Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
04

Zones and conduits

Partition the system into zones of common security requirements, and allow only engineered, controlled conduits between them.

6 min readInteractive figureISA/IEC 62443-3-2ISA/IEC 62443-3-3
Interactive figure
From a flat network to zones and conduits
ONE FLAT NETWORK · EVERYTHING REACHES EVERYTHINGERPOffice usersVendorHistorian replicaAccess brokerSCADAEWSPLCsHMIsSIS controller
Flows
Allowed. On a flat network nothing stops it.
Choose a flow on the right, then compare it on the flat network and the zoned design.

Segment a flat network into zones, then open only the conduits the process needs.

The flat network problem

Many plants grew as a single flat network: business systems, engineering workstations, controllers and safety systems able to reach each other freely. One compromised laptop can then reach everything, including the systems that keep the plant safe.

Zones and conduits

ISA/IEC 62443-3-2 asks you to group assets into zones that share the same security requirements, for example the safety system, the basic process control system, supervisory systems, the industrial DMZ and the enterprise. Each zone is given a target security level.

Communication between zones runs only through conduits: defined, documented channels with controls matched to the risk, such as firewalls with explicit rules, data diodes or brokered access. If the process does not need a flow, the flow does not exist.

Designing without breaking production

Segmentation is designed from observed traffic, not assumptions, and delivered in phases so that availability is protected at every step. The industrial DMZ ensures that the enterprise never talks directly to control systems.

Takeaways
  1. 01Zones group assets with common security requirements.
  2. 02Conduits are the only permitted paths between zones.
  3. 03Base rules on observed process traffic and phase the delivery.