---

Key Takeaways

• Third-party penetration testing evaluates gateway cybersecurity from an attacker’s perspective, rather than relying only on internal testing or individual security features.
• Penetration testing is part of an ongoing cybersecurity process that includes scoping, testing, review, remediation, follow-up testing when appropriate, and continued improvement. FieldServer undergoes this testing regularly rather than as a one-time exercise.
• Encryption alone is not enough to secure a connected gateway. Integrators also need to consider firmware, credentials, management interfaces, updates, network exposure, cloud applications, and physical access.
• The scope of penetration testing can change based on product updates, risk areas, and where additional security assurance is needed.

---

A gateway sits at an important point in a connected system. It bridges legacy Modbus equipment with modern Ethernet networks, building automation systems, remote applications, or cloud services.

That ability to connect different environments is what makes a gateway useful. It also creates a broader security challenge: each connection introduces its own interfaces, protocols, and potential attack paths, so gateway security must be evaluated across the entire system, not feature by feature.

This reality changes the questions integrators should ask. Instead of asking:

“Does this gateway support encryption?”

A better question is:

“How has the security of the gateway been tested?”

Third-party penetration testing helps answer that question, not with a feature list, but with an assessment conducted from an attacker’s perspective.

How Does Third-Party Penetration Testing Work for Connected Gateways?

Third-party penetration testing looks at how a connected gateway responds to real-world attack scenarios under controlled conditions.

For MSA FieldServer gateways, security is evaluated internally and through external penetration testing.

Before testing begins, MSA and the relevant technical team define the scope, including which product components, interfaces, and security areas will be evaluated and which threat scenarios or risks the test should address.

Once that scope is set, external security researchers assess the system from an attacker’s perspective, looking for weaknesses that could affect confidentiality, integrity, or availability.

Who Runs the Tests, and What Standards Do They Follow?

MSA works with an independent third-party cybersecurity firm to perform penetration testing of FieldServer gateways.

Its methodology draws on established security frameworks and guidance, including:

• OWASP and OSSTMM for structured security testing
• PTES (Penetration Testing Execution Standard)
• Hardening guidance from NIST
• Guidance from Germany’s BSI (Federal Office for Information Security)

Testing combines manual analysis with automated tooling, including industry-standard tools and tools developed by the testing firm. Depending on the scope, an assessment may include both remote and on-site testing.

What Can a Gateway Penetration Test Examine?

Scope varies by product, by what has changed since the last assessment, and by where additional assurance is needed.

In some engagements, the gateway and its corresponding cloud application may be tested together. In others, testing may focus specifically on the gateway itself, including its software and physical attack surface.

For a connected gateway, testing can include:

Area	What researchers may evaluate
Authentication & authorization	How access to gateway functions is controlled
Communications	How data moves between devices, networks, and connected applications
Firmware & software	How the gateway handles updates and unexpected or untrusted input
Management interfaces	How configuration and administrative functions are protected
Cloud connectivity	How the gateway interacts with connected cloud applications
Physical access	What risks exist if someone has the device in hand

This broader scope matters because securing a gateway involves more than protecting traffic moving across a network.

Testing physical attack surfaces alongside software is deliberate. Unauthorized access does not always begin with a remote exploit. In some scenarios, physical access to the device can also become relevant.

How Often Is FieldServer Penetration Tested?

Penetration testing is not treated as a one-time security check. MSA aims to perform at least one third-party penetration test annually for each ISMS scope, with the exact scope adjusted based on product changes and areas where additional security assurance is needed.

FieldServer has successfully completed third-party penetration testing and follow-up testing.

The goal is not simply to complete a test. Results are reviewed, appropriate follow-up actions are taken, and additional testing may be used to verify remediation when needed.

That ongoing process also helps identify opportunities to continue strengthening FieldServer security as products, connected environments, and cybersecurity risks evolve.

What Happens After a Pentest Wraps Up?

Completing the test is not the finish line. The results become part of an ongoing cybersecurity process.

The process looks like this:

Scope → Test → Review → Address → Follow-up Test → Improve

Review
Findings are evaluated internally by the relevant technical teams.

Prioritize
Findings are reviewed and prioritized based on the appropriate security and product considerations.

Address
Engineering and product teams determine and implement the appropriate follow-up actions.

Follow-up Test
Where appropriate, external researchers verify that remediation was successful.

Communicate, when relevant
If an issue requires customer action, MSA may issue a public security advisory explaining affected product versions and recommended steps.

Repeat
Testing continues as products, connected environments, and cybersecurity risks evolve.

What’s the Biggest Misconception About Gateway Security?

That encrypting the network connection is enough.

It isn’t.

Encryption and strong authentication are important controls, but they protect only part of the connected environment. Gateway security also has to account for:

• The gateway itself
• Firmware and software
• Local management interfaces
• Stored credentials and secrets
• Firmware-update mechanisms
• Network exposure
• Communication with cloud applications
• The cloud application itself
• Physical access to the device

Cloud infrastructure is part of that picture, too. MSA’s cloud applications operate on AWS infrastructure, but infrastructure security and application security are not the same thing.

Application-level security remains part of MSA’s own product architecture and security responsibilities.

Securing one link in the chain does not secure the entire connected environment.

What Should Integrators Ask About Gateway Cybersecurity?

Security conversations can quickly turn into a checklist of individual features. A better starting point is to ask how the product is evaluated as a whole:

• Is independent penetration testing performed?
• Is the assessment conducted from an attacker’s perspective?
• How is the scope determined?
• Can testing include firmware, software, communications, cloud connectivity, and physical access?
• What happens when an assessment identifies an issue?
• Is remediation verified through retesting?
• Is security testing repeated as the product and threat landscape evolve?

Those questions provide a clearer picture of how product security is evaluated and maintained over time.

A gateway is designed to connect different protocols, equipment, networks, and applications. Evaluating its cybersecurity requires looking across that same connected environment.

For organizations evaluating FieldServer for a connected environment, MSA can provide additional information about the security considerations relevant to a specific deployment.

Have questions about gateway cybersecurity or how FieldServer fits into your connected environment? Contact us to talk through your application.