Speaker: Alexander Zaitsev, AVEVA

Abstract: 

As industrial systems become more connected, securing communications between central systems and edge devices is increasingly important. This presentation shares practical experience from real OT deployments and discusses how certificate-based security can be implemented in a way that is both secure and operationally manageable.

The session will cover certificate architecture choices, including the use of root, intermediate, and device certificates, as well as deployment approaches suitable for large-scale OT environments. We will review different trust validation methods for both connected and disconnected systems, where online verification may not always be available.

Special attention will be given to certificate lifecycle management, including provisioning, renewal, revocation, and recovery from compromise. The presentation will focus on practical strategies for handling expired, revoked, or compromised certificates without disrupting operations or requiring engineers to visit remote sites. Attendees will gain insights into building a scalable and maintainable trust model for edge-connected industrial systems.