A zone is a group of assets that share the same security requirements. A conduit is the controlled path between two zones, and it carries only what you have named. For a site with 3 PLCs, an HMI, a historian, an engineering workstation, and a vendor remote link, 5 zones and 5 conduits is a reasonable starting design.
The standard behind this is IEC 62443-3-2, which covers risk assessment and the partitioning of a system into zones and conduits. IEC 62443-3-3 supplies the system requirements and security levels (SL) you check the result against. The vocabulary is covered in the free OT networks course, and the wider controls are in Security controls for OT networks that hold up in production.
The example site
One building, one process line. 3 PLCs run the process, one HMI shows it to operators, a historian records tags, and an engineering workstation holds the PLC project files. A vendor logs in occasionally to support one PLC. The site has a business network next door for email and accounting.
The zones
| Zone | Assets | Why it is separate |
|---|---|---|
| Control | 3 PLCs, their I/O | Highest consequence if altered; fewest legitimate talkers |
| Supervisory | HMI | Operators need it; it talks to the PLCs constantly |
| Engineering | Engineering workstation | Can change PLC logic, so it needs the tightest access control |
| Operations data | Historian | Receives data from the plant and is read by the business |
| Remote access | Jump host in an industrial DMZ | The only place outside sessions terminate |
The business network sits outside these zones. It is untrusted from the plant’s point of view.
The conduits and their rules
Write each rule as who, to what, over which port, and in which direction.
- Supervisory to Control. The HMI may poll the PLCs on the protocol they use, for example EtherNet/IP on 44818/TCP and 2222/UDP, Modbus/TCP on 502, or S7 on 102. Nothing else.
- Engineering to Control. The engineering workstation may program the PLCs, and only when someone has switched it on. Keep it powered off or disconnected from the plant network when not in use if your process allows.
- Control to Operations data. The historian collects tags from the PLCs or from the HMI server. Prefer the historian initiating the connection, and read only.
- Operations data to business. Replicate historian data to a copy in the DMZ, and let the business read the copy. No business machine opens a session into the plant.
- Remote access to Engineering and Supervisory. The vendor connects to the jump host, and the jump host connects inward to one named target. The vendor’s laptop never gets a route to the PLC. How to build that is in Vendor remote access to OT without the forgotten VPN.
Every conduit ends with a deny rule that logs. The log is how you find the device nobody told you about.
What the security level means here
IEC 62443 assigns each zone a target security level from SL 1 to SL 4, based on the kind of attacker you are defending against. SL 1 is protection against casual or coincidental violation. SL 2 is intentional violation using simple means and low resources. A small plant often lands on SL 2 for the control and engineering zones. That is a judgement made in the 3-2 risk assessment, and it should be written down with the reasoning. Component requirements live in 62443-4-2, and the supplier side is in 62443-2-4.
What to build first
If the plant is flat today, do not redraw everything in a weekend.
- Put the vendor link behind a jump host.
- Move the historian copy into a DMZ so the business stops reaching the plant.
- Pull the engineering workstation into its own zone.
- Then split the HMI from the PLCs with a firewall that understands the protocols in use.
An asset inventory comes before any of it, because you cannot draw a zone around a device you do not know about. The model these zones map onto is discussed in The Purdue model in practice versus on paper.
Where this goes wrong
Zones drawn on a slide but not enforced by a firewall or managed switch are labels. Conduits with “any” in the port column are the same. And a flat VLAN with a firewall rule that says “OT to OT allow” has the zones in name only.
For the broader picture see industrial OT network security and the OT and IT convergence advisory. A hands-on version of this exercise is taught in Hardening Control Networks.
Want a second pair of eyes on your zone design? See /book/.