How Do You Share OT Data Without Letting IT Touch OT?
IT wants the data.
OT needs isolation, predictability, and control.
As organizations look for more ways to use operational data for analysis, decision-making, and long-term planning, those two priorities can collide.
Operational technology (OT) systems have a very different job from information technology (IT) systems. IT is designed around managing and making information available. OT controls physical equipment and processes, where uptime, safety, and precise timing can be critical.
So how do you give IT access to valuable OT data without allowing IT activity to interfere with the systems running the operation?
I believe an in-memory Network Cache can provide the bridge.
Two Requirements I Won't Compromise
My background is in real-time control engineering. I write software for OT systems controlling equipment where things need to happen on a tight schedule.
From that perspective, I see two major requirements for sharing data between OT and IT.
First, IT cannot be allowed to affect OT performance.
If an OT system is controlling expensive equipment or managing time-critical operations, sending data to IT can't interfere with those responsibilities. Sharing information is useful. Maintaining control of the physical system is essential.
Second, sharing data cannot unnecessarily expose the OT environment to additional security risk.
That's particularly important because OT systems can have very different security constraints from traditional IT. Industrial equipment may operate continuously, remain in service for many years, and be difficult to update or take offline.
Simply connecting everything together isn't the answer.
Build a Bridge, Not a Direct Connection
The architecture I've been working with takes a different approach.
Instead of having IT systems communicate directly with the OT systems, we use an in-memory Network Cache as the data-sharing bridge between the two environments.
Think of it as a controlled buffer.
On the OT side, operational systems publish the data that needs to be shared to the Network Cache. On the IT side, authorized systems can access that data without reaching back into the OT equipment that generated it.
The Network Cache machine can be configured similarly to a DMZ, with separate physical network connections for the OT and IT sides and tightly limited network access.
The result is separation between the two environments while still allowing large amounts of useful data to move from OT to IT with very low latency.
For applications requiring even greater isolation, a Cache replica can add another layer between the IT-facing system and the OT environment.
The objective isn't to claim that any architecture eliminates security risk. It is to reduce the attack surface, maintain separation, and tightly control how information moves between the two environments.
Why the Buffer Matters
The Cache isn't simply a doorway through which data passes.
It acts as a large, high-speed buffer.
That's important because OT and IT don't necessarily need data in the same way or at the same pace.
The OT system can concentrate on its primary job: controlling and monitoring the physical operation. It publishes data to the Cache without having to respond individually to multiple IT applications requesting information.
Once the data is in the Cache, it becomes available for other uses.
That could mean analytics, visualization, monitoring, storage, or other IT applications that can create value from operational information.
This approach supports something organizations increasingly want: greater access to operational data without asking the OT system to become an IT system.
From Minutes to Milliseconds
I didn't start out as an advocate for in-memory Network Cache technology.
Over the last five years, however, I've fallen in love with what it allows me to do with large amounts of data.
Before using this approach, getting data where it needed to go could take minutes. With Network Cache, I can make large volumes of operational data available for use in milliseconds.
That changes what's possible.
IT isn't just receiving historical information about what the OT system did. It can gain low-latency visibility into what the system is doing now and put that information to productive use.
The underlying idea fits a broader shift happening in industry. As OT and IT become more connected, real-time visibility, remote monitoring, and better use of operational data are creating opportunities for both sides of the organization.
But realizing those benefits doesn't mean we should ignore the fundamental differences between the two environments.
Protect OT. Unlock Its Data.
The goal shouldn't be connecting OT and IT simply because we can.
The goal should be giving the organization access to valuable operational data without compromising what makes the OT environment dependable in the first place.
That's why I like the Network Cache approach.
OT remains focused on controlling the physical world. IT gets access to the data it needs. And between them sits a controlled, high-speed bridge designed to keep those responsibilities separate.
This architecture has been fully tested and works well in a production environment.
For me, that's the real opportunity in IT/OT convergence: not forcing two very different worlds together, but creating a better way for information to move between them.
Facing a similar challenge? Contact Paul to discuss your IT/OT data-sharing challenge. Click on the button below.
Comments