xalgord Implementing IEC 62443 Security Zones
When to Use
- When designing a greenfield OT network architecture for a new industrial facility
- When retrofitting security zones into an existing flat OT network after an assessment finding
- When implementing network segmentation to comply with IEC 62443-3-2 certification requirements
- When upgrading from basic VLAN segmentation to policy-enforced zone/conduit architecture
- When an IT/OT convergence project requires defining security boundaries between enterprise and operational networks
Do not use for IT-only network segmentation (see implementing-network-microsegmentation), for cloud-native workload segmentation (see securing-kubernetes-on-cloud), or for physical security zone design without a cyber component.
Common Misconfigurations & Verification
- Zones defined on paper but not enforced. A zone/conduit document and SL-T assignments mean nothing if the firewall still permits any-any or VLANs share a broadcast domain. Verify each conduit's allow list matches the design and that a default-deny terminates every inter-zone ACL.
- SIS not isolated. Placing safety controllers (SL 3) in the same zone as the BPCS violates 62443 isolation; confirm the SIS zone is air-gapped or has no network conduit, exactly as the zone definition states.
- Purdue bypass via dual-homed hosts. Engineering workstations or historians with a NIC in two zones collapse the boundary; enumerate multi-homed assets and remove or firewall them.
- Data diode running backward or bypassed. Confirm unidirectional flow is hardware-enforced (OT->DMZ) and that no parallel TCP path provides a reverse channel.
- Verify without disrupting the process. Deploy firewalls in monitor mode first, then test from each zone during a maintenance window: prohibited cross-zone connections (e.g., Enterprise->PLC on 502/44818/102) must be filtered, and permitted read-only flows must still work. Use connectivity checks, not write commands against live controllers.
Prerequisites
- Completed OT network security assessment with asset inventory and traffic flow analysis
- Understanding of IEC 62443-3-2 zone/conduit design process and the Purdue Reference Model
- Industrial firewalls capable of deep packet inspection for OT protocols (Palo Alto with OT Security, Fortinet OT, Cisco ISA-3000)
- Network switches supporting VLANs, 802.1Q trunking, and port security
- Approval from operations management for network architecture changes during maintenance windows
Workflow
Step 1: Perform Zone Partitioning Based on Risk Assessment
Partition the IACS into zones based on functional requirements, security requirements, criticality, and consequence of compromise. Each zone contains assets with common security requirements.
# IEC 62443-3-2 Zone Definition Document
facility: "Petrochemical Refinery - Unit 3"
assessment_date: "2026-02-23"
standard: "IEC 62443-3-2:2020"
zones:
- zone_id: "Z1-SIS"
name: "Safety Instrumented Systems"
purdue_level: 1
security_level_target: "SL 3"
criticality: "Safety Critical"
assets:
- "Triconex 3008 Safety Controller (SIS-01)"
- "Triconex 3008 Safety Controller (SIS-02)"
- "SIS Engineering Workstation"
security_requirements:
- "Physically isolated from all other zones (air-gapped)"
- "Dedicated engineering workstation with removable media controls"
- "No remote access permitted under any circumstances"
- "Change management requires dual authorization"
allowed_conduits: [] # No network conduits - fully air-gapped
- zone_id: "Z2-BPCS"
name: "Basic Process Control System"
purdue_level: "1-2"
security_level_target: "SL 2"
criticality: "High"
assets:
- "Allen-Bradley ControlLogix PLCs (PLC-01 through PLC-12)"
- "Rockwell FactoryTalk View HMIs (HMI-01 through HMI-06)"
- "Engineering Workstation (EWS-01)"
security_requirements:
- "Industrial firewall at zone boundary with protocol inspection"
- "Read-only access from Level 3 for data acquisition"
- "Write access restricted to engineering workstation subnet"
- "USB ports disabled on HMIs"
allowed_conduits: ["C1-BPCS-OPS"]
- zone_id: "Z3-OPS"
name: "Site Operations"
purdue_level: 3
security_level_target: "SL 2"
criticality: "Medium"
assets:
- "OSIsoft PI Historian (HIST-01)"
- "OPC UA Server (OPC-01)"
- "MES Application Server (MES-01)"
- "Alarm Management Server (ALM-01)"
security_requirements:
- "Firewall between operations and control zones"
- "Firewall between operations and DMZ"
- "No direct internet access"
- "Antivirus with OT-approved signatures"
allowed_conduits: ["C1-BPCS-OPS", "C2-OPS-DMZ"]
- zone_id: "Z4-DMZ"
name: "Industrial Demilitarized Zone"
purdue_level: 3.5
security_level_target: "SL 2"
criticality: "Medium"
assets:
- "PI-to-PI Interface (DMZ-HIST-01)"
- "Patch Management Server (DMZ-WSUS-01)"
- "Remote Access Jump Server (DMZ-JUMP-01)"
- "Data Diode - Waterfall Security (DMZ-DD-01)"
security_requirements:
- "Dual-homed firewalls on both sides"
- "No direct traffic traversal - all connections terminate in DMZ"
- "Data diode for unidirectional historian replication"
- "Jump server with MFA for remote access"
allowed_conduits: ["C2-OPS-DMZ", "C3-DMZ-ENT"]
- zone_id: "Z5-ENT"
name: "Enterprise Network"
purdue_level: 4
security_level_target: "SL 1"
criticality: "Low (from OT perspective)"
assets:
- "Corporate systems accessing OT data"
security_requirements:
- "Firewall between enterprise and DMZ"
- "No direct access to any OT zone below DMZ"
allowed_conduits: ["C3-DMZ-ENT"]
conduits:
- conduit_id: "C1-BPCS-OPS"
name: "Control-to-Operations Conduit"
connects: ["Z2-BPCS", "Z3-OPS"]
security_level: "SL 2"
protocols_allowed:
- protocol: "OPC UA"
port: 4840
direction: "Z2 -> Z3 (read only)"
security_mode: "SignAndEncrypt"
- protocol: "Modbus/TCP"
port: 502
direction: "Z3 -> Z2 (read only, FC 3/4 only)"
security_mode: "Firewall-enforced function code filtering"
controls:
- "Industrial firewall with OT protocol DPI"
- "Allowlisted source/destination IP pairs"
- "Function code filtering (block all write operations from L3)"
- "Connection rate limiting"
- conduit_id: "C2-OPS-DMZ"
name: "Operations-to-DMZ Conduit"
connects: ["Z3-OPS", "Z4-DMZ"]
security_level: "SL 2"
protocols_allowed:
- protocol: "PI-to-PI"
port: 5450
direction: "Z3 -> Z4 (unidirectional via data diode)"
- protocol: "HTTPS"
port: 443
direction: "Z4 -> Z3 (patch downloads only)"
controls:
- "Data diode for historian replication (Waterfall Security)"
- "Firewall with application-layer inspection"
- "Patch server pulls only from approved vendor repositories"
- conduit_id: "C3-DMZ-ENT"
name: "DMZ-to-Enterprise Conduit"
connects: ["Z4-DMZ", "Z5-ENT"]
security_level: "SL 1"
protocols_allowed:
- protocol: "HTTPS"
port: 443
direction: "Z5 -> Z4 (historian read, remote access portal)"
- protocol: "RDP"
port: 3389
direction: "Z5 -> Z4 (jump server with MFA)"
controls:
- "Next-gen firewall with SSL inspection"
- "MFA required for all remote access sessions"
- "Session recording on jump server"
Step 2: Configure Industrial Firewalls for Zone Boundaries
Deploy and configure industrial-grade firewalls at each zone boundary with OT protocol-aware deep packet inspection.
# Cisco ISA-3000 Industrial Firewall Configuration
# Conduit C1: BPCS (Zone 2) <-> Operations (Zone 3)
# Define zone interfaces
interface GigabitEthernet1/1
nameif zone-bpcs
security-level 90
ip address 10.20.1.1 255.255.0.0
interface GigabitEthernet1/2
nameif zone-ops
security-level 70
ip address 10.30.1.1 255.255.0.0
# OPC UA from BPCS to Operations (read-only data flow)
access-list BPCS-to-OPS extended permit tcp 10.20.0.0 255.255.0.0 host 10.30.1.50 eq 4840
# Modbus read from Operations historian to PLCs (FC 3,4 only)
access-list OPS-to-BPCS extended permit tcp host 10.30.1.50 10.20.0.0 255.255.0.0 eq 502
# Deny all other traffic between zones
access-list BPCS-to-OPS extended deny ip any any log
access-list OPS-to-BPCS extended deny ip any any log
# Apply access lists
access-group BPCS-to-OPS in interface zone-bpcs
access-group OPS-to-BPCS in interface zone-ops
# Enable Modbus protocol inspection with function code filtering
policy-map type inspect modbus MODBUS-INSPECT
parameters
# Allow read operations only from Operations zone
match func-code read-coils
match func-code read-discrete-inputs
match func-code read-holding-registers
match func-code read-input-registers
# Block all write function codes
match func-code force-single-coil action drop log
match func-code preset-single-register action drop log
match func-code force-multiple-coils action drop log
match func-code preset-multiple-registers action drop log
# Apply to service policy
policy-map global_policy
class inspection_default
inspect modbus MODBUS-INSPECT
# Logging to OT SIEM
logging host zone-ops 10.30.1.60
logging trap informational
logging enable
Step 3: Implement VLAN Segmentation at Switch Level
Configure network switches to enforce zone boundaries at Layer 2, preventing broadcast domain overlap between Purdue levels.
# Cisco Industrial Ethernet Switch Configuration
# Zone-based VLAN assignment
# VLAN definitions aligned with zones
vlan 10
name Z1-SIS-Safety
vlan 20
name Z2-BPCS-Control
vlan 30
name Z3-OPS-Operations
vlan 35
name Z4-DMZ
vlan 40
name Z5-Enterprise
# PLC ports - Zone 2 BPCS
interface range GigabitEthernet1/0/1-12
description PLC connections - Zone 2
switchport mode access
switchport access vlan 20
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation shutdown
spanning-tree portfast
spanning-tree bpduguard enable
no cdp enable
no lldp transmit
# HMI ports - Zone 2 BPCS
interface range GigabitEthernet1/0/13-18
description HMI connections - Zone 2
switchport mode access
switchport access vlan 20
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation restrict
spanning-tree portfast
# Trunk to industrial firewall
interface GigabitEthernet1/0/24
description Trunk to ISA-3000 Firewall
switchport mode trunk
switchport trunk allowed vlan 20,30,35
switchport trunk native vlan 999
# Disable unused ports
interface range GigabitEthernet1/0/19-23
shutdown
switchport access vlan 999
Step 4: Deploy Data Diode for Unidirectional Historian Replication
Install a hardware-enforced data diode between the operations zone and DMZ to ensure unidirectional data flow from OT to IT. Data diodes physically prevent any data from flowing back into the OT network.
#!/usr/bin/env python3
"""Data Diode Configuration Validator.
Validates that historian replication across the data diode
(Waterfall Security, Owl Cyber Defense, or Siemens) is
functioning correctly with unidirectional enforcement.
"""
import socket
import struct
import time
import json
from datetime import datetime
class DataDiodeValidator:
"""Validates data diode unidirectional enforcement."""
def __init__(self, diode_tx_ip, diode_rx_ip, historian_port=5450):
self.tx_ip = diode_tx_ip # OT side (transmit)
self.rx_ip = diode_rx_ip # IT/DMZ side (receive)
self.port = historian_port
self.results = []
def test_forward_flow(self):
"""Verify data flows from OT (TX) to DMZ (RX) through diode."""
test_payload = f"DIODE_TEST_{datetime.now().isoformat()}"
try:
# Send test data to TX interface
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(5)
sock.sendto(test_payload.encode(), (self.tx_ip, self.port))
sock.close()
self.results.append({
"test": "forward_flow",
"status": "PASS",
"detail": f"Data sent to TX interface {self.tx_ip}:{self.port}",
})
except Exception as e:
self.results.append({
"test": "forward_flow",
"status": "FAIL",
"detail": f"Cannot reach TX interface: {e}",
})
def test_reverse_flow_blocked(self):
"""Verify reverse flow (DMZ to OT) is physically blocked by diode."""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(3)
result = sock.connect_ex((self.tx_ip, self.port))
sock.close()
if result != 0:
self.results.append({
"test": "reverse_flow_blocked",
"status": "PASS",
"detail": "Reverse connection to OT side correctly rejected",
})
else:
self.results.append({
"test": "reverse_flow_blocked",
"status": "CRITICAL_FAIL",
"detail": "REVERSE FLOW POSSIBLE - Data diode bypass detected!",
})
except (socket.timeout, ConnectionRefusedError):
self.results.append({
"test": "reverse_flow_blocked",
"status": "PASS",
"detail": "Reverse connection timed out (expected with hardware diode)",
})
def test_historian_replication_latency(self):
"""Measure replication latency across the data diode."""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(10)
start = time.time()
sock.connect((self.rx_ip, self.port))
latency = (time.time() - start) * 1000
sock.close()
status = "PASS" if latency < 1000 else "WARN"
self.results.append({
"test": "replication_latency",
"status": status,
"detail": f"Replication endpoint latency: {latency:.1f}ms",
})
except Exception as e:
self.results.append({
"test": "replication_latency",
"status": "FAIL",
"detail": f"Cannot reach RX historian: {e}",
})
def run_all_tests(self):
"""Run complete data diode validation suite."""
print("=" * 60)
print("DATA DIODE VALIDATION REPORT")
print("=" * 60)
self.test_forward_flow()
self.test_reverse_flow_blocked()
self.test_historian_replication_latency()
for r in self.results:
status_icon = "+" if r["status"] == "PASS" else "-"
print(f" [{status_icon}] {r['test']}: {r['status']}")
print(f" {r['detail']}")
return self.results
if __name__ == "__main__":
validator = DataDiodeValidator(
diode_tx_ip="10.30.1.100", # Operations zone TX
diode_rx_ip="172.16.1.100", # DMZ zone RX
)
validator.run_all_tests()
Step 5: Validate Zone Architecture
After implementation, validate the zone architecture by verifying that only authorized conduit traffic passes between zones and that all prohibited cross-zone paths are blocked.
# Validation test from Enterprise zone - should be blocked from reaching BPCS
nmap -sT -p 502,44818,102,4840 10.20.0.0/16 --reason
# Expected: All ports filtered/closed
# Validation test from Operations zone - read-only Modbus should work
python3 -c "
from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient('10.20.1.10', port=502)
client.connect()
# Read should succeed
result = client.read_holding_registers(0, 10, slave=1)
print(f'Read test: {\"PASS\" if not result.isError() else \"FAIL\"}')
# Write should be blocked by firewall
result = client.write_register(0, 100, slave=1)
print(f'Write blocked: {\"PASS\" if result.isError() else \"FAIL - WRITE PERMITTED!\"}')
client.close()
"
# Verify data diode blocks reverse traffic
ping -c 3 10.30.1.100 # From DMZ to OT - should timeout
# Expected: 100% packet loss (hardware diode blocks ICMP)
Key Concepts
| Term | Definition |
|---|---|
| Security Zone | A grouping of logical or physical assets that share common security requirements, as defined by IEC 62443-3-2 |
| Conduit | A logical grouping of communication channels connecting two or more zones, subject to common security policies |
| Security Level Target (SL-T) | The desired security level for a zone, ranging from SL 1 (casual violation) to SL 4 (state-sponsored attack) |
| Data Diode | Hardware-enforced unidirectional network gateway that physically prevents data from flowing in the reverse direction |
| Microsegmentation | Granular network segmentation at the device level, managing communication device-by-device based on roles and functions |
| Deep Packet Inspection (DPI) | Firewall capability to inspect industrial protocol payloads (Modbus function codes, OPC UA service calls) beyond Layer 4 |
| Defense in Depth | Layered security approach where multiple security controls protect assets at different levels of the architecture |
Tools & Systems
- Cisco ISA-3000: Industrial security appliance providing OT-aware firewall, IPS, and VPN capabilities with Modbus, DNP3, and EtherNet/IP inspection
- Fortinet FortiGate Rugged: Ruggedized next-gen firewall with OT protocol support for industrial environments
- Palo Alto IoT/OT Security: Cloud-delivered OT security subscription providing device identification and protocol-aware policy enforcement
- Waterfall Security Solutions: Hardware-enforced unidirectional security gateways (data diodes) for OT-to-IT data transfer
- Tofino Xenon: Industrial security appliance providing deep packet inspection for Modbus, OPC, and EtherNet/IP protocols
Common Scenarios
Scenario: Migrating Flat OT Network to Zone Architecture
Context: A manufacturing plant operates all OT devices on a single VLAN (10.10.0.0/16) with no segmentation between PLCs, HMIs, historians, and the corporate network. An IEC 62443 gap assessment identified this as a critical finding requiring zone implementation.
Approach:
- Capture complete traffic baseline for 4 weeks using passive monitoring to identify all legitimate communication flows
- Classify all assets into Purdue levels and group into logical zones based on function and security requirements
- Design VLAN architecture with one VLAN per zone and inter-zone firewall rules based on observed legitimate traffic
- Deploy industrial firewalls at zone boundaries with initial "monitor only" mode (log but do not block)
- Analyze firewall logs for 2 weeks to identify any legitimate traffic that would be blocked
- Switch firewalls to enforcement mode during a scheduled maintenance window
- Validate that all process control communications function correctly post-segmentation
- Implement data diode between operations and DMZ for historian replication
Pitfalls: Implementing zone firewalls without a complete traffic baseline will break unknown but legitimate communication paths. Scheduling zone cutover during production instead of maintenance windows risks process disruptions. Placing SIS controllers in the same zone as BPCS violates IEC 62443 safety system isolation requirements.
Output Format
IEC 62443 Zone Implementation Report
=====================================
Facility: [Name]
Implementation Date: YYYY-MM-DD
Standard: IEC 62443-3-2/3-3
ZONE ARCHITECTURE:
Zone [ID]: [Name] (SL-T: [1-4])
Assets: [count]
Conduits: [list]
Controls: [firewall type, data diode, etc.]
CONDUIT CONFIGURATION:
Conduit [ID]: [Zone A] <-> [Zone B]
Protocols: [allowed protocols with direction]
Firewall Rules: [count allow / count deny]
DPI Enabled: Yes/No
VALIDATION RESULTS:
Cross-zone tests: [pass/fail count]
Prohibited path tests: [all blocked / exceptions]
Protocol enforcement: [function code filtering verified]