The outermost layer of security should prevent unauthorised access to the network itself from external sources.
In the past this was trivial, as industrial networks were generally stand-alone systems.
The growing amount of integration with business networks has made this a much more complex requirement. Plant data might be required by engineers or other employees working on the business network, information concerning the plant may be needed at other plants or at central locations and vendors may need dedicated remote access to assist with troubleshooting.