implementing-iec-62443-security-zones

This skill covers designing and implementing security zones and conduits for industrial automation and control systems (IACS) per IEC 62443-3-2. It addresses zone partitioning based on risk assessment, assigning Security Level targets (SL-T), designing conduit security controls, implementing microsegmentation with industrial firewalls, and validating zone architecture through traffic analysis and penetration testing against the Purdue Reference Model.

Jump to install

Repository: autohandai/community-skills
Last source activity: March 16, 2026 at 00:59
Detected SKILL.md language: English
Stars: 10
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	implementing-iec-62443-security-zones
description	This skill covers designing and implementing security zones and conduits for industrial automation and control systems (IACS) per IEC 62443-3-2. It addresses zone partitioning based on risk assessment, assigning Security Level targets (SL-T), designing conduit security controls, implementing microsegmentation with industrial firewalls, and validating zone architecture through traffic analysis and penetration testing against the Purdue Reference Model.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","scada","industrial-control","iec62443","network-segmentation","zones-conduits"]
version	1.0.0
author	mahipal
license	Apache-2.0

Implementing IEC 62443 Security Zones

When to Use

When designing a greenfield OT network architecture for a new industrial facility
When retrofitting security zones into an existing flat OT network after an assessment finding
When implementing network segmentation to comply with IEC 62443-3-2 certification requirements
When upgrading from basic VLAN segmentation to policy-enforced zone/conduit architecture
When an IT/OT convergence project requires defining security boundaries between enterprise and operational networks

Do not use for IT-only network segmentation (see implementing-network-microsegmentation), for cloud-native workload segmentation (see securing-kubernetes-on-cloud), or for physical security zone design without a cyber component.

Prerequisites

Completed OT network security assessment with asset inventory and traffic flow analysis
Understanding of IEC 62443-3-2 zone/conduit design process and the Purdue Reference Model
Industrial firewalls capable of deep packet inspection for OT protocols (Palo Alto with OT Security, Fortinet OT, Cisco ISA-3000)
Network switches supporting VLANs, 802.1Q trunking, and port security
Approval from operations management for network architecture changes during maintenance windows

Workflow

Step 1: Perform Zone Partitioning Based on Risk Assessment

Partition the IACS into zones based on functional requirements, security requirements, criticality, and consequence of compromise. Each zone contains assets with common security requirements.

# IEC 62443-3-2 Zone Definition Document
facility: "Petrochemical Refinery - Unit 3"
assessment_date: "2026-02-23"
standard: "IEC 62443-3-2:2020"

zones:
  - zone_id: "Z1-SIS"
    name: "Safety Instrumented Systems"
    purdue_level: 1
    security_level_target: "SL 3"
    criticality: "Safety Critical"
    assets:
       
       
       
    
       
       
       
       
     []  

    
     
     
     
     
    
       
       
       
    
       
       
       
       
     []

    
     
     
     
     
    
       
       
       
       
    
       
       
       
       
     [, ]

    
     
     
     
     
    
       
       
       
       
    
       
       
       
       
     [, ]

    
     
     
     
     
    
       
    
       
       
     []


    
     
     [, ]
     
    
        
         
         
         
        
         
         
         
    
       
       
       
       

    
     
     [, ]
     
    
        
         
         
        
         
         
    
       
       
       

    
     
     [, ]

# Cisco ISA-3000 Industrial Firewall Configuration
# Conduit C1: BPCS (Zone 2) <-> Operations (Zone 3)

# Define zone interfaces
interface GigabitEthernet1/1
  nameif zone-bpcs
  security-level 90
  ip address 10.20.1.1 255.255.0.0

interface GigabitEthernet1/2
  nameif zone-ops
  security-level 70
  ip address 10.30.1.1 255.255.0.0

# OPC UA from BPCS to Operations (read-only data flow)
access-list BPCS-to-OPS extended permit tcp 10.20.0.0 255.255.0.0 host 10.30.1.50 eq 4840
# Modbus read from Operations historian to PLCs (FC 3,4 only)
access-list OPS-to-BPCS extended permit tcp host 10.30.1.50 10.20.0.0 255.255.0.0 eq 502

# Deny all other traffic between zones
access-list BPCS-to-OPS extended deny ip any any log
access-list OPS-to-BPCS extended deny ip any any log

# Apply access lists
access-group BPCS-to-OPS in interface zone-bpcs
access-group OPS-to-BPCS in interface zone-ops

# Enable Modbus protocol inspection with function code filtering
policy-map type inspect modbus MODBUS-INSPECT
  parameters
    # Allow read operations only from Operations zone
    match func-code read-coils
    match func-code read-discrete-inputs
    match func-code read-holding-registers
    match func-code read-input-registers
    # Block all write function codes
    match func-code force-single-coil  action drop log
    match func-code preset-single-register  action drop log
    match func-code force-multiple-coils  action drop log
    match func-code preset-multiple-registers  action drop log

# Apply to service policy
policy-map global_policy
  class inspection_default
    inspect modbus MODBUS-INSPECT

# Logging to OT SIEM
logging host zone-ops 10.30.1.60
logging trap informational
logging enable

# Cisco Industrial Ethernet Switch Configuration
# Zone-based VLAN assignment

# VLAN definitions aligned with zones
vlan 10
  name Z1-SIS-Safety
vlan 20
  name Z2-BPCS-Control
vlan 30
  name Z3-OPS-Operations
vlan 35
  name Z4-DMZ
vlan 40
  name Z5-Enterprise

# PLC ports - Zone 2 BPCS
interface range GigabitEthernet1/0/1-12
  description PLC connections - Zone 2
  switchport mode access
  switchport access vlan 20
  switchport port-security
  switchport port-security maximum 1
  switchport port-security mac-address sticky
  switchport port-security violation shutdown
  spanning-tree portfast
  spanning-tree bpduguard enable
  no cdp enable
  no lldp transmit

# HMI ports - Zone 2 BPCS
interface range GigabitEthernet1/0/13-18
  description HMI connections - Zone 2
  switchport mode access
  switchport access vlan 20
  switchport port-security
  switchport port-security maximum 1
  switchport port-security mac-address sticky
  switchport port-security violation restrict
  spanning-tree portfast

# Trunk to industrial firewall
interface GigabitEthernet1/0/24
  description Trunk to ISA-3000 Firewall
  switchport mode trunk
  switchport trunk allowed vlan 20,30,35
  switchport trunk native vlan 999

# Disable unused ports
interface range GigabitEthernet1/0/19-23
  shutdown
  switchport access vlan 999

#!/usr/bin/env python3
"""Data Diode Configuration Validator.

Validates that historian replication across the data diode
(Waterfall Security, Owl Cyber Defense, or Siemens) is
functioning correctly with unidirectional enforcement.
"""

import socket
import struct
import time
import json
from datetime import datetime


class DataDiodeValidator:
    """Validates data diode unidirectional enforcement."""

    def __init__(self, diode_tx_ip, diode_rx_ip, historian_port=5450):
        self.tx_ip = diode_tx_ip  # OT side (transmit)
        self.rx_ip = diode_rx_ip  # IT/DMZ side (receive)
        self.port = historian_port
        self.results = []

    def test_forward_flow(self):
        """Verify data flows from OT (TX) to DMZ (RX) through diode."""
        test_payload = f"DIODE_TEST_{datetime.now().isoformat()}"

        try:
            # Send test data to TX interface
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            sock.settimeout(5)
            sock.sendto(test_payload.encode(), (self.tx_ip, self.port))
            sock.close()

            self.results.append({
                "test": "forward_flow",
                "status": "PASS",
                "detail": f"Data sent to TX interface {self.tx_ip}:{self.port}",
            })
        except Exception as e:
            self.results.append({
                "test": "forward_flow",
                "status": "FAIL",
                "detail": f"Cannot reach TX interface: {e}",
            })

    def test_reverse_flow_blocked(self):
        """Verify reverse flow (DMZ to OT) is physically blocked by diode."""
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(3)
            result = sock.connect_ex((self.tx_ip, self.port))
            sock.close()

            if result != 0:
                self.results.append({
                    "test": "reverse_flow_blocked",
                    "status": "PASS",
                    "detail": "Reverse connection to OT side correctly rejected",
                })
            else:
                self.results.append({
                    "test": "reverse_flow_blocked",
                    "status": "CRITICAL_FAIL",
                    "detail": "REVERSE FLOW POSSIBLE - Data diode bypass detected!",
                })
        except (socket.timeout, ConnectionRefusedError):
            self.results.append({
                "test": "reverse_flow_blocked",
                "status": "PASS",
                "detail": "Reverse connection timed out (expected with hardware diode)",
            })

    def test_historian_replication_latency(self):
        """Measure replication latency across the data diode."""
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(10)
            start = time.time()
            sock.connect((self.rx_ip, self.port))
            latency = (time.time() - start) * 1000
            sock.close()

            status = "PASS" if latency < 1000 else "WARN"
            self.results.append({
                "test": "replication_latency",
                "status": status,
                "detail": f"Replication endpoint latency: {latency:.1f}ms",
            })
        except Exception as e:
            self.results.append({
                "test": "replication_latency",
                "status": "FAIL",
                "detail": f"Cannot reach RX historian: {e}",
            })

    def run_all_tests(self):
        """Run complete data diode validation suite."""
        print("=" * 60)
        print("DATA DIODE VALIDATION REPORT")
        print("=" * 60)

        self.test_forward_flow()
        self.test_reverse_flow_blocked()
        self.test_historian_replication_latency()

        for r in self.results:
            status_icon = "+" if r["status"] == "PASS" else "-"
            print(f"  [{status_icon}] {r['test']}: {r['status']}")
            print(f"      {r['detail']}")

        return self.results


if __name__ == "__main__":
    validator = DataDiodeValidator(
        diode_tx_ip="10.30.1.100",   # Operations zone TX
        diode_rx_ip="172.16.1.100",  # DMZ zone RX
    )
    validator.run_all_tests()

# Validation test from Enterprise zone - should be blocked from reaching BPCS
nmap -sT -p 502,44818,102,4840 10.20.0.0/16 --reason
# Expected: All ports filtered/closed

# Validation test from Operations zone - read-only Modbus should work
python3 -c "
from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient('10.20.1.10', port=502)
client.connect()
# Read should succeed
result = client.read_holding_registers(0, 10, slave=1)
print(f'Read test: {\"PASS\" if not result.isError() else \"FAIL\"}')
# Write should be blocked by firewall
result = client.write_register(0, 100, slave=1)
print(f'Write blocked: {\"PASS\" if result.isError() else \"FAIL - WRITE PERMITTED!\"}')
client.close()
"

# Verify data diode blocks reverse traffic
ping -c 3 10.30.1.100  # From DMZ to OT - should timeout
# Expected: 100% packet loss (hardware diode blocks ICMP)

Term	Definition
Security Zone	A grouping of logical or physical assets that share common security requirements, as defined by IEC 62443-3-2
Conduit	A logical grouping of communication channels connecting two or more zones, subject to common security policies
Security Level Target (SL-T)	The desired security level for a zone, ranging from SL 1 (casual violation) to SL 4 (state-sponsored attack)
Data Diode	Hardware-enforced unidirectional network gateway that physically prevents data from flowing in the reverse direction
Microsegmentation	Granular network segmentation at the device level, managing communication device-by-device based on roles and functions
Deep Packet Inspection (DPI)	Firewall capability to inspect industrial protocol payloads (Modbus function codes, OPC UA service calls) beyond Layer 4
Defense in Depth	Layered security approach where multiple security controls protect assets at different levels of the architecture

IEC 62443 Zone Implementation Report
=====================================
Facility: [Name]
Implementation Date: YYYY-MM-DD
Standard: IEC 62443-3-2/3-3

ZONE ARCHITECTURE:
  Zone [ID]: [Name] (SL-T: [1-4])
    Assets: [count]
    Conduits: [list]
    Controls: [firewall type, data diode, etc.]

CONDUIT CONFIGURATION:
  Conduit [ID]: [Zone A] <-> [Zone B]
    Protocols: [allowed protocols with direction]
    Firewall Rules: [count allow / count deny]
    DPI Enabled: Yes/No

VALIDATION RESULTS:
  Cross-zone tests: [pass/fail count]
  Prohibited path tests: [all blocked / exceptions]
  Protocol enforcement: [function code filtering verified]