IEC 62443 Zones and Conduits: Segmenting an OT Network Without Stopping the Plant
The short answer
A zone is a group of assets that share the same security requirements. A conduit is the controlled path between zones, and it is the only way traffic should cross. IEC 62443 asks you to define both, decide a target security level for each zone, and then prove the conduits enforce it. The point is not to make the plant unreachable; it is to make sure that a compromise of one part does not become a compromise of everything.
Security levels, briefly
| Level | Protects against |
|---|---|
| SL 1 | Casual or coincidental violation |
| SL 2 | Intentional violation using simple means, low resources, general skills |
| SL 3 | Intentional violation using sophisticated means, moderate resources, IACS-specific skills |
| SL 4 | Intentional violation using sophisticated means, extended resources, IACS-specific skills |
Most manufacturing plants are targeting SL 1 to SL 2 and should be honest about that. Claiming SL 3 in a document while the engineering workstation shares a flat network with the office is worse than claiming nothing, because it stops people asking.
Drawing zones on a real plant
Start from consequence, not from the network diagram. Assets that would cause the same kind of harm if compromised belong together.
A workable first cut in a typical discrete manufacturing plant:
- Enterprise zone. ERP, email, general IT. Not yours.
- DMZ. The only place where IT and OT exchange data. Historian mirror, patch server, remote access jump host, data diode or broker. Nothing in the enterprise zone talks directly to anything below the DMZ.
- Operations zone. SCADA servers, historian, engineering workstations, MES clients.
- Control zone, often several. PLCs, HMIs and drives for one line or one process unit. Separate lines should be separate zones, because that is what stops an infection on one line stopping the plant.
- Safety zone. The SIS, always its own zone, with the most restrictive conduit of all.
Draw the conduits after the zones, and write down for each one what protocol crosses it, in which direction, initiated by whom, and why. Anything you cannot justify in a sentence should not be there.
Why the IT rulebook does not transfer
Availability outranks confidentiality. In IT, taking a server down to patch it is normal. In OT, a controller that stops is a process that stops, and sometimes a process that stops unsafely.
You cannot patch on Tuesday. Control system patches wait for a plant outage and vendor approval, often for months. Compensating controls exist because patching cannot be the primary control.
Scanning can break things. An aggressive vulnerability scan against an older PLC can fault it. Passive monitoring first, active scanning only with vendor guidance and never on a running critical process.
The protocols have no authentication. Modbus TCP, older EtherNet/IP and DNP3 were designed for trusted networks. You cannot fix that at the protocol; you contain it at the conduit.
A sequence that does not stop production
- Inventory. You cannot segment what you cannot list. Passive discovery first.
- Document the flows you already have, by observing rather than by asking. What people believe is connected and what is connected differ.
- Draw zones and conduits on paper and get operations to argue with them.
- Put the firewall in first in monitor or alert-only mode. Watch for weeks, not days, so you catch monthly and quarterly traffic like reporting jobs and vendor connections.
- Turn on enforcement one conduit at a time, during a planned window, with a documented rollback.
- Remote access last, and properly: through the DMZ jump host, multi-factor, session recorded, enabled on request rather than standing.
Step 4 is what separates a segmentation project that works from one that gets rolled back on day two.
Where to learn it
OT and ICS cybersecurity to IEC 62443 covers the standard and the zone model, ICS security foundations covers the protocols and the threat picture, and OT security assessment covers running an assessment. Background reading: SCADA cybersecurity basics.
Frequently asked questions
Is a VLAN a zone? A VLAN is a segmentation mechanism. A zone is a design concept with a security level and a set of requirements. A VLAN with no filtering between it and the next one is not enforcing a conduit.
Do we need a data diode? Only where the requirement is genuinely one-way and the consequence justifies the cost, typically between a safety or critical control zone and everything else. For most plants a properly configured firewall with a DMZ is the right answer.
Where does the engineering laptop fit? It is the highest-risk asset in most plants because it moves between zones and carries project files. Give it a defined home zone, control what it connects to, and never let it be the bridge between the office network and a control zone.
