The Zero Trust concept is being adopted in information technology (IT) deployments, while human users remain to be the main risk for operational technology (OT) deployments. This article proposes to enhance the new Modbus/TCP Security protocol with authentication and authorization functions that guarantee security against intentional unauthorized access. It aims to comply with the principle of never trusting the person who is accessing the network before carrying out a security check. Two functions are tested and used in order to build an access control method that is based on a username and a password for human users with knowledge of industrial automation control systems (IACS), using simple means, low motivation, and few resources. A man-in-the-middle (MITM) component was added in order to intermediate the client and the server communication and to validate these functions. The proposed scenario was implemented using the Node-RED programming platform. The tests implementing the functions and the access control method through the Node-RED software have proven their potential and their applicability.

Human users remain the main risk for commercial variable speed drives. At the same time, adopting of the Zero Trust concept is already recommended for operational technology deployments to comply with the principle of never trusting the person accessing the system before performing a security check. Based on the specifications of the Security Level 2 (SL2) on the International Electrotechnical Commission (IEC) 62443-4-2 standard and considering the Cyber Resilience Act regulation this article aims to validate that it is possible to improve the cybersecurity of variable speed drives, developing a cybersecurity subsystem and applying a method to implement access control using Modbus protocol, seeking to control requests made by human users through parameterization software and devices through Fieldbus communication. To validate the role-based access control, which is subjected to tests that simulate threats in a real environment based on Industry 4.0 where edge devices collect and send data to the cloud. Its results are compared with the requirements to quantify and qualify the cybersecurity subsystem's adherence. It demonstrates that 100% of the FR1 requirements were achieved and met 87% of the FR2 requirements for SL 2, which allows the development of VSDs in adherence with IEC 62443-4-2.