implementing-iec-62443-security-zones

Start with a risk assessment and traffic baseline, then partition assets into zones by criticality and assign Security Level Targets. Deploy industrial firewalls at zone boundaries in monitor mode first, then enforce default-deny conduit rules during a maintenance window.

A zone is a grouping of assets sharing common security requirements, while a conduit is the controlled communication channel connecting two zones. Conduits define allowed protocols, directions, and security controls such as firewalls and function code filtering.

The Skill covers Cisco ISA-3000, Fortinet FortiGate Rugged, Palo Alto with OT Security, and Tofino Xenon. These inspect industrial protocols like Modbus, OPC UA, and EtherNet/IP beyond Layer 4, enabling function code filtering.

IEC 62443 requires SIS isolation because safety controllers demand the highest protection level, typically SL 3. The Skill recommends air-gapping the SIS zone with no network conduits, dedicated engineering workstations, and dual-authorization change management.

Deploy firewalls in monitor-only mode first and analyze logs for legitimate traffic. During a maintenance window, run connectivity checks confirming prohibited cross-zone ports like 502, 44818, and 102 are filtered while permitted read-only flows still work.

Do not use it for IT-only network segmentation, cloud-native workload segmentation such as Kubernetes, or physical security zone design without a cyber component. Those scenarios require different skills and frameworks.