The Great IT vs. OT Divide

For decades, Information Technology (IT) and Operational Technology (OT) have existed in parallel universes. IT lives in temperature-controlled server rooms, dealing with enterprise systems like SAP, Apache Kafka, and AWS. They prioritize data accessibility, rapid iterations, and large scale.

OT, on the other hand, lives on the roaring, gritty factory floor. Their world revolves around PLCs, robotics, SCADA systems, and high-voltage machinery. They prioritize one thing above all else: High Reliability and Physical Safety.

Today, "Industry 4.0" demands that these two departments merge-a concept known as IT/OT Convergence. Management wants to stream real-time PLC counts into the cloud ERP to predict supply chain shortages. However, when the IT department asks OT to "just open a firewall port to the Siemens PLC," the OT team flatly refuses, citing massive cybersecurity risks. And they are right.

So, how do you bridge the gap?

Observed performance depends on workload shape, node capacity, and deployment design.

The Wrong Way: Point-to-Point Spaghetti

The historical approach to IT/OT integration was point-to-point. If the Quality team needed SPC (Statistical Process Control) data, a custom script was written to bridge the PLC directly to the quality database. If Finance needed energy consumption data, another script was strung from the smart meter directly to the ERP.

This creates an unmaintainable "spaghetti architecture". It is fragile, difficult to scale across multiple factories, and in many deployments it leads to multiple inbound firewall exceptions.

The Right Way: The Unified Namespace (UNS)

The modern approach to convergence relies on a Unified Namespace (UNS). A UNS acts as a single, centralized message broker (typically MQTT-based) that represents the current state of your entire business.

Instead of writing custom scripts for every application, the OT side publishes data to the UNS in a standardized format. The IT side then subscribes to the UNS to consume that data.

Why does this matter? It creates a clean decoupling of systems. The SAP ERP doesn't need to know the IP address of a robot on the floor, and the robot doesn't care if the ERP goes down for maintenance. They both only talk to the central UNS.

Solving Security Risk: "Outbound-Only" Architecture

Even with a UNS, the physical mechanism of extracting data from a PLC typically should be flawless. You cannot expose an industrial control network (Level 1/2 of the Purdue Model) to the internet.

This is where the Proxus IT/OT Bridge relies on strict Outbound-Only architectural principles to keep the factory safe:

1. No Inbound Ports: The Proxus Edge Gateway sits on the factory floor. It reaches out into the OT network via industrial protocols (like OPC UA or Modbus) to read data.
2. Streaming "Up": Crucially, the Edge Gateway then establishes an outbound TLS 1.3 encrypted connection to the central platform (or cloud). Because the connection originates from inside the firewall, there are zero inbound open ports required on the factory network.
3. Read-Only Traffic: By default, data flows up (from OT to IT). If control writes are strictly necessary, they are funnelled through hyper-governed, audited pipelines-but in 95% of use cases, enterprise systems like Kafka or AWS only need to read the data.

Data Normalization: Speaking the Same Language

Even if the pipeline is secure, raw OT data is often useless to IT. A PLC might output a tag named DB40.DBD12 which means nothing to a cloud developer.

A true IT/OT Convergence platform typically should translate this raw signal. Before Proxus routes data to enterprise targets, it Normalizes the Tags. It transforms DB40.DBD12 into a clean, contextualized payload like SiteA / Line1 / Press_Machine / Temperature_C.

When the IT systems (like a Data Lake or AI platform) receive this data, it is already clean, structured, and ready for analytics.

Conclusion

True IT/OT Convergence isn't just about stringing cables between the factory network and the corporate cloud. It is about building a secure, governed bridge that respects the priorities of both departments.

By utilizing a Unified Namespace, enforcing Outbound-Only network policies, and automatically Normalizing Data, organizations can improve data availability for Enterprise systems while preserving stronger Shop Floor security boundaries.

When this may not be suitable

• Lower-frequency telemetry may not justify full distributed complexity.
• Small single-line plants may prefer simpler architectures first.
• Strict legacy constraints may require phased adoption.
• Safety-critical closed-loop control should remain in PLC/Safety PLC layers.

Outcomes depend on workload profile, hardware capacity, and deployment topology.

Frequently Asked Questions

What does "outbound-only" mean in IT/OT convergence?

The Edge Gateway initiates all connections outward from the OT network to the IT/cloud layer. No inbound ports are opened on the factory firewall. This significantly constrains direct reverse traversal from IT/cloud into OT, but does not replace credential hygiene, segmentation, and monitoring controls. It is a foundational network-security pattern in industrial IoT.

Who should own the IT/OT bridge - IT or OT?

Neither exclusively. Best practice is a cross-functional team with OT owning the edge configuration (protocols, tag mapping) and IT owning the cloud infrastructure (broker, data lake, IAM). The Unified Namespace serves as the shared contract between both teams.

How does data normalization work at the edge?

Raw PLC addresses (e.g., DB40.DBD12) are mapped to semantic topic paths (e.g., SiteA/Line1/Press/Temperature_C) with engineering unit conversion, timestamp enrichment, and data type standardization. This happens inside the Edge Gateway before data leaves the OT network - see OT DataOps for the full pipeline.

References

1. IEC 62443 - Industrial cybersecurity framework defining security zones and conduits for IT/OT network segmentation.
2. ISA-95 / IEC 62264 - Defines the functional hierarchy (Levels 0–4) that the IT/OT bridge spans.
3. NIST SP 800-82 - Guide to Industrial Control Systems Security, foundational for OT network protection strategies.

Explore the Proxus IT/OT Bridge Architecture →