The Ghost in the Machine: Architecting Granular, Identity-Based Zero-Trust for Agentless Legacy ICS

The Unseen Identity: Confronting the Core Challenge of Zero-Trust in OT

Modern cybersecurity is built upon a simple yet powerful principle articulated in the Zero-Trust model: never trust, always verify. This paradigm mandates that every access request, regardless of its origin within the network, must be authenticated and authorized. In the IT world, this is achieved through a rich ecosystem of identity providers, agents, and modern protocols. However, in the realm of remote manufacturing plants and industrial control systems (ICS), this principle collides with a stark reality: the vast majority of operational technology (OT) assets are non-agent capable, legacy systems. These Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and Distributed Control Systems (DCS) were engineered for deterministic reliability, not for a world of pervasive cyber threats. They lack the memory, CPU cycles, and operating systems to support modern security agents, and their core communication protocols (e.g., Modbus/TCP, EtherNet/IP, DNP3) often lack any notion of authentication or granular command authorization.

This creates a fundamental architectural paradox. How can an organization establish granular, identity-based access controls for devices that have no native identity? The traditional approach of perimeter defense and network segmentation, often embodied by the Purdue Model, is no longer sufficient. A flat, trusted OT network, once protected by an air gap, is now a prime target for lateral movement by adversaries. The challenge, therefore, is not to force legacy devices to behave like modern IT endpoints, but to build an externalized security fabric that can impose identity and enforce policy upon them without disrupting critical physical processes.

Architectural Blueprint: The Synthetic Identity Fabric

The solution lies in creating a