How Do You Secure an Industrial IoT Gateway?

A secure IoT gateway is one that has been designed, configured and maintained so that it cannot easily become a route into the equipment it connects. That matters more for a gateway than for most devices, because of where it sits.

An industrial gateway has one side on the plant floor, talking Modbus, CAN or serial to PLCs, meters and drives that were often never designed with security in mind. Its other side connects to the business network, a cellular network or a cloud service. If an attacker takes over the gateway, they may be able to read process data, send commands to machines or move further into the IT network.

Gateways also tend to live in remote cabinets, run for years and be forgotten once they work. Weak default passwords, open management ports and out-of-date firmware are the most common problems, and none of them needs a sophisticated attacker to exploit.

Software controls are only as strong as the platform underneath them. When choosing industrial IoT gateways, look for features that let the device prove it is running trusted code:

Most gateways run Linux, and some run Windows IoT. Whichever is used, the image should contain only what the gateway needs. Remove compilers, desktop packages and sample applications, disable services that are not used and close every listening port that is not required. Run gateway applications as unprivileged users, or in containers where the platform supports them, so that a fault in one application does not hand over the whole system.

Updates need a plan from the start. Signed update packages, a tested rollback path and a schedule for applying security patches matter more than any single setting, because a gateway that cannot be updated safely will eventually stop being secure.

Every gateway should have its own identity. In practice this means a unique X.509 certificate per device, ideally with the private key generated and held in the TPM, rather than a shared password or API key copied to every gateway in a fleet. Cloud IoT services and MQTT brokers can then authenticate each gateway separately and revoke one without affecting the rest.

All traffic leaving the gateway should be encrypted. The usual options are:

Where possible, design the gateway to make outbound connections only. A gateway that publishes data to a broker and pulls its updates needs no open inbound ports, which removes a large part of its attack surface.

The gateway should be the controlled crossing point between the plant network and everything else, not one more device on a flat network. IEC 62443 describes this as zones and conduits: group devices with similar security needs into zones, and allow traffic between them only through defined, firewalled conduits. Put the field side of the gateway on its own VLAN or physical port, put its upstream side in a DMZ or IIoT zone, and allow only the protocols and destinations it needs.

On cellular gateways, a private APN from the mobile operator keeps the gateway off the public internet, and the SIM can be locked to the device.

For industrial systems the main reference is the IEC 62443 series. IEC 62443-3-3 sets security requirements for a complete control system, and IEC 62443-4-2 sets technical requirements for components such as gateways and embedded devices, graded into security levels. Our IEC 62443-4-2 hardware security checklist goes through those requirements for edge hardware. In the US, NIST SP 800-82 gives guidance on OT security and NIST IR 8259 describes baseline capabilities for IoT devices.

In the EU, the Cyber Resilience Act adds security duties for products with digital elements, with its reporting obligations applying from September 2026 and most other requirements from December 2027. Whether a particular gateway needs third-party assessment depends on its category and use, so check the manufacturer’s declarations and your own obligations rather than assuming a product is compliant.

Many of the x86 industrial IoT gateways we list carry TPM 2.0, and we configure the BIOS, operating system and network settings each project needs as part of the standard build.