Zones and Conduits

The two words

IEC 62443 describes a control system as zones connected by conduits. A zone is a grouping of physical or logical assets that share common security requirements. A conduit is a logical grouping of communication channels between zones that share the same security requirements. The definitions are deliberately about requirements rather than about networks: two devices on the same switch can be in different zones if they need different protection, and two sites a hundred miles apart can be in the same zone if they do not.

In practice zones do usually end up mapped onto network segments, because a network boundary is how the requirement gets enforced. But the design goes in the order requirement first, network second. Drawing zones from the existing subnets is the most common mistake, and it produces a drawing that documents what happens to exist rather than what should.

Drawing the zones

1. 1

   Start from the asset inventory

   Every controller, HMI, server, workstation, network device, radio, modem, and instrument with a network address. A zone drawing built from memory misses the things that matter.

2. 2

   Group by function

   Assets that do the same job together: the SCADA servers, the plant PLCs, the engineering workstations, the historian. Then by physical location, because a remote site cannot share enforcement with the plant.

3. 3

   Separate by criticality

   Within a function, split out anything whose compromise has a different consequence. A chlorine feed controller and a lighting controller are both PLCs; they are not the same zone.

4. 4

   Separate by ownership and trust

   Anything managed by someone else, a vendor-maintained package system, a leased radio network, a shared municipal network, gets its own zone or is treated as outside.

5. 5

   Assign a target security level

   From the risk assessment, per zone. Most control zones land at SL 2. The zone containing the most consequential process gets the closest look.

6. 6

   Check the boundaries

   Every place a line crosses a zone edge is a conduit and needs an enforcement point. If a boundary cannot be enforced, either merge the zones and protect them at the higher level, or move the enforcement to where it can be done.

A worked example

A mid-size water and wastewater utility with one treatment plant, a SCADA system, a dozen remote sites, and an office network might partition itself like this.

The conduits between those zones are then listed one at a time. The table is long in real systems; the extract below shows the shape.

From the table to the firewall

Each row in the conduit table becomes one or more firewall rules, and the rule number goes back into the table. This is what makes the drawing maintainable: when a rule is questioned a year later, the table says which conduit it serves and why. A rule with no conduit is removed. A conduit with no rule is a finding. The discipline is that the table is the source and the firewall is the implementation, not the other way around.

Remote sites

Utilities have many small zones and few large ones. Each lift station, well, and tank site is its own zone because a site is physically accessible to anyone with a bolt cutter, its enclosure may have a cellular modem in it, and its compromise should stop at the fence. The conduit from each site to the SCADA servers is the telemetry link, and it is enforced at the site by a small firewall or router access list that allows the SCADA protocol to the master and nothing else, and at the plant by the telemetry router that refuses site-to-site traffic.

The conduits nobody drew

When a zone drawing is checked against the network, the discrepancies are almost always conduits that exist without being documented. Look for these.

• A cellular modem installed by a vendor for support, with the vendor holding the credentials, plugged into the control network.
• A laptop with wireless enabled that is also cabled into a control switch, bridging enterprise and control.
• A historian or reporting connection that was set up as a pull from the enterprise side because it was easier.
• A managed switch with its management interface on the control VLAN and a default password.
• A printer, a camera system, or an HVAC controller sharing the control network because a port was free.
• A remote desktop tool on the SCADA server that reaches the internet directly.

Each of these is either brought into the table and enforced, or removed. Leaving one off the drawing does not make it go away; it makes the drawing wrong.