6.3 Industrial Cybersecurity by Design: Zones, Conduits & Security Levels (ISA/IEC 62443)

6.3 Industrial Cybersecurity by Design: Zones, Conduits & Security Levels (ISA/IEC 62443)

Historically, industrial automation and control systems relied on physical isolation—the legendary "air gap"—for protection against malicious threats. In modern digital manufacturing, enterprise Resource Planning (ERP) systems, remote vendor diagnostics, cloud analytics, and industrial internet of things (IIoT) sensors have permanently eliminated the air gap. Today, cybersecurity is an inseparable component of system design. A Certified Automation Professional (CAP) must understand the fundamental differences between Information Technology (IT) and Operational Technology (OT) security, design network architectures per ISA/IEC 62443, partition systems into Zones and Conduits, assign Security Levels (SL), and engineer secure Industrial Demilitarized Zones (IDMZ).

---

Building on the Definition-Phase Security Architecture

Section 4.2 introduced the IT/OT priority difference (availability and integrity before confidentiality), the structure of the ISA/IEC 62443 series, the seven Foundational Requirements and the preliminary zone-and-conduit model. Detailed design turns that preliminary architecture into specified, buildable controls. Three parts of the series drive this work:

From SL-T to Specified Requirements

A target security level is not one number for the whole plant. It is assigned per zone and conduit and can be expressed as a security level vector—one value for each of the seven FRs—because a zone may need strong integrity and availability protection but only modest confidentiality. For each FR, 62443-3-3 lists base system requirements (for example, SR 1.1 human user identification and authentication, SR 3.4 software and information integrity, and SR 5.1 network segmentation) plus requirement enhancements that are added as the security level rises. The design team selects the SRs and REs needed to reach each zone's SL-T and records them in the CRS and in the procurement specifications.

Specifying Components and Certification

When buying controllers, switches, firewalls and workstations, the specification should state the required capability security level (SL-C) against 62443-4-2 and ask suppliers for evidence such as ISASecure certification (component security assurance for products, system security assurance for systems) and a secure development lifecycle per 62443-4-1. A system reaches its target only if its components are capable of it and they are configured correctly—capability alone does not deliver the achieved level (SL-A).

---

Zone and Conduit Partitioning (ISA/IEC 62443-3-2)

ISA/IEC 62443-3-2 establishes the engineering workflow for segmenting an industrial plant into defensible enclaves. The central tenet of the standard is that an industrial control system cannot be defended as a single monolithic network.

+-------------------------------------------------------------------------------------+
|                                 ENTERPRISE NETWORK (LEVEL 4)                        |
+-------------------------------------------------------------------------------------+
                                           │
                        [ External Enterprise Firewall ]
                                           │
                                           ▼
+-------------------------------------------------------------------------------------+
|                      INDUSTRIAL DEMILITARIZED ZONE (IDMZ - LEVEL 3.5)               |
|   - Dual-Homed Jump Host (RDP/SSH)     - Replicated Process Historian               |
|   - Patch Mirror Server (WSUS)         - Antivirus Update Mirror                    |
+-------------------------------------------------------------------------------------+
                                           │
                        [ Internal Industrial DPI Firewall ]
                                           │
                                           ▼
+-------------------------------------------------------------------------------------+
|                       OPERATIONS & SUPERVISORY ZONE (LEVEL 3)                       |
|   - SCADA Servers / Distributed Control System Engineering Workstations             |
+-------------------------------------------------------------------------------------+
         │                                                           │
   [ Conduit A (DPI) ]                                         [ Conduit B (DPI) ]
         │                                                           │
         ▼                                                           ▼
+---------------------------------+         +-----------------------------------------+
| UNIT 1 CONTROL ZONE (LEVEL 1/2) |         | SAFETY INSTRUMENTED SYSTEM ZONE (SIS)   |
| - Process PLCs (10.10.1.x)      |         | - Safety Logic Solver (10.10.99.x)      |
| - Unit Operator HMI Consoles    |         | - Dedicated Safety Engineering Tool     |
| - Variable Frequency Drives     |         | - Read-Only Isolated Gateway to BPCS    |
+---------------------------------+         +-----------------------------------------+

Definitions and Partitioning Rules

• System Under Consideration (SuC): The complete collection of industrial automation hardware, networks, and software being evaluated.
• Security Zone: A logical or physical grouping of cyber assets that share identical cybersecurity requirements, risk profiles, and operational functions. Assets within a zone must share similar operational criticality.
• Conduit: The dedicated, controlled communication channel that connects two or more security zones. All communications crossing the boundary between zones must pass through a conduit.
• Border Protection Devices: Conduits are enforced physically and logically using firewalls, data diodes, managed switches with access control lists (ACLs), or secure VPN routers.

The Cardinal Rules of Zone and Conduit Engineering

1. No Flat Networks: Direct, unrouted Layer 2 or Layer 3 connectivity across distinct functional areas (e.g., from an operator station directly to an enterprise business desktop) is strictly prohibited.
2. The Safety Zone is Sovereign: The Safety Instrumented System (SIS) logic solvers and engineering tools must occupy a dedicated, segregated security zone. Communication between the SIS and the BPCS must occur through a heavily restricted conduit permitting only read-only status telemetry.
3. Default-Deny Rule: All traffic passing through a conduit must be blocked by default. Only explicitly authorized protocols, source/destination IP addresses, and specific port numbers are allowed.

---

Security Levels (SL) and Foundational Requirements

ISA/IEC 62443 defines four progressive Security Levels (SL) based on the capabilities, resources, and motivation of potential threat actors:

The Three Types of Security Levels

• Target Security Level ($SL-T$): The required security level determined during the cyber risk assessment for a specific zone.
• Capability Security Level ($SL-C$): The security level that vendor hardware/software components are certified to provide out-of-the-box.
• Achieved Security Level ($SL-A$): The actual, verified security level of the fully commissioned and configured industrial system in the field. To achieve compliance: $SL-A \ge SL-T$.

Hardening Devices and Hosts to Meet the Requirements

Security levels are achieved through configuration as much as through product choice. A detailed design typically specifies:

• Least functionality: disable unused services, ports and protocols (for example, web servers, FTP, Telnet and SNMPv1) on controllers, switches and hosts.
• Account management: unique named accounts, removal or change of default credentials, role-based privileges and session timeouts (FR 1 and FR 2).
• Integrity protection: signed firmware where available, controller key switches or write protection in RUN, and application allowlisting on Windows hosts (FR 3).
• Unidirectional gateways (data diodes): hardware that physically allows traffic in only one direction, used where historian or monitoring data must leave a high-security zone and nothing should flow back (FR 5).
• Logging and monitoring: time-synchronized security event logs forwarded to a central collector, plus passive network monitoring (FR 6).
• Resource protection: rate limiting and network design that keep control traffic deterministic during a traffic flood (FR 7).

---

Industrial Demilitarized Zone (IDMZ) & Purdue Model

The Purdue Enterprise Reference Architecture (PERA), standardized within ISA-95, establishes five functional levels:

• Level 5 / 4: Enterprise IT Business Network (ERP, Email, Corporate WAN)
• Level 3.5: Industrial Demilitarized Zone (IDMZ)
• Level 3: Operations & Site-Wide Supervisory Control (Plant Historian, Batch Execution, Domain Controller)
• Level 2: Area Supervisory Control (Local SCADA, Operator HMIs, Alarm Servers)
• Level 1: Basic Direct Process Control (PLCs, DCS Controllers, SIS Logic Solvers, Remote I/O)
• Level 0: Physical Process (Sensors, Transmitters, Control Valves, Motors)

The Architectural Principles of the IDMZ (Level 3.5)

The Industrial Demilitarized Zone (IDMZ) is a critical buffer zone positioned between the untrusted Enterprise Network (Level 4) and the trusted Industrial Automation Control Network (Level 3):

1. Zero Direct Traffic: No network packet may traverse directly from Level 4 to Level 3. Every session originating in Level 4 must terminate on a proxy or jump host in the IDMZ, and a separate, independent session must initiate from the IDMZ into Level 3.
2. Dual-Homed Infrastructure with Routing Disabled: Servers in the IDMZ (such as jump hosts or mirrored historians) frequently contain two physical network interface cards (NICs)—one connected to the Level 4 firewall interface and one connected to the Level 3 firewall interface. IP forwarding/routing between NICs must be explicitly disabled in the operating system kernel.
3. Segregated Authentication Domains: The industrial active directory (OT Forest) must remain strictly independent of the enterprise corporate active directory (IT Forest). Corporate IT credential compromises must never grant access to industrial controllers.
4. Data Replication via Replicated Historian: Process historians on Level 3 push historical data out to a secondary "mirrored" historian located in the IDMZ. Corporate business analysts query the IDMZ mirrored historian, ensuring external database queries never reach Level 3 SCADA databases.

---

Deep Packet Inspection (DPI) for Industrial Protocols

Standard IT firewalls inspect traffic at Network Layer 3 (IP addresses) and Transport Layer 4 (TCP/UDP ports). For example, a standard firewall rule might permit port 502 for Modbus TCP between an engineering laptop and a PLC.

However, industrial protocols such as Modbus TCP, EtherNet/IP (CIP), and PROFINET were designed without native authentication. Once port 502 is open, an attacker or compromised workstation can send any Modbus command. An adversary can issue a Function 05 (Write Single Coil) or Function 16 (Write Multiple Registers) command to shut down cooling pumps or force open safety valves.

An Industrial Deep Packet Inspection (DPI) Firewall operates at Application Layer 7. It disassembles and decodes the industrial protocol payload in real time:

• The DPI firewall verifies the specific industrial function code.
• An engineering rule can be configured: "Permit Function 03 (Read Holding Registers) from HMI to PLC, but DROP and ALARM on any Function 05, 06, or 16 (Write Commands) unless originating from the authenticated Engineering Workstation."

Standard IT Firewall:    [ Allow IP 192.168.1.10 -> 10.10.1.50:502 ] ===> BLIND TO PAYLOAD (Allows Attack!)

Industrial DPI Firewall: [ Decodes Modbus Payload ]
                         - Function Code 03 (Read)?   ===> PASS
                         - Function Code 16 (Write)?  ===> BLOCK & GENERATE SIEM ALERT

---

Secure Remote Access Architectures

Remote vendor support and emergency engineering diagnostics require secure remote access architectures:

• Clientless or TLS VPN: Remote connections authenticate via an external VPN gateway using Multi-Factor Authentication (MFA).
• Jump Host Bastion Model: The remote user connects via Remote Desktop Protocol (RDP) or SSH exclusively to a locked-down jump host located in the IDMZ.
• Session Brokering and Recording: All administrative keystrokes and video sessions are logged for audit compliance.
• Zero Direct Bridging: The remote engineer's personal computer is never bridged onto the industrial control network, eliminating the risk of malware pivoting.

---

Realistic Industrial Scenario: Municipal Water Treatment SCADA Attack

A municipal water treatment plant operated a flat Class C subnet (192.168.1.0/24) connecting chemical dosing PLCs, operator HMIs, and the plant manager's desktop computer. The plant manager installed a third-party commercial remote desktop application (TeamViewer) on their office PC to monitor water quality from home.

The Incident

An external threat actor obtained the plant manager's remote-access credentials. The attacker logged into the desktop via the commercial remote access software and, because the network was completely flat, directly browsed the SCADA HMI. The attacker manipulated the sodium hydroxide (lye) dosing setpoint from 100 ppm to 11,100 ppm, presenting an immediate chemical poisoning hazard to the public municipal water supply. Fortunately, an on-duty plant operator physically observed the mouse cursor moving across the screen and manually aborted the setpoint change.

The ISA/IEC 62443 Remediation

1. Zone Partitioning: The chemical dosing PLCs were isolated into a dedicated Level 1 Security Zone. The operator HMIs were placed in a Level 2 Zone, and the plant manager's office PC was moved to an isolated Level 4 Enterprise LAN.
2. Conduit Enforcement: An industrial DPI firewall was deployed between Level 2 and Level 1, restricting PLC communication to authorized CIP read/write tags exclusively from the HMI IP addresses.
3. IDMZ Implementation: Third-party remote desktop software was permanently uninstalled. Remote access was redesigned using a hardware VPN with time-based Multi-Factor Authentication (MFA) terminating at an IDMZ jump host. From the jump host, a secondary authenticated RDP session was required to access Level 2 supervisory displays, with all active write permissions disabled during remote sessions.

---

Common Exam Traps

1. Permitting Direct Network Bridging Across the IDMZ: Any architecture that routes traffic directly from Level 4 to Level 3 without terminating at an intermediate IDMZ proxy or jump host violates ISA/IEC 62443.
2. Assuming Stateful Firewalls Protect Industrial Payloads: A standard stateful firewall filters only IP addresses and port numbers. It cannot distinguish between a harmless read command and a catastrophic write command within an industrial protocol. Application-layer filtering such as Deep Packet Inspection (DPI) is needed whenever the policy must distinguish harmless reads from writes.
3. Conflating IT Security Priorities with OT Priorities: Exam questions frequently test the confidentiality vs. availability dichotomy. In an industrial plant, shutting down a controller because a non-critical certificate expired or blocking real-time packets due to encryption latency violates functional safety.