Encryptie

What is encryption?

Encryption is the process of converting readable data into unreadable ciphertext using a cryptographic algorithm and a secret key, so that only parties holding the correct key can recover the original information. Encryption protects the confidentiality of data against eavesdropping and espionage, and modern protocols almost always combine it with cryptographic integrity checks against tampering. In IT, encryption has long been standard; in OT networks it helps protect process communication, configurations, Remote Access and Firmware updates, but there it more often clashes with legacy equipment and real-time requirements.

🧠 How does encryption work?

There are two families of encryption, which work together in practice:

1. Symmetric encryption

• A single shared secret key for both encryption and decryption
• Fast and suitable for large volumes of data, even on devices with limited processing power
• The standard is AES (Advanced Encryption Standard): published by NIST in 2001 as FIPS 197, designed by the Belgian cryptographers Joan Daemen and Vincent Rijmen, with 128-bit blocks and keys of 128, 192 or 256 bits
• Drawback: the key must reach both parties securely

2. Asymmetric encryption

• A key pair: a public key that anyone may know and a private key that stays secret
• Used for key exchange, digital signatures, certificates and authentication
• Examples: RSA and ECC (elliptic curve cryptography, such as ECDH and ECDSA)
• Much slower than symmetric encryption

Protocols such as TLS, HTTPS, SSH and VPN therefore work in a hybrid way: asymmetric cryptography sets up the connection and securely exchanges a session key, after which AES (or ChaCha20) encrypts the actual data.

🔄 What is the difference between encryption, hashing and obfuscation?

A common mistake is to assume that encryption also proves data has not been altered. Integrity and origin come from hashes, MACs and digital signatures, as in code signing and firmware signing. Passwords should be stored with a salted, deliberately slow hash function, never encrypted and never with a bare fast hash.

🔧 What are data in transit and data at rest?

• Data in transit — network traffic, encrypted with TLS (preferably TLS 1.3), IPsec or VPN, SSH/SFTP, and on Wi-Fi with WPA2 or WPA3, introduced in 2018. This protects against eavesdropping and man-in-the-middle attacks.
• Data at rest — stored data: disks of engineering stations and servers, backups, PLC project files, recipes and historian exports. Protected by full-disk encryption, often with keys held in a TPM.
• Data in use — data being processed; encryption is still of limited use here, so access control and hardening matter more.

🏭 How is encryption applied in industrial protocols?

Many classic industrial protocols were designed for closed networks and have no encryption at all. Most now have a secure variant:

In addition, organisations encrypt remote access through a VPN or jump server, secure device web interfaces with HTTPS and sign firmware so that a PLC with secure boot only loads trusted code. Some vendors also encrypt firmware images to protect their know-how; that provides confidentiality, while the signature ensures integrity. Email carrying maintenance logs or export data can likewise be protected with S/MIME or an encrypted attachment.

🔐 What should you watch for with encryption in OT?

• Legacy equipment — older PLCs, RTUs and field devices often do not support encryption and are only replaced after fifteen to twenty years; compensate with network segmentation and encrypted tunnels between zones
• Latency and processing power — handshakes and certificate checks cost time and CPU; watch latency and jitter in cyclic real-time traffic and test beforehand
• Visibility — encrypted traffic is harder to inspect for IDS and DPI; plan monitoring at the endpoints or at zone boundaries
• Key management — the strength of encryption depends entirely on how keys and certificates are managed: PKI, HSM or central vaults, plus certificate management with timely renewal; an expired certificate can stop a production line
• Availability first — in OT, availability comes before confidentiality; integrity (signing) is often more important than encrypting process data

Always combine encryption with Access Control and authentication: encryption is a core component of Defense in Depth and Zero Trust, but not a replacement for other security measures.

🧭 How do you introduce encryption in an OT environment step by step?

1. Inventory — map, per asset and connection, which protocols, algorithms, key lengths and certificates are in use (a cryptographic inventory)
2. Classify — decide which data flows need confidentiality and which mainly need integrity, based on the zones and conduits from IEC 62443
3. Choose secure protocols — OPC UA with SignAndEncrypt, Modbus/TCP Security, TLS 1.3 where possible and TLS 1.2 as a minimum
4. Set up key management — a PKI for OT, a fixed lifetime and renewal process for certificates, keys in an HSM or TPM
5. Compensate for legacy — encrypt conduits between zones with VPN gateways or an industrial firewall when devices cannot do it themselves
6. Test and monitor — measure the impact on cycle times before commissioning and monitor certificate expiry and failed handshakes

IEC 62443-3-3 requires communication integrity in SR 3.1, information confidentiality in SR 4.1 and the use of recognised cryptography in SR 4.3. Article 21 of the NIS2 directive requires policies on the use of cryptography and, where appropriate, encryption; in the Netherlands this obligation has applied since 15 August 2026 through the Cyberbeveiligingswet (Cybersecurity Act). Encryption also supports compliance with ISO 27001. In its TLS guidelines, the Dutch NCSC rates TLS 1.3 as “good” and TLS 1.2 as “sufficient”.

⚛️ What does post-quantum cryptography mean for OT?

A sufficiently powerful quantum computer can break RSA and ECC. Attackers can already intercept encrypted traffic today and decrypt it later (harvest now, decrypt later). Symmetric encryption with longer keys, such as AES-256, remains secure. A migration approach for industrial systems is described in Post-Quantum Cryptography.

This is urgent for OT because plants stay in service for twenty years or more: a PLC or gateway you buy today must be able to update its firmware signatures and key exchange later (crypto-agility).

❓ Frequently asked questions

What is the difference between symmetric and asymmetric encryption?

Symmetric encryption uses one shared key for encryption and decryption and is fast, as with AES. Asymmetric encryption uses a public and a private key, as with RSA and ECC, and is mainly used for key exchange and digital signatures. Protocols such as TLS combine both.

Is AES-256 secure against quantum computers?

AES-256 is considered resistant to quantum computers, because known quantum algorithms at most roughly halve the effective strength of symmetric encryption. RSA and ECC, however, are vulnerable and must be replaced by post-quantum algorithms such as ML-KEM and ML-DSA from FIPS 203 and 204.

Why is encryption used less in OT than in IT?

Encryption is used less in OT because many industrial protocols and legacy devices were never designed for it. Operators also fear extra latency, processing load and outages caused by expired certificates. Modern protocols such as OPC UA, Modbus/TCP Security and PROFINET Security Class 3 do make encryption in OT feasible.

Does OPC UA always encrypt communication?

OPC UA only encrypts when the security mode SignAndEncrypt is configured. In Sign mode messages are only signed, and with None there is no protection at all. Check the security mode of every endpoint and avoid deprecated policies such as Basic128Rsa15.

What is the difference between encryption and hashing?

Encryption is reversible with the correct key and protects the confidentiality of data. Hashing is a one-way function that creates a fixed fingerprint of data and is used for integrity checking and password verification. A hash cannot be decrypted.

Does NIS2 require encryption?

Article 21 of NIS2 requires essential and important entities to have policies and procedures for the use of cryptography and, where appropriate, encryption. The directive does not prescribe specific algorithms but expects a risk-based choice. In the Netherlands this has been a legal requirement since 15 August 2026 under the Cyberbeveiligingswet.

📌 In summary

Encryption makes data unreadable to unauthorised parties and is a fundamental layer in any OT security model, but it is only effective when key and certificate management is in order. In industrial environments, encryption calls for secure protocol variants, compensating measures for legacy equipment, attention to latency and timely preparation for post-quantum cryptography.