Access
IIoT Edge Gateway
A device collecting OT data and forwarding it to cloud or enterprise analytics, sometimes with edge compute.
High criticalityLevel 3.5 and above
What it does
Reads process data, buffers, transforms and publishes it outward — occasionally supports inbound commands.
Typically locatedPlant edge, DMZ, or attached directly to machines by vendors.
At a glance
PurdueLevel 3.5 and above
CategoryAccess
Protocolsmqtt, opc-ua, amqp, modbus-tcp
Talks toControllers, Cloud services, Broker infrastructure
Common vendorsSiemens (SIMATIC Industrial Edge), Rockwell Automation (FactoryTalk Edge), Schneider Electric (EcoStruxure Machine Advisor), ABB (Ability Edgenius), Multiple
Why should I care?
IIoT Edge Gateway sits at Level 3.5 and above. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Vendor-installed cellular connectivity bypassing site network controls
- Inbound command channels enabled by default
- Unmanaged patching by a third party
If it is compromised
- An external path into the control network
What to monitor
- Outbound destinations
- Inbound command usage
- Firmware/agent updates
- Cellular link presence
How to defend it
- Outbound-only data flow through the DMZ
- Ban unmanaged cellular in control zones
- Contractual patching and access terms
Hunting
Hunt ideas for this component
Related