Question

An engineering team is deploying an OPC UA gateway to bridge sensor data from an OT process cell to a cloud historian. The security architect requires that only authenticated and authorized OPC UA clients can establish sessions, that message payloads are encrypted, and that the gateway rejects self-signed or unknown client certificates automatically. During commissioning, integrators report they can connect using the gateway's default 'None' security policy. Which configuration change most directly enforces the architect's requirements?

Accepted Answer

Set the OPC UA security policy to Sign & Encrypt (e.g., Aes256_Sha256_RsaPss) and configure the gateway's certificate trust list to accept only certificates issued by the organization's approved CA, rejecting untrusted client certificates

Answer

Enable the OPC UA 'Sign' security policy only, and rely on network segmentation ACLs to block untrusted clients from reaching the gateway

Answer

Keep the 'None' security policy but require username/password authentication on each session and enable TLS on the northbound cloud connection

Answer

Deploy an application-layer firewall in front of the gateway to inspect OPC UA traffic and drop sessions from unrecognized source IP addresses