Zero trust in railway OT: What worked, what broke
Presented by: Tõnu Tammer
Originally aired on October 23 @ 7:30 AM - 8:00 AM EDT
OT was never built for identity-based access. It ran on implicit trust: physical access was authorization, the wire was the perimeter, IEC 60870-5-104 and Modbus authenticated nothing, and an air gap covered the rest. Add 25-year lifecycles and uptime-over-confidentiality approaches — thinking that IT dropped a decade ago — still running railways. At Estonian Railways, signaling, SCADA, and traffic management need vendor access and patching; and NIS2, IEC 62443, and CLC/TS 50701 expect zones, conduits and auditable access, not a flat VPN. This talk shows what we built on Cloudflare Zero Trust: Cloudflare Tunnel into OT zones, Cloudflare Access policies mapped to IEC 62443 zones/conduits, WARP for engineers, and Cloudflare Gateway logs as audit evidence. Then we cover where zero trust breaks: legacy protocols, latency budgets, safety-certified systems you can’t touch, vendor-mandated jump hosts, and more.
English
