IT/OT Convergence: Risks at the Interface Between Office and Production

Two Worlds That Should Never Have Been Separated

When you walk through the production hall of a mid-market manufacturing company and then back to the office, you cross a boundary that technically no longer exists. The CNC machine in the hall gets its order data from the ERP system in the data center. The MES (Manufacturing Execution System) monitors production progress and reports it back to order management. The maintenance technician checks equipment condition via a dashboard on their tablet, reading sensor data from the controller in real time.

The technical convergence is already a reality. But the organizational structures, security concepts, and mental models of the people involved are lagging behind. It is precisely in this gap that the risks arise that this article addresses.

Why IT and OT Are Growing Together

The convergence of IT and OT is not an end in itself and not merely a technology trend. It is driven by concrete business requirements:

Industry 4.0 and Data-Driven Manufacturing

Modern production optimization is based on data. To shorten cycle times, reduce scrap, and identify bottlenecks, production data must be available in real time. This is only possible when the control systems in production communicate with the analytics and planning systems in IT.

A mid-market plastics processor, for example, captures temperature, pressure, and cycle time at every injection molding machine. This data flows into an MES that optimizes production and detects quality deviations early. Without the connection between OT (machine control) and IT (MES, ERP), this would not be possible.

Predictive Maintenance

Instead of maintaining machines on rigid schedules, modern systems analyze vibration patterns, temperatures, and power consumption to determine the optimal maintenance timing. The sensor data comes from the OT world; the analysis runs in IT (often in the cloud). Predictive maintenance can reduce maintenance costs by 25 to 30 percent and unplanned downtime by up to 70 percent. Those are numbers every CFO understands.

Digital Twins

A digital twin is a virtual replica of a physical asset, fed in real time with data from production. It enables simulations, optimizations, and fault analyses without affecting the real equipment. Digital twins require a continuous, bidirectional data stream between OT and IT.

Remote Operations and Distributed Sites

Mid-market companies with multiple production sites or international locations need centralized access to production data. Engineers at headquarters monitor equipment at remote sites, adjust parameters, and diagnose faults remotely. This saves travel costs and accelerates troubleshooting, but requires secure connections between local OT networks and centralized IT systems.

Regulatory Drivers

Regulation is also driving convergence. The EU Machinery Regulation 2023/1230, which replaces the previous Machinery Directive from 2027, explicitly requires that networked machines are protected against unauthorized digital access. This presupposes that the networking is known, documented, and secured — meaning deliberate IT/OT integration rather than uncontrolled mixing.

The Historical Separation and Its Remnants

To understand today's problems, a brief look at history is worthwhile. Until the 2000s, OT systems were largely isolated. They used proprietary protocols (Profibus, Modbus RTU over serial connections), proprietary hardware, and were physically separated from the office network. Cybersecurity was not an issue because there was no attack surface.

This isolation dissolved in several waves:

First wave (2000s): Industrial protocols migrated to Ethernet. Modbus TCP, Profinet, EtherNet/IP replaced serial connections. Suddenly, OT devices could communicate over standard network infrastructure.

Second wave (2010s): Windows-based HMIs and engineering workstations became the norm. SCADA servers ran on commodity server hardware with Windows operating systems. IT-typical vulnerabilities moved onto the production floor.

Third wave (2020s): Cloud connectivity, IoT sensors, and edge computing. Data flows directly from production into cloud platforms for analytics, monitoring, and optimization. The boundary between IT and OT blurs completely.

What has remained are the organizational structures. In many companies, there is still a clear separation: the IT department takes care of servers, networks, and clients. Production engineering takes care of machines and controls. In between lies a no-man's-land that nobody truly feels responsible for. That is exactly where the risks lie.

Risks at the Interface

The convergence of IT and OT creates risks that do not exist in either world alone. They emerge precisely at the handover points.

Lateral Movement: From the Office to the Production Floor

The most common attack scenario: an attacker first compromises an IT system (for example through a phishing email to a finance department employee). From there, they move laterally through the network until they find the connection to the OT world. If segmentation between IT and OT is insufficient, they can move from a compromised office PC directly to SCADA servers or engineering workstations.

The Colonial Pipeline attack in 2021 is a prominent example. Technically, only the IT side was compromised (billing system). But because the company was not sure whether the attacker had also penetrated OT systems, the pipeline was shut down as a precaution. The economic damage was not caused by the attack on OT but by the uncertainty about the IT/OT boundary.

Protocol-Bridging Attacks

At the interfaces between IT and OT sit systems that bridge both worlds: MES servers, OPC-UA gateways, historian databases, or MQTT brokers. These systems speak IT protocols (TCP/IP, HTTPS, SQL) on one side and OT protocols (Modbus, Profinet, S7comm) on the other.

An attacker who compromises such a bridge server can cross protocol boundaries. They attack via the IT side and use the OT interface to send control commands. In doing so, they may bypass firewalls that block direct IT-OT traffic but trust the bridge server.

Supply Chain Risks via Maintenance Access

Machine manufacturers and maintenance service providers need access to OT systems, often through the IT network. A structured supplier management approach helps control these connections. When a service provider is compromised, the attacker can reach the customer's OT environment through the provider's maintenance access. This risk is amplified by convergence because maintenance connections today typically run as VPN tunnels through the IT infrastructure.

Misconfigurations at Handover Points

Every interface between IT and OT requires firewall rules, access controls, and monitoring. In practice, these handover points are often poorly documented and inadequately secured. Reasons include: IT firewall administrators do not understand which OT protocols need which ports and why. OT technicians request "just open the port so the machine works" and IT complies without questioning. Temporary rules created for commissioning are never removed.

Cascading Effects

Convergence creates dependencies that can lead to cascading effects during an incident. Example: a ransomware attack encrypts the Active Directory server. Because the HMI panels in production authenticate via Active Directory, operators can no longer log in. The machines are still running, but nobody can operate or monitor them. An IT disruption becomes a production shutdown without the OT systems themselves being affected.

Solution Approaches: Secure Convergence Instead of Blind Separation

The answer to the risks of IT/OT convergence is not to separate the systems again. That would be neither practical nor economically sensible. The answer is a deliberate, controlled convergence with clear security mechanisms.

Defense in Depth

The underlying principle is defense in depth: multiple security layers that stop an attacker even when a single layer fails. In IT/OT convergence, this means:

Layer 1 — Network zones and segmentation: Divide IT and OT into clearly defined network zones, with firewalls at the transitions. The Purdue Model (or its modern variants) provides a proven structure for this.

Layer 2 — Demilitarized zone (DMZ): Establish a DMZ between IT and OT where bridge systems reside (MES, historian, OPC-UA gateway). No direct traffic from IT to OT. All data flows run through the DMZ.

Layer 3 — Access control: Clear rules on who may access which systems. Separate accounts for IT and OT administration. Multi-factor authentication for all remote access.

Layer 4 — Monitoring and detection: Separate monitoring systems for IT and OT, but with centralized correlation. When an attack is detected in the IT network, the OT security team must be immediately informed and vice versa.

Layer 5 — Incident response: An integrated incident response plan covering both worlds. Clear escalation paths and predefined decision criteria (when to shut down production, when not).

Defined Handover Points (Conduits)

Every data flow between IT and OT runs through a defined handover point (conduit). For each conduit, document:

• What data flows in which direction?
• What protocol is used?
• What systems are involved?
• What firewall rules apply?
• Who approved the conduit?
• When was it last reviewed?

This documentation is important not only for security but also for troubleshooting. When a connection between IT and OT is disrupted, you need a current overview of all legitimate data flows. In ISMS Lite, IT and OT assets can be documented in a shared register along with their interfaces, data flows, and dependencies.

Joint Governance

Perhaps the most important measure is organizational: establish a joint governance structure for IT/OT security. This can be a joint security board, regular coordination meetings between IT security and production engineering, or a dedicated OT security coordinator who connects both worlds.

In practice, the following model has proven effective: the CISO (Chief Information Security Officer) is responsible for the entire ISMS, including OT. For operational OT security, there is an OT security coordinator from the production engineering team who contributes local expertise. Both work closely together and report jointly to executive management.

Risk-Based Prioritization

You cannot address all risks simultaneously. Prioritize based on impact. The most critical interfaces are typically:

1. ERP-to-MES connection: This is where order data flows into production. A failure stops manufacturing.
2. Remote maintenance connections: Direct access from outside to OT systems. Highest compromise risk.
3. Cloud connections: Data flows from production to cloud platforms. Often inadequately secured.
4. Historian/data archive: Collects production data from the entire plant. Compromise gives the attacker a complete overview.

Practical Implementation: Four Phases

Phase 1: Inventory (4 weeks)

Document all connections between IT and OT. Inventory the bridge systems. Create a network diagram that maps both worlds. Identify the critical handover points. In this phase, the goal is only visibility — not yet measures.

Phase 2: Risk Assessment (4 weeks)

Assess the identified interfaces by risk. Consider both the likelihood of occurrence (how easily can an attacker exploit this interface?) and the impact (what happens if they do?). Prioritize the top 10 risks.

Phase 3: Quick Wins (8 weeks)

Implement the measures that deliver the greatest security gain with manageable effort. Typically: tighten firewall rules between IT and OT, secure remote maintenance connections, establish monitoring at critical handover points, change default passwords on bridge systems.

Phase 4: Systematic Hardening (ongoing)

The long-term work: build a DMZ, formally document conduits, expand monitoring, introduce change management for IT/OT interfaces, establish regular reviews.

Documenting IT/OT Interfaces

Clean documentation of all IT/OT interfaces is not bureaucratic overhead but a critical security tool. Without this documentation, you do not know during an incident which paths an attacker can take and which systems you need to isolate.

What to Document for Each Interface

Technical description: Which systems are connected? Over which protocol? Over which ports? In which direction does data flow? Is there encryption? Is there authentication?

Business purpose: Why does this connection exist? Which business process depends on it? What happens if the connection is interrupted? How long can the business process continue without this connection?

Responsibilities: Who set up the connection? Who is responsible for maintenance? Who decides whether to sever it during an incident? Who is the technical contact on the IT side and on the OT side?

Security measures: Which firewall rules apply? Is there IDS/IPS? Is traffic logged? When was the configuration last reviewed?

Risk assessment: What risk does this interface carry? How likely is a compromise? What would the impact be?

Typical Interfaces in a Mid-Market Manufacturing Company

In practice, you will typically find the following IT/OT interfaces in a mid-market company:

This list is not exhaustive, but it gives you a starting point for your own inventory.

The Cultural Dimension

Technically securing the IT/OT interfaces is only half the battle. The other half is the cultural integration of both worlds.

IT teams and OT teams have different backgrounds, different priorities, and often a different understanding of "security." The IT security expert thinks of firewalls and endpoint protection. The automation engineer thinks of protective devices and functional safety. Both are right — and both have blind spots.

Joint workshops. Organize regular workshops where IT and OT teams work together on concrete scenarios. What happens when the ERP server is compromised? How does that affect production? What happens when a PLC is manipulated? How does IT detect it? These scenarios build understanding for the other perspective.

Cross-team job shadowing. Invite IT staff to spend a day on the production floor. And invite production engineers to spend a day in IT operations. Nothing breaks down silos faster than personally experiencing the other world.

Joint incident response exercises. When an incident affects both worlds, both teams must collaborate. Practice this before it happens. An annual tabletop exercise with an IT/OT crossover scenario is an investment that pays off a hundredfold in an emergency.

The Role of Regulation

The EU Machinery Regulation 2023/1230 is an important driver of secure IT/OT convergence. It requires that machines with digital elements must be designed so that their safety functions cannot be impaired by unauthorized digital access. In practice, this means: if a machine has a network connection (and most modern machines do), that connection must be protected against misuse.

For machine operators, this creates a duty of care: you must know the network connections of your machines, assess the risks, and take appropriate protective measures. The regulation thus complements the requirements of NIS2, which requires risk management for all network and information systems on the operator side.

The Cyber Resilience Act also indirectly addresses the IT/OT interface. Manufacturers of products with digital elements (which includes industrial control systems) must ensure that their products can interact securely with other systems. For machine operators, this means that the OT products they buy from 2027 onward will have better security properties. But the responsibility for secure integration into their own IT landscape remains with the operator.

The message is unambiguous: uncontrolled IT/OT convergence will no longer be tolerated by regulators. The connection between office and production must be deliberately designed, documented, and secured.

Further Reading

• OT Security for Mid-Market Companies: Why Production Controls Belong in Your ISMS
• The Purdue Model Explained: Network Zones in Production
• Securing SCADA and PLC: Practical Measures Without Production Stops
• Patch Management in OT: When You Cannot Simply Update
• Risk Assessment for OT Systems: Different Priorities Than in IT