The questions IT will ask before a sensor goes on

Connecting a measurement device is no longer decided on the shop floor. It goes through a review, short or long depending on the company, and its outcome sets the project schedule. Better to know the questions in advance.

The four questions in the file

• What network does the device attach to, and what rules have to be opened for it?

• Who pushes updates, through which channel, and what happens the day a vulnerability is published?

• What is encrypted, in transit and at rest, and how does the device authenticate itself?

• What can the device see of the rest of the installation, and can it write anywhere?

Why those questions are fair

The convergence of operational and IT networks exposed industrial systems to attack vectors that were once foreign to them: ransomware, malware, distributed denial of service. Stuxnet showed that an industrial control system could be targeted for its own sake.

The quietest risk, though, is not a production stoppage. It is the falsified reading: a manipulated measurement keeps feeding analyses and decisions without triggering anything, and the plant is then run on numbers that only look right. Platforms that concentrate production data are targeted for the same reason: what they hold is worth more than the access itself.

What a parallel network answers

The architecture Sycon uses removes the first question rather than answering it. The Sybox brings up its own LTE-M cellular link and never uses the site's IT network: no firewall rule to negotiate, no segment to create, no wireless credentials to hand over. The separation is physical as much as logical, which makes it possible to instrument critical equipment without exposing the existing industrial network.

Exchanges run on MQTT over TLS: the stream is encrypted and the device authenticates itself. That dedicated link also carries software and firmware updates remotely, so a vulnerability can be fixed without sending anyone on site and without local handling.

What it does not do

An isolated box does not secure a factory. Segmentation between operations and IT, multi-factor authentication, least privilege, event monitoring, a tested incident response plan and staff training remain the site's own work. Frameworks exist to organise that: the ISA/IEC 62443 series for automation systems, the NIS 2 directive for essential entities and their suppliers, the GDPR for personal data, and publications from NIST, ENISA and the French national cybersecurity agency for implementation.

So the question to put to a supplier is not whether it is secure, but what it adds to your exposure surface. Ideally, nothing.