For much of industrial automation history, cybersecurity was treated as a perimeter problem. Control systems lived on isolated networks, threats were assumed to be external, and security controls were added — if at all — through firewalls, segmentation, and procedures layered on top of existing architectures.
That model is no longer viable.
Today’s industrial control systems are connected, data-driven, and increasingly dependent on remote access and modern compute. In that environment, security that is bolted on after the fact is structurally insufficient. This is one of the core reasons end users are pushing for Open Process Automation (OPA).
Legacy Architectures Were Never Designed for Today’s Threats
The fundamental challenge is not a lack of security tools. It is that most legacy control architectures were designed before today’s threat landscape existed.
Don Bartusiak of ExxonMobil describes the mismatch clearly:
“The currently available products were designed in an era before we had ubiquitous internet connectivity and all of the cyber security risks that we currently have to mitigate.”
— Don Bartusiak, Former Chief Engineer, Process Control at ExxonMobil (Why End Users Are Driving the Open Process Automation Standard, ~06:34)
As a result, many control systems still rely on:
- Security that is bolted on, rather than designed into the control system
- Implicit trust within the control network
- Long-lived operating systems that outlast vendor support
- Limited visibility into device identity and integrity
When security is external to the architecture, it becomes fragile. Changes intended to improve security — patches, upgrades, monitoring — often introduce operational risk instead.
End Users See Security as a Business Risk, Not Just a Technical One
For owner/operators, cybersecurity is not an abstract IT concern. It is tightly coupled to safety, uptime, and business continuity.
Julie Smith of DuPont captures this reality succinctly:
“Cybersecurity is becoming more important, but it’s becoming more difficult to do — and it’s an afterthought in most cases.”
— Julie Smith, DuPont (Why End Users Are Driving the Open Process Automation Standard, ~13:59)
In many plants, systems must run well past their intended lifecycle. Operating systems evolve every few years; control systems are expected to run for decades. That mismatch creates unavoidable exposure.
When security upgrades require shutdowns or recertification, they are delayed — sometimes indefinitely. Over time, this creates a growing gap between operational necessity and security best practice.
What “Security by Design” Means in OPA
OPA does not promise perfect security. What it changes is where security lives.
Rather than relying solely on perimeter defenses, OPA emphasizes:
- Strong identity for devices and software components
- Authenticated and encrypted communication as a baseline
- Standards-based interfaces that can be verified and tested
- Architectural separation that limits blast radius when issues occur
As discussed in the COPA Quickstart sessions, security is treated as an inherent system property — not an optional add-on.
“We’ll show you how OPA systems have security built in from day one — it’s inherent in the system.”
— COPA Quickstart Overview, ~05:05
This shift mirrors what occurred years ago in IT, where zero-trust principles replaced implicit trust models.
Architecture Enables Continuous Security — Not One-Time Hardening
One of the most important — and often overlooked — security benefits of OPA is lifecycle flexibility.
In traditional control systems:
- Security patches often require downtime
- Upgrades are bundled with hardware refreshes
- Unsupported software remains in production because replacement is too risky
OPA’s modular architecture allows security improvements to occur incrementally.
Because compute, networking, and applications are decoupled:
- System software can be updated without shutting down the process
- New security capabilities can be introduced alongside existing control logic
- Systems can evolve without forcing disruptive migrations
This directly addresses a core end-user concern: how to remain secure over decades-long plant lifecycles.
Interoperability Strengthens Security — Not Weakens It
A common misconception is that openness increases attack surface. In practice, opaque systems often hide risk rather than reduce it.
Luis Duran of ABB highlights why standards matter:
“We are driving toward open, secure, and interoperable products as defined by these standards.”
— Luis Duran, ABB (Why End Users Are Driving the Open Process Automation Standard, ~11:42)
Standards-based systems allow:
- Independent validation and testing
- Clear definition of trust boundaries
- Consistent security behavior across vendors
In contrast, proprietary mechanisms often require blind trust in vendor implementation — a risky proposition in a connected world.
Security, Safety, and Scope Discipline
OPA also makes an important distinction between what is in scope and what is not.
Safety Instrumented Systems (SIS), for example, are explicitly out of scope of the OPA standard. This is intentional.
By not redefining safety architectures, OPA avoids introducing risk into domains that already have rigorous certification and regulatory oversight. Instead, it focuses on strengthening the layers where security gaps are most acute: control compute, networking, and system management.
This discipline reinforces trust — particularly among operators in high-consequence environments.
Why End Users Are Insisting on This Change
For end users, cybersecurity is no longer negotiable — but neither is operational continuity. Architectures that force a trade-off between the two are increasingly unacceptable.
OPA represents an attempt to remove that trade-off.
By designing security into the architecture — rather than layering it on — OPA enables systems that can be:
- Secure by default
- Safer to operate
- Easier to evolve
- More resilient over time
This is not about chasing the latest security tool. It is about fixing the structural flaws that made security fragile in the first place.
More Insights
