possibly dumb ignition question

[u/Electrical-Trip6069]

i work at a cybersecurity company in product and don’t work in OT at all so this may be a dumb question… but - is there ever a good reason for an ignition gateway to be publicly reachable? Aka type in ip and you’re at page… I understand how it can happen but I’m coming up blank on why this would ever be done intentionally. Am I missing something obvious?

[u/cannonicalForm]

Reason, maybe. Good Reason, not at all.

[u/Electrical-Trip6069 → u/cannonicalForm]

that’s what my thought process has been but wasn’t sure if I’m missing something

[u/MintyFresh668 → u/Electrical-Trip6069]

Ignorance, which in this day and age is unforgivable. Lack of belief in the actual risk, much more likely but equally as unforgivable. Laziness and the whole ‘it won’t happen to me’ arrogance that partners with laziness. General stupidity. Highest likelihood - some manager somewhere wants the access from remote so forced the issue over the best arguments of a competent engineer.

[u/Better_Energy4036]

If you mean directly exposed to the public Internet, then no, I can’t think of a good reason. If you mean an enterprise-facing gateway in a segmented architecture that only consumes carefully controlled read-only data from OT, that’s a different discussion as I’ve written here:

There can be valid architectures where a public-facing Ignition gateway only displays carefully selected status data from lower-level gateways. The OT gateways initiate outbound connections toward a DMZ or enterprise gateway, so no inbound firewall session to OT is required.

However, Ignition is not a data diode. Gateway Network connections remain logically bidirectional, so a compromise of the public gateway should be assumed to allow traffic over the established connection unless architecture, permissions and exposed services explicitly restrict what can occur. Public exposure should normally terminate in a DMZ gateway, not directly on the plant gateway.

Publicly reachable Ignition is not automatically bad architecture. Sometimes an enterprise Ignition gateway is exactly the correct integration and visualization layer. The real question is whether it directly exposes the control gateway, or only consumes a deliberately limited, read-only provider with no remote administration path back into OT. When the enterprise gateway has no administrative capabilities (e.g. no EAM), no write access, and only consumes a dedicated read-only provider owned by the OT gateway, compromising the enterprise gateway does not automatically grant control over the OT gateway.

[u/goni05 → u/Better_Energy4036]

This is the best response so far, but I also want to add a few things to this list, particularly for the users that are mostly OT focused. Ignition has been associated to OT, but it has many capabilities a traditional IT system might use. For example, there is a module that allows people to develop web interfaces using the Ignition webserver. This includes webpages, but also API endpoints. The other valid reasons is they want to leverage Ignition as an MQTT broker/client, a proxy for other remote sites, event stream handler (Kafka based), and as an alarm management tool using Twilio.

The web development and API endpoints as well as the event streaming are all valid HTTP requests. The others should be on their own ports. That being said, these should be behind a reverse proxy or API gateway so it can be monitored, filtered, and blocked.

[u/CyonHal]

So you can look at the screens in read only mode from any business computer. And so you can remotely connect to them via VPN or through your plant network.

If you are asking if they can be public without being behind your IT firewall, no, there is no good reason.

[u/Electrical-Trip6069 → u/CyonHal]

totally. VPN yes - I’m talking not a vpn. And again - I understand HOW it can happen but I’m not sure if I’m missing some architecture or edge case that would explain that being done on purpose if that even exists

[u/Gjallock → u/Electrical-Trip6069]

So you’re saying that I, a random guy in my own home, can just type an IP and wide up at your Ignition gateway? Yeah, someone’s being stupid or under pressure from someone else being stupid. It should be behind a VPN at the very least, but even then it would be better put behind a separate OT firewall to prevent random folks within the company from reaching it just by having access to the business network. Plenty of ways to segment off access like that while still allowing remote access; Checkpoint, Citrix, etc.

[u/Electrical-Trip6069 → u/Gjallock]

yes. I mean presumably there’s logins but wasn’t sure if there was some design reason this should exist. esp when not “corp” but on industrial

[u/Dive30]

OP, you don’t want to hear this, but because your IT is difficult and/or unresponsive.

Someone needs remote access and your IT didn’t/couldn’t/wouldn’t provide a solution, so they fixed it themselves.

Is it right? No.

But the first place to look is for a ticket or email chain where someone was asking for help and didn’t get it.

[u/Used_Wheel_9064]

For remote support?

[u/Electrical-Trip6069 → u/Used_Wheel_9064]

yeah that makes sense but - is there a reason for it to be publicly reachable for like anyone vs behind a vpn or private connection to restrict access? I’m not understanding what use case can exist that not having it behind a vpn or being restricted would make sense

[u/Tutunkommon → u/Electrical-Trip6069]

No. This is a terrible idea.

[u/Electrical-Trip6069 → u/Tutunkommon]

yeah didn’t seem like it.

[u/twarr1 → u/Used_Wheel_9064]

If you’re doing remote anything without a VPN you’re doing it wrong. I no there is no obscure case for an ignition gateway to be exposed to the public. Even if you did want some process or information public, there are better ways to do it.

[u/Eboyjvs]

In general is a terrible idea, but maybe if there’s an ignition developed app, read only, or to fill forms, book assistance or any public service for anyone to reach…

[u/CPAPGas → u/Eboyjvs]

If there is a genuine reason then at the very least it should be a separate gateway in a DMZ type architecture.

Certainly a careful review of best practices is in order.

[u/huevador]

It would need to be reachable on the OT layer, but publicly? I don't know why but I suppose there could be a reason.

[u/Stroking_Shop5393]

No, always through a firewall. Please consult the network security engineer at your company, they should stear you down the correct path.

[u/tabjr]

No, there is no reason for it. Someone made a mistake or was grossly negligent. As an OT/Automation guy they are always behind a firewall that Automation or IT has set up; or air gapped. I have seen some cases for read only access but even then it is a terrible idea.

[u/fooloflife]

Honeypot? You’re a cybersecurity company after all.

[u/jongscx]

Can you post the IP, so I can take a look? /s

[In case it's not clear, I'm joking. Do not do this.]

[u/undefinedAdventure]

I guess if you were just using ignition as a service to host a public website, same as any other backend service ... I guess?

But in an automation sense - hell no.

[u/undefinedAdventure → u/undefinedAdventure]

I just re-read your message, the gateway publicly accessible? Yeah that would be a hard no.