For most of my cRIO applications, I've been able to deploy all software onto the cRIO and control it through an RS-232 command/reply interface with commands general enough they can utilize most of the I/O for the system, but narrow enough that only intentional misuse would be able to do anything destructive with the signals. Thankfully, I'm mostly working with test equipment, and the systems which are controlling the tester through RS-232 are behind quite a bit of firewall.
If I were in a different environment (Ethernet connection preferred, non-controlled engineer interacting with my interfaces), I would look into encrypting/decrypting command/response pairs, having the embedded software interface be less generalized, and each command only able to perform tasks which will not hurt the system or endanger anyone (with a much larger set of commands needed). Reducing the scope of "acceptable" commands (case-sensitive, defined command length, etc...) would also reduce someone attempting random commands' ability to tamper with the system.
Depending on the application, I might use a cloud service. I would just assume that the controller of the cloud service had access to all information stored there, no matter the encryption level.