Learn Automation with MINATA #59: IIoT Connectivity — Start From the Data Question and the Security Boundary

IIoT Connectivity: Start From the Data Question and the Security Boundary

IIoT connectivity starts with two questions: which data do you need, and where does the security boundary sit. Putting a machine online "to have data" without answering those two is the fastest way to create a security risk for the whole plant.

Start from the data question

Decide in advance which data goes up — state, output, alarms, energy — how often, who uses it and what for. Most of the value of IIoT comes from a small, well-chosen set of data, not from pushing every tag to a cloud service. Sending less, but the right less, also reduces network load and the risk of exposing information.

The security boundary is not optional

Never open a port from the internet straight into a PLC. Remote access needs an architecture, authentication, access control and an audit log, in line with the organisation's policy. The usual model is a gateway or DMZ: field devices talk to the gateway, and only the gateway sends outward, in a controlled direction with controlled rights. The PLC is never exposed directly to a public network.

Keep control and safety at the machine layer

Real-time control and safety functions belong at the machine, independent of any cloud connection. If the internet is lost, the machine must keep running correctly and safely; IIoT loses the ability to send data, not the ability to operate. Never move a safety decision or immediate logic onto a network layer that has latency.

A worked engineering situation

A gateway sends only state, output and a selected set of alarms up for monitoring. The PLC runs independently if the internet drops; remote support, when needed, goes through an approved channel with authentication and logging, not a permanently open port. The plant gets the data it needs for improvement without enlarging its attack surface.

The connection architecture, the access rights and the security measures all follow the organisation's security policy and the requirements of the system.

Common mistakes

Opening a port from the internet directly into a PLC.
Pushing every tag to the cloud instead of choosing the data that is needed.
Moving immediate logic or safety onto a network layer with latency.
Remote access without authentication and without an audit trail.
Making the machine depend on the cloud, so losing the internet stops production.

IIoT connectivity checklist

[ ] The data to send was chosen against a goal, rather than sending everything.
[ ] No port is open from the internet into the PLC.
[ ] A gateway or DMZ is used, with authentication, access control and auditing.
[ ] Control and safety stay at the machine layer and survive a lost connection.
[ ] Remote access goes through a channel approved under the organisation's policy.

Connectivity with a clear boundary is what makes it both safe and durable. #60 closes this stretch with the roadmap of an automation project: settle the requirement before settling the equipment.

Read more automation knowledge at MINATA: https://minatavn.com/en/blog/industrial-automation

Previous — #58: OEE data: https://minatavn.com/en/blog/automation-58-oee-data

Next — #60: The automation project roadmap: https://minatavn.com/en/blog/automation-60-automation-project-roadmap

View all MINATA technical articles