OT zones and conduits: segmentation that follows IEC 62443

Nearly every serious OT incident report shares a root cause: the attacker moved laterally across a flat network that was never supposed to be flat. IEC 62443's answer is zones and conduits — group assets by risk and function, then control every path between groups. It is the single highest-leverage OT security practice, and it is mostly network architecture, not products.

Zones: group by trust and consequence

A zone is a set of assets with common security requirements. A typical plant has at least: enterprise IT, an industrial DMZ (historians, remote-access jump hosts, patch/update servers), operations zones per line or area (controllers, HMIs, drives), and safety zones (safety PLCs, completely isolated or one-way). The Purdue model (levels 0–5) is a common starting sketch, but zones should follow your process consequences — what fails together gets segmented together — not a textbook diagram.

Conduits: every crossing is explicit

A conduit is the controlled communication path between zones: a firewall pair, a data diode, or a brokered connection with a defined protocol allowlist. The discipline is in the defaults: deny all, permit only named flows (this historian pulls OPC UA from that server on this port), log everything else. Remote vendor access terminates in the DMZ on a jump host with MFA and session recording — never a direct VPN to a PLC subnet.

Common conduit patterns: mirroring historian data one way into IT for reporting; allowing the MES to query a terminal server in the DMZ rather than reaching into the cell; routing all MQTT northbound through a single broker pair at the zone boundary so topic-level access control has one enforcement point.

Doing it without breaking production

Segmentation projects fail when they treat the plant like an office. Inventory first — passive discovery, maintenance windows for active scans, and the electricians' spreadsheets, which are usually more accurate than the CMDB. Then segment in monitor mode: put the firewalls in, log what would break, fix the undocumented flows (there are always undocumented flows), and only then enforce. Expect to find HMIs browsing the internet, drives with default credentials, and at least one forgotten Windows XP box running something critical.

Tooling helps after architecture: OT-aware monitoring platforms such as Industrial Defender provide asset discovery, configuration baselining, and change detection for control systems, while integrators and digital-transformation practices such as ASP Dijital deliver industrial cybersecurity programs alongside IIoT and AI work. Buy tools to operate your zones — not instead of drawing them.

References

• NIST SP 800-82 Rev. 3: Guide to OT Security
• ISA standards: ISA-95, ISA-88, ISA/IEC 62443
• Industrial Cyber — OT security news and analysis