<p id="isPasted">In the modern, everything-is-connected era, security isn’t just an issue for information technology (IT) and networking specialists but a shared concern across disciplines and job functions.</p><p>Traditionally, cybersecurity has focused on building a fortified network perimeter. Once users or devices gained access to the network, they were assumed to be trustworthy. But that model is no longer sufficient.</p><p>Consider a modern manufacturing facility. There may be hundreds of Internet of Things (IoT) sensors transmitting data to cloud analytics platforms. Engineers might remotely monitor diagnostics from home offices. Third-party vendors could access equipment for routine maintenance. Every one of these connections represents a potential vulnerability. In such an environment, there is no longer a meaningful "inside" or "outside" the network.</p><p>To draw an analogy, the traditional approach embodied a "castle-and-moat" philosophy. Anyone outside the castle — i.e., outside the security perimeter — was treated as a potential threat, while anyone inside the castle walls was deemed trustworthy.</p><p>Today’s digital landscape more closely resembles a sprawling city built around that castle. The defensive moat can no longer enclose every system, device, or user. Instead, each resource must be protected individually, such as by requiring an ID check at the entrance to every building.</p><p>This is the premise of zero trust architecture (ZTA), a cybersecurity model based on the principle of "never trust, always verify." Under ZTA, users and devices are not trusted by default, regardless of their network location. Instead, each request to access a resource is evaluated in real time.</p><p>This architectural shift extends far beyond traditional IT teams. Automotive engineers designing connected cars, industrial control specialists securing power plants, and healthcare developers building IoT medical devices all need ZTA principles to protect their systems from modern threats.</p><p>This article will explore how implementing this new approach requires both technological evolution and a fundamental reassessment of how we secure digital interactions in an increasingly connected world.</p><h2>Four Core Concepts Underpinning Zero Trust Architecture</h2><p>In traditional security models, access was typically granted based on network location —  whether a user or device was inside the corporate network. Firewalls and virtual private networks (VPNs) created barriers at the perimeter, and once users made it past those defenses, they often had broad access to internal systems.</p><p>A critical weakness in this approach is that once an attacker breaches the perimeter, they can move throughout the network. This lateral movement is particularly dangerous in operational technology (OT) environments where systems control physical processes. In a power plant, for example, an attacker who compromises one system could potentially navigate to critical control systems, threatening not just data but physical infrastructure and public safety.</p><p>ZTA flips this model by making identity, not location, the foundation of security decisions. Every access request is evaluated based on who is asking, what they are asking for, and the context surrounding the request. This architecture is built on the following four key principles.</p><h3>Identity Verification and Continuous Authentication</h3><p>Every user and device must prove their identities. This verification is not a one-time event; it continues throughout the session. Access can be revoked immediately if risk signals emerge, such as a login from an unusual location or an outdated security patch.</p><h3>Micro-Segmentation</h3><p>Networks are divided into small, secure zones. Even if attackers compromise one zone, they cannot easily move into others. In smart factories, for example, micro-segmentation can prevent a breach in a quality control system from affecting production machinery or safety-critical controls.</p><h3>Least Privilege Access</h3><p>Users and devices are granted only the minimum permissions necessary to complete their tasks. An accounting employee, for instance, does not need to access engineering servers, and vice versa. This restriction limits the damage that can result from compromised credentials or insider threats.</p><h3>Continuous Monitoring and Risk Assessment</h3><p>Access control is dynamic, guided by ongoing analysis of user behavior, device posture, and system health. Monitoring tools feed risk models that adjust permissions in real time based on shifting conditions.</p><p>To extend our city analogy, compare ZTA to the procedures researchers might follow at a high-security facility:</p><ul><li>Employees must present their IDs (<strong>Figure 1</strong>) every time they enter the building, whether at the start of the day or just returning from a coffee break (i.e., identity verification and continuous authentication).</li><li>Researchers have exclusive access to the floor where their labs are located (i.e., micro-segmentation).</li><li>Researchers can access only the specific labs needed for their work (i.e., least privilege access).</li><li>Employees’ activities are monitored, and their security clearances are reviewed regularly (i.e., continuous monitoring and risk assessment).</li></ul><p><em><span class="fr-img-caption fr-fic fr-dib"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1784038913791-Figure+1.jpg" style="width:100%px" class="fr-fic fr-dib" alt="Figure 1: Access starts with identity. Zero trust ensures every badge, device, and user is verified before entry. (Source: spyrakot/stock.adobe.com; generated with AI)" /><span class="fr-inner"><em><strong>Figure 1:</strong> Access starts with identity. Zero trust ensures every badge, device, and user is verified before entry. (Source: spyrakot/stock.adobe.com; generated with AI)</em></span></span></span></em></p><p>The goal of ZTA is not simply to block unauthorized access, but to enforce fine-grained, context-aware controls that adapt to changing conditions.</p><h2>Key Architectural Components</h2><p>To achieve this goal, a ZTA environment is built around three functional pillars: establishing identity, enforcing access, and continuously monitoring for risk (<strong>Figure 2</strong>).</p><p><span class="fr-img-caption fr-fic fr-dib"><span class="fr-img-wrap"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1784038986345-1784038986345.png" class="fr-fic fr-dib" alt="Figure 2: Zero trust is not built on a single solution; it stands on three foundational pillars that work together to secure identity, control access, and monitor continuously. (Source: Mouser Electronics/Author)" /><span class="fr-inner"><em><strong>Figure 2:</strong> Zero trust is not built on a single solution; it stands on three foundational pillars that work together to secure identity, control access, and monitor continuously. (Source: Mouser Electronics/Author)</em></span></span></span></p><h3>Establish Identity: Who or What Is Asking for Access?</h3><p>Zero trust begins with verifying both users and devices. Identity providers (IdPs) handle this process, often using familiar tools like multi-factor authentication (MFA). This role is often filled by enterprise identity and access management (IAM) platforms that manage access across an organization.</p><p>However, even a trusted user can become a risk if their device is vulnerable. To combat this, device posture checks ensure systems meet security requirements like recent operating system (OS) patches or up-to-date antivirus software. These checks may be built into IdPs or managed through endpoint security platforms.</p><h3>Enforce Access: What Can They Do, and Where Can They Go?</h3><p>Once identity is confirmed, the system must decide what level of access to allow. Policy decision points (PDPs) evaluate each request using pre-defined rules. Policy enforcement points (PEPs) act on those decisions as gates that allow or block access. Enforcement can happen within apps, network devices, or dedicated gateways.</p><p>Consider a technician trying to update a control system. They might be allowed access from a company laptop during work hours, but not from a personal device at 3 a.m.</p><p>A key enforcement tool is the software-defined perimeter (SDP). Unlike VPNs that expose entire networks, SDPs create secure, encrypted tunnels to specific resources. For example, the technician can see only the industrial control system; the rest of the factory network remains invisible and inaccessible.</p><h3>Monitor Continuously: Are Conditions Still Safe?</h3><p>ZTA does not stop at the access decision; it requires ongoing assessment. Systems like security information and event management (SIEM) platforms and user and entity behavior analytics (UEBA) continuously monitor users, devices, and activity for signs of risk.</p><p>These tools detect anomalies, trigger additional verification steps, and adapt access policies as needed. For example, a user showing unusual behavior — such as downloading large files outside business hours — might be prompted for re-authentication or temporarily restricted.</p><h2>Common Implementation Challenges</h2><p>This all sounds great in theory, but organizations adopting ZTA typically encounter several significant obstacles in practice.</p><p>First, you cannot protect what you cannot see. Many environments, like factories, hospitals, and rail systems, contain legacy equipment deployed before widespread connectivity. The existence of these systems may not be documented, and therefore, neither are their vulnerabilities.</p><p>Then, organizations must determine how to secure these systems. Many legacy systems run decades-old software or use proprietary equipment with limited security capabilities. Retrofitting them for ZTA often requires creative approaches, such as implementing security gateways that mediate access to legacy equipment without requiring modifications to the equipment itself.</p><p>Segmentation is another common pain point. While micro-segmentation is a core ZTA principle, excessive segmentation can create performance bottlenecks and administrative overhead. Security benefits must be balanced against operational impacts, particularly in time-sensitive control systems.</p><p>Perhaps the most significant challenge is cultural: ZTA requires different workflows that can disrupt established practices. Users accustomed to relatively free access may resist the new safeguards.</p><p>To promote adoption, organizations must make implementation as user-friendly as possible and clearly explain how users benefit from enhanced security. This might include demonstrating how ZTA can improve the user experience by enabling secure remote access to resources that previously required physical presence.</p><h3>Deployment Strategies</h3><p>Implementing ZTA across an entire organization is rarely feasible in a single step. Instead, a phased rollout reduces risk and allows policies to be validated in controlled environments.</p><p>For example, a power utility might start by securing remote access to its supervisory control and data acquisition (SCADA) systems with strong authentication and limited access rights. Over time, it could extend ZTA principles to internal operations, implementing micro-segmentation between control systems and establishing continuous monitoring for anomalous behavior.</p><p>This measured approach allows organizations to access security benefits while managing the practical challenges of transformation. The goal is not perfect security, but a security posture that continuously improves and adapts to evolving threats.</p><h2>Conclusion</h2><p>ZTA offers a powerful framework for securing modern systems, but effective implementation requires careful planning, collaboration across teams, and a shift in how organizations think about trust, access, and security.</p><p>For engineers and architects tasked with protecting today’s connected environments, now is the time to evaluate existing systems, identify high-risk assets, and begin laying the foundation for ZTA. All players must see security as part of their core responsibilities.</p>

Learn why zero trust architecture is the new cybersecurity standard for securing users, devices, applications, and connected systems.

Why Zero Trust Architecture Is the New Cybersecurity Standard

<p id="isPasted">Industrial systems are entering a new era where the boundaries between the digital and physical worlds are no longer clear lines but shared fault zones. As factories, utilities, and infrastructure providers embrace smarter automation and tighter connectivity, they also inherit a challenge that grows in lockstep with their technological progress: the urgent need to defend the machinery that powers modern life. What once operated behind closed networks and air-gapped systems is now intertwined with cloud platforms, remote sensors, and global data flows, creating opportunities for efficiency — and vulnerabilities that didn’t exist a decade ago.</p><p>In this environment, cybersecurity is no longer just a concern for information technology (IT) departments. It has become a frontline requirement for engineers, operators, and policymakers working to keep critical infrastructure safe. The evolution toward Industry 5.0 highlights not only the value of human-centric design and sustainability but also the necessity of resilience, ensuring that the physical backbone of society can withstand the digital threats that now surround it. The European Union’s Network and Information Security 2 (NIS2) Directive reflects this shift, pushing organizations to rethink how they protect operational technology (OT) and reinforcing that safeguarding industrial systems is as essential as maintaining the machines themselves.</p><p>OT — which concerns the processes and physical equipment that perform actions such as moving water through treatment plants, monitoring factory temperatures, and controlling turbines in power stations — is becoming increasingly interconnected. This connectivity opens doors to efficiency and insight, but it also exposes systems to a growing and dangerous digital threat landscape.</p><p>This blog explains why OT cybersecurity is suddenly on the front lines, how regulations are evolving, and what engineers and organizations must do to stay resilient.</p><h2>The New Reality of Connected Industry</h2><p>A decade ago, most industrial systems were isolated from the outside world. Their priority was reliability, not connectivity. But Industry 4.0 introduced real-time data sharing across millions of sensors, controllers, and machines. This change allowed companies to reduce waste, optimize output, and predict maintenance issues before they occurred.</p><p>However, this rapid expansion came with a hidden cost: Billions of devices that were never designed with security in mind suddenly became exposed to the internet.</p><p>And attackers noticed.</p><p>Recent findings show that 62 percent of water and electricity operators in the US and UK faced cyberattacks in 2024, and many incidents went undetected because companies lacked the tools or expertise to identify them. The threat is no longer theoretical—it’s at our doorsteps.</p><p>Some examples read like scenes from a cyber-thriller. A casino’s network was breached through a smart thermometer in a fish tank. In another case, a hacker attempted to contaminate a Florida town’s drinking water by infiltrating the supervisory control and data acquisition (SCADA) system of a treatment plant. Attacks also occurred on nation-states, such as the 2022 cyberattack on an Iranian steel facility that caused a massive fire.</p><p>These events underscore a simple truth: OT cybersecurity is no longer about protecting data; it’s about protecting people, infrastructure, and entire economies.</p><h2>NIS2: Europe’s Push for Stronger Cyber Defense</h2><p>Recognizing the rising threat, the EU expanded its original NIS1 Directive into the far more comprehensive NIS2, implemented in January 2023.</p><p>NIS2 casts a significantly wider net than its predecessor. Industries such as public communications, wastewater management, manufacturing, transportation, postal services, and space operations now fall under stricter cybersecurity requirements. Medium and large organizations must comply, and severe penalties can follow non-compliance.</p><p>A key shift in NIS2 is accountability: Senior leadership is now directly responsible for cybersecurity readiness. Companies must be able to demonstrate:</p><ul><li>Proactive risk-management strategies</li><li>Rapid incident reporting within 24 hours</li><li>Clear recovery and continuity plans</li></ul><p>Supervision, enforcement, and even peer-review mechanisms have been introduced to ensure organizations take these responsibilities seriously.</p><h2>Building Resilience in a Hyperconnected World</h2><p>While NIS2 lays out the requirements, implementing effective OT cybersecurity requires several foundational practices that mirror — but are not identical to — traditional IT security practices.</p><h3>Know What You’re Protecting</h3><p>A modern industrial site may contain thousands of networked devices, many of which are replaced or updated regularly. Creating an up-to-date inventory is essential to identifying vulnerabilities and prioritizing protections.</p><h3>Adopt Zero-Trust Principles</h3><p>Zero trust assumes no user or device is trustworthy by default. Practices such as multi-factor authentication, secure remote access for maintenance vendors, and detailed logging help prevent unauthorized entry.</p><h3>Patch Without Disruption</h3><p>OT systems often run around the clock. Shutting them down for updates isn’t always possible. Effective cybersecurity requires carefully planned maintenance windows, offline testing, and fallback procedures.</p><h3>Segment and Isolate</h3><p>Separating critical OT assets from main networks can prevent attackers from moving laterally through a system — a common technique in advanced cyberattacks.</p><h3>Continuously Monitor and Assess</h3><p>Because threats evolve rapidly, cybersecurity cannot be a one-time effort. Techniques like risk modeling, simulated attacks, and compliance checks help ensure ongoing readiness.</p><h3>Train the Teams</h3><p>Human error remains one of the biggest vulnerabilities. Regular training, threat-awareness programs, and collaboration between IT and OT teams strengthen organizational defenses.</p><h2>What’s at Stake</h2><p>Industry 5.0 promises smarter, more adaptable industrial ecosystems, but without robust cybersecurity, that promise falls apart. As OT and IT continue to merge, risks expand. A single breach can stop production lines, cause environmental damage, or even threaten public health. The stakes are simply too high for cybersecurity to remain an afterthought.</p><p>The frameworks and technologies exist. Their success depends on commitment to continuous improvement, collaboration across teams, and investment in resilience.</p><h2>Conclusion</h2><p>Industrial cybersecurity has grown beyond a technical problem to become a societal responsibility. As we usher in Industry 5.0, resilience becomes the core of sustainable progress. By understanding the evolving threat landscape and embracing directives like NIS2, organizations can safeguard their operations and the communities that depend on them.</p><p>For a deeper dive into this topic, read the full article, “<a href="https://resources.mouser.com/iiot/protecting-industrial-infrastructure-with-nis2" target="_blank">Protecting Industrial Infrastructure with NIS2</a>.”</p>

Global IoT Connectivity

ORGANIZATIONS. SHAPING THE INDUSTRY.

Latest Posts

Why Zero Trust Architecture Is the New Cybersecurity Standard

Why Industrial Cybersecurity Matters in the Age of NIS2