In alarm monitoring and industrial control, the cloud is no longer optional; it is the operational backbone. Alarm receiving centres, telecare platforms, and SCADA systems increasingly rely on cloud infrastructure for event processing, data analytics, and remote management. But with that shift comes an uncomfortable truth: the perimeter-based security model no longer works.
Zero-trust architecture (ZTA) replaces the implicit trust of VPNs and firewalls with explicit, continuous verification of every request, regardless of origin. For critical infrastructure bound by BS 5979, EN 50518, or IEC 62443, it is quickly becoming a regulatory expectation.
Why Perimeter Security Fails for Critical Infrastructure
Traditional security assumes that anything inside the corporate network is trustworthy. In practice, that assumption has failed repeatedly, through compromised credentials, insider threats, and lateral movement after an initial breach. For alarm monitoring, where a single compromised session could suppress or manipulate life-safety events, the risk is unacceptable.
EN 50518 requires that alarm communications maintain integrity and availability. A flat network with VPN access cannot satisfy this requirement in a cloud environment. Zero-trust provides the architectural basis for meeting these standards in modern architectures.
Core Zero-Trust Principles Applied to Critical Infrastructure
- Never trust, always verify: Every API call, database query, and message bus publish must be authenticated and authorised individually, not inherited from a network position.
- Least-privilege access: An alarm receiver terminal has access only to the events it needs to process. A maintenance dashboard cannot reach the event ingestion pipeline.
- Micro-segmentation: The event ingestion path (sensor → gateway → cloud → ARC) is isolated from the management plane. Compromise of the management UI cannot affect event processing.
- Continuous monitoring: Every inter-service call is logged and analysed for anomalies. Behavioural baselines detect deviations before they become incidents.
Practical Architecture for Alarm Monitoring
In a recent deployment for a European alarm receiving centre, we implemented zero-trust across three planes:
- Data plane: Event ingestion from monitoring centres uses mutual TLS (mTLS) with device-specific certificates. Each transmitter authenticates individually, and events are written to an immutable audit log before processing.
- Control plane: Configuration changes require multi-party approval and are recorded on a blockchain-backed audit trail. API gateways enforce per-endpoint authorisation scopes.
- Management plane: Operator dashboards authenticate via OAuth 2.0 with hardware-backed tokens. Session duration is limited to shift length, and all actions are logged with operator identity.
The result: the platform achieved BS 5979 compliance for cloud-connected ARC operations, a first for that operator, while reducing the incident response time from hours to minutes through automated threat detection.
Getting Started
Transitioning to zero-trust does not require a greenfield build. Start by identifying the highest-risk flows in your existing infrastructure, typically alarm event ingestion and remote operator access, and apply micro-segmentation and mTLS to those paths first. From there, expand the zero-trust boundary outward.
At Altirratech EU, we design and deploy zero-trust cloud infrastructure for alarm monitoring, telecare, and industrial control systems. If you are planning a compliance upgrade or a new cloud platform, our engineers can help.