implementing-iec-62443-security-zones

What this skill does

# Implementing IEC 62443 Security Zones

## When to Use

- When designing a greenfield OT network architecture for a new industrial facility
- When retrofitting security zones into an existing flat OT network after an assessment finding
- When implementing network segmentation to comply with IEC 62443-3-2 certification requirements
- When upgrading from basic VLAN segmentation to policy-enforced zone/conduit architecture
- When an IT/OT convergence project requires defining security boundaries between enterprise and operational networks

**Do not use** for IT-only network segmentation (see implementing-network-microsegmentation), for cloud-native workload segmentation (see securing-kubernetes-on-cloud), or for physical security zone design without a cyber component.

## Prerequisites

- Completed OT network security assessment with asset inventory and traffic flow analysis
- Understanding of IEC 62443-3-2 zone/conduit design process and the Purdue Reference Model
- Industrial firewalls capable of deep packet inspection for OT protocols (Palo Alto with OT Security, Fortinet OT, Cisco ISA-3000)
- Network switches supporting VLANs, 802.1Q trunking, and port security
- Approval from operations management for network architecture changes during maintenance windows

## Workflow

### Step 1: Perform Zone Partitioning Based on Risk Assessment

Partition the IACS into zones based on functional requirements, security requirements, criticality, and consequence of compromise. Each zone contains assets with common security requirements.

```yaml
# IEC 62443-3-2 Zone Definition Document
facility: "Petrochemical Refinery - Unit 3"
assessment_date: "2026-02-23"
standard: "IEC 62443-3-2:2020"

zones:
  - zone_id: "Z1-SIS"
    name: "Safety Instrumented Systems"
    purdue_level: 1
    security_level_target: "SL 3"
    criticality: "Safety Critical"
    assets:
      - "Triconex 3008 Safety Controller (SIS-01)"
      - "Triconex 3008 Safety Controller (SIS-02)"
      - "SIS Engineering Workstation"
    security_requirements:
      - "Physically isolated from all other zones (air-gapped)"
      - "Dedicated engineering workstation with removable media controls"
      - "No remote access permitted under any circumstances"
      - "Change management requires dual authorization"
    allowed_conduits: []  # No network conduits - fully air-gapped

  - zone_id: "Z2-BPCS"
    name: "Basic Process Control System"
    purdue_level: "1-2"
    security_level_target: "SL 2"
    criticality: "High"
    assets:
      - "Allen-Bradley ControlLogix PLCs (PLC-01 through PLC-12)"
      - "Rockwell FactoryTalk View HMIs (HMI-01 through HMI-06)"
      - "Engineering Workstation (EWS-01)"
    security_requirements:
      - "Industrial firewall at zone boundary with protocol inspection"
      - "Read-only access from Level 3 for data acquisition"
      - "Write access restricted to engineering workstation subnet"
      - "USB ports disabled on HMIs"
    allowed_conduits: ["C1-BPCS-OPS"]

  - zone_id: "Z3-OPS"
    name: "Site Operations"
    purdue_level: 3
    security_level_target: "SL 2"
    criticality: "Medium"
    assets:
      - "OSIsoft PI Historian (HIST-01)"
      - "OPC UA Server (OPC-01)"
      - "MES Application Server (MES-01)"
      - "Alarm Management Server (ALM-01)"
    security_requirements:
      - "Firewall between operations and control zones"
      - "Firewall between operations and DMZ"
      - "No direct internet access"
      - "Antivirus with OT-approved signatures"
    allowed_conduits: ["C1-BPCS-OPS", "C2-OPS-DMZ"]

  - zone_id: "Z4-DMZ"
    name: "Industrial Demilitarized Zone"
    purdue_level: 3.5
    security_level_target: "SL 2"
    criticality: "Medium"
    assets:
      - "PI-to-PI Interface (DMZ-HIST-01)"
      - "Patch Management Server (DMZ-WSUS-01)"
      - "Remote Access Jump Server (DMZ-JUMP-01)"
      - "Data Diode - Waterfall Security (DMZ-DD-01)"
    security_requirements:
      - "Dual-homed firewalls on both sides"
      - "No direct traffic traversal - all connections terminate in DMZ"
      - "Data diode for unidirectional historian replication"
      - "Jump server with MFA for remote access"
    allowed_conduits: ["C2-OPS-DMZ", "C3-DMZ-ENT"]

  - zone_id: "Z5-ENT"
    name: "Enterprise Network"
    purdue_level: 4
    security_level_target: "SL 1"
    criticality: "Low (from OT perspective)"
    assets:
      - "Corporate systems accessing OT data"
    security_requirements:
      - "Firewall between enterprise and DMZ"
      - "No direct access to any OT zone below DMZ"
    allowed_conduits: ["C3-DMZ-ENT"]

conduits:
  - conduit_id: "C1-BPCS-OPS"
    name: "Control-to-Operations Conduit"
    connects: ["Z2-BPCS", "Z3-OPS"]
    security_level: "SL 2"
    protocols_allowed:
      - protocol: "OPC UA"
        port: 4840
        direction: "Z2 -> Z3 (read only)"
        security_mode: "SignAndEncrypt"
      - protocol: "Modbus/TCP"
        port: 502
        direction: "Z3 -> Z2 (read only, FC 3/4 only)"
        security_mode: "Firewall-enforced function code filtering"
    controls:
      - "Industrial firewall with OT protocol DPI"
      - "Allowlisted source/destination IP pairs"
      - "Function code filtering (block all write operations from L3)"
      - "Connection rate limiting"

  - conduit_id: "C2-OPS-DMZ"
    name: "Operations-to-DMZ Conduit"
    connects: ["Z3-OPS", "Z4-DMZ"]
    security_level: "SL 2"
    protocols_allowed:
      - protocol: "PI-to-PI"
        port: 5450
        direction: "Z3 -> Z4 (unidirectional via data diode)"
      - protocol: "HTTPS"
        port: 443
        direction: "Z4 -> Z3 (patch downloads only)"
    controls:
      - "Data diode for historian replication (Waterfall Security)"
      - "Firewall with application-layer inspection"
      - "Patch server pulls only from approved vendor repositories"

  - conduit_id: "C3-DMZ-ENT"
    name: "DMZ-to-Enterprise Conduit"
    connects: ["Z4-DMZ", "Z5-ENT"]
    security_level: "SL 1"
    protocols_allowed:
      - protocol: "HTTPS"
        port: 443
        direction: "Z5 -> Z4 (historian read, remote access portal)"
      - protocol: "RDP"
        port: 3389
        direction: "Z5 -> Z4 (jump server with MFA)"
    controls:
      - "Next-gen firewall with SSL inspection"
      - "MFA required for all remote access sessions"
      - "Session recording on jump server"
```

### Step 2: Configure Industrial Firewalls for Zone Boundaries

Deploy and configure industrial-grade firewalls at each zone boundary with OT protocol-aware deep packet inspection.

```bash
# Cisco ISA-3000 Industrial Firewall Configuration
# Conduit C1: BPCS (Zone 2) <-> Operations (Zone 3)

# Define zone interfaces
interface GigabitEthernet1/1
  nameif zone-bpcs
  security-level 90
  ip address 10.20.1.1 255.255.0.0

interface GigabitEthernet1/2
  nameif zone-ops
  security-level 70
  ip address 10.30.1.1 255.255.0.0

# OPC UA from BPCS to Operations (read-only data flow)
access-list BPCS-to-OPS extended permit tcp 10.20.0.0 255.255.0.0 host 10.30.1.50 eq 4840
# Modbus read from Operations historian to PLCs (FC 3,4 only)
access-list OPS-to-BPCS extended permit tcp host 10.30.1.50 10.20.0.0 255.255.0.0 eq 502

# Deny all other traffic between zones
access-list BPCS-to-OPS extended deny ip any any log
access-list OPS-to-BPCS extended deny ip any any log

# Apply access lists
access-group BPCS-to-OPS in interface zone-bpcs
access-group OPS-to-BPCS in interface zone-ops

# Enable Modbus protocol inspection with function code filtering
policy-map type inspect modbus MODBUS-INSPECT
  parameters
    # Allow read operations only from Operations zone
    match func-code read-coils
    match func-code read-discrete-inputs
    match func-code read-holding-registers
    match func-code read-input-registers
    # Block all write function codes
    match func-code force-single-coil  action drop log
    match func-code preset-single-register  action drop log
    match func-code force-multiple-coils  actio