A programmable control unit interacts with a physical system. The physical system has a public network interface for communicating with remote computer systems. A user computer system is located remotely from the programmable control unit. A front-end security gateway is located remotely from the programmable control unit, wherein the front-end security gateway communicates with the user computer system to authenticate and authorize a user for access to the programmable control unit. The front-end security gateway forwards messages between the user computer system and the programmable control unit after the user is authenticated and authorized. A public communication network is coupled between the front-end security gateway and the programmable control unit to carry the forwarded messages. The public communication network includes a routing control configured to allow communication with the programmable control unit only by the front-end security gateway.