Who Is on the Wire? Identity Architecture Across the IT/OT Boundary

Abstract

Most recent intrusions into industrial operations walked in through an identity nobody was managing, not a novel exploit. This practitioner feature article explains why identity behaves differently in operational technology (OT), where it breaks between enterprise IT and industrial control systems, and five vendor-neutral architecture patterns operators can apply: 1. Separate IT and OT identity domains, joined only through a broker in the IT/OT DMZ.2. Strong authentication at a single brokered entry point, with just-in-time, vaulted and recorded privilege inside the plant.3. Operator consoles designed for shifts, separating monitoring from actions that change the process.4. Certificate identities for devices, with authenticating gateways for legacy controllers.5. A pre-planned, drilled break-glass path for emergencies. The patterns are grounded in ISA/IEC 62443-3-3 (FR 1, identification and authentication control; FR 2, use control) and the April 2026 joint U.S. federal guide "Adapting Zero Trust Principles to Operational Technology," with the 2021 Colonial Pipeline incident and CISA advisory AA23-335A as case examples. The article includes one original reference-architecture figure and an identity-class summary table (1,861 words). Prepared as a feature article for ISA InTech.