OT security for plant systems: zones, conduits and the controls that fit a plant
What makes OT different from IT, the zones and conduits every reference agrees on, the IEC 62443 security levels in plain words, the eight controls that fit a plant and how each differs from its office form, the Essential Eight applied with judgement, and how remote access and the supply chain are handled.
Key takeaways
- OT security protects the systems that run a plant, where the consequence of a breach is a physical one. It borrows from IT security and differs from it wherever a control could stop the plant.
- The structure is zones and conduits: the plant divided by function and consequence, with a named, firewalled path between each pair and the industrial DMZ as the only crossing to the business.
- IEC 62443 is the reference for the structure and the requirements, NIST SP 800-82 for the practice, and the ASD's Essential Eight for the controls, applied with the compensating measures a plant needs.
- The controls that matter most are the plain ones: know every device, segment, control remote access, back up the controller programs, allowlist the workstations, and watch the network passively.
- Patching is deferred, not skipped. A controller is patched in a window after the vendor has qualified the patch, with the exposure reduced by segmentation until then.
The systems that run a plant were built to be reliable, deterministic and left alone. Most of them predate the idea that anything outside the control room would ever talk to them, and many will run for another twenty years. OT security is the discipline of protecting those systems now that they are connected, in a way that respects what they are: equipment whose failure is physical, and whose owners rightly refuse a control that could stop the plant.
This guide sets out what makes OT different from IT, the structure of zones and conduits that every reference agrees on, the IEC 62443 security levels in plain words, the controls that fit a plant and how each differs from its office form, how the Essential Eight is applied with judgement, how remote access and the supply chain are handled, and the mistakes that are common enough to be predictable.
The references are IEC 62443 for the structure and requirements, NIST SP 800-82 for the practice, and the Australian Signals Directorate's Essential Eight and principles of OT cyber security for the controls and the governance. They are reference points for the reader, not a programme Enco offers. Enco builds and integrates software on this ground, and the plant protocols and data historian guides sit beside this one.
What makes OT different
The difference is the consequence. In an office, a breach exposes data; in a plant, it can open a valve, stop a conveyor, disable a trip or hurt someone. The ASD's first principle of OT cyber security is that safety is paramount, and every control is read against it. A control that could interrupt the plant is not applied in its office form, and the question becomes what compensating control gives the same protection without the interruption.
The second difference is change. Office systems are patched monthly and replaced every few years. A controller runs the same firmware for a decade because changing it means a shutdown, a vendor qualification and a retest of the safety functions. That slow pace is a safety and availability decision, not neglect, and OT security works with it by reducing the exposure of what cannot be changed rather than insisting it change.
The third is visibility. Active scanning that is routine on an office network can crash a controller that was never built to answer it. Inventory and monitoring in a plant are passive, built from listening to the network and reading the configuration, and the people who read the results know what the normal conversations of the plant look like.
Zones and conduits
Every reference arrives at the same structure. The plant is divided into zones, groups of assets with the same security requirement, by function and by the consequence of their compromise. Between each pair of zones that need to talk runs a conduit, a named path with the devices, protocols and ports that may use it written down and enforced by a firewall. IEC 62443-3-2 sets out the risk assessment that produces the zones, and the Purdue levels of ISA-95 are the usual starting shape.
The industrial DMZ is the one crossing between the plant and the business, and the rule that makes it work is that no connection passes through it in one hop. The plant pushes a historian replica and publishes to a broker in the DMZ; the business reads from those; remote access lands on a jump host there and goes no further without a second step. The historian guide shows the data path; this is the security reason for it.
Level 4 to 5
Business and internet
ERP, email, the data warehouse, vendor and cloud services
Conduit
Reads from the DMZ replica and broker. Remote access only to the jump host, with multi-factor authentication
Level 3.5
Industrial DMZ
Historian replica, MQTT broker, patch and antivirus relays, the jump host for remote access
Conduit
Every path between plant and business ends here. No connection crosses the DMZ in one hop
Level 3
Site operations
Site historian, MES, batch, reporting, the domain for the plant
Conduit
Replication and MQTT outward through the DMZ only
Level 2
Supervisory control
SCADA, HMI, engineering workstations, the historian collector
Conduit
OPC UA and historian replication upward, nothing inbound except from the jump host
Level 0 to 1
Process and basic control
Instruments, actuators, drives, PLCs, safety systems
Conduit
Controller protocols to the supervisory zone, firewalled by device and port. Safety systems on their own zone
- ↑ Data flows up through the DMZ. Nothing above it reaches a controller
| Level | Zone | Holds | The conduit rule |
|---|---|---|---|
| 0 to 1 | Process and basic control | Instruments, actuators, drives, PLCs, safety systems | Controller protocols to the supervisory zone, firewalled by device and port. Safety systems on their own zone |
| 2 | Supervisory control | SCADA, HMI, engineering workstations, the historian collector | OPC UA and historian replication upward, nothing inbound except from the jump host |
| 3 | Site operations | Site historian, MES, batch, reporting, the domain for the plant | Replication and MQTT outward through the DMZ only |
| 3.5 | Industrial DMZ | Historian replica, MQTT broker, patch and antivirus relays, the jump host for remote access | Every path between plant and business ends here. No connection crosses the DMZ in one hop |
| 4 to 5 | Business and internet | ERP, email, the data warehouse, vendor and cloud services | Reads from the DMZ replica and broker. Remote access only to the jump host, with multi-factor authentication |
A conduit is a firewall rule that names devices and ports. Any to any between two zones is not a conduit. It is the absence of one.
The IEC 62443 security levels
IEC 62443-3-3 lists the technical requirements for a system and grades each at four security levels, by the kind of attacker the zone has to resist. The level is chosen per zone from the risk assessment, which is what lets a site put its effort where the consequence is, rather than everywhere equally. A safety system zone and a process control zone are usually specified higher than a reporting zone, and the requirements for each follow from the level.
| Level | Resists | In practice |
|---|---|---|
| SL 1 | Casual or accidental misuse | A well-meaning operator or a stray laptop |
| SL 2 | Intentional misuse with simple means, low resources and generic skills | Commodity malware, an opportunist with a found password |
| SL 3 | Sophisticated means, moderate resources, system-specific skills | An attacker who has studied the plant's systems |
| SL 4 | Sophisticated means, extended resources, specific skills, high motivation | A well-funded, patient group |
The controls that fit a plant
Most of what protects a plant is plain. The controls below are the ones every reference lists, with the way each differs from its office form and the reference it comes from. None of them is novel, and a site that has all eight in place, honestly, is well ahead of most.
| Control | How it is done in a plant | Reference |
|---|---|---|
| Asset inventory | Every controller, HMI, drive and network device, with firmware and the program backed up. Built passively, because active scanning can stop a PLC | IEC 62443-2-1, NIST SP 800-82 |
| Zones and conduits | Segmentation by function and consequence, with a firewall rule per conduit that names the devices and ports. The DMZ as the only crossing | IEC 62443-3-2 |
| Remote access | Through a jump host in the DMZ with multi-factor authentication, a named person, a time window and a recording. Vendor access the same way, never a modem or a vendor's own tunnel | IEC 62443-3-3, Essential Eight |
| Patching | Deferred to the next window after the vendor has qualified the patch, with the exposure reduced by segmentation in the meantime. Never automatic on a controller | Essential Eight, applied with compensating controls |
| Application control | Allowlisting on HMIs and engineering workstations, which change rarely, so it holds better than it does on office machines | Essential Eight |
| Backups | Controller programs, HMI projects, historian and configuration, tested by restoring to a spare. The recovery time is a plant availability figure | Essential Eight, IEC 62443-3-3 |
| Monitoring | Passive network monitoring that learns the normal conversations and raises what is new, read by someone who knows the plant | NIST SP 800-82 |
| Safety systems | Safety instrumented systems in their own zone, with engineering access physically controlled, because the consequence is not data | IEC 62443-3-2, ASD OT principles |
The Essential Eight, read for a plant
The Australian Signals Directorate's Essential Eight is the baseline most Australian organisations are measured against: application control, patching applications, configuring macro settings, hardening user applications, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. It was written for office systems, and it applies to a plant with judgement rather than by exception.
Some of it fits OT better than it fits an office. Application control holds well on an HMI or an engineering workstation that runs the same five programs for years. Restricting administrative privileges is natural where the engineering account is the only one that changes anything. Multi-factor authentication belongs at the point of remote access, on the jump host, where it protects the whole plant at one door. Backups of controller programs and HMI projects, restored to a spare to prove they work, are the recovery plan for a plant and are often the one control nobody has tested.
Patching is where the judgement sits. A controller or a SCADA server is patched when the vendor has qualified the patch and the plant has a window, which can be months, and in the meantime the exposure is reduced by the zone it sits in and the conduits into it. That is recorded as a compensating control against the maturity model, with the reason, which is what an assessor expects to see.
Remote access and the supply chain
Remote access is the door most often left open. Vendors need to support their equipment, engineers need to work from home, and every one of those needs has at some point been met with a cellular modem in a panel or a vendor's own tunnel that nobody at the site can see. The path is the same for everyone: a jump host in the DMZ, multi-factor authentication, a named person, a session opened by the site for a time window and closed afterwards, and a recording of what was done.
The supply chain is the same door seen from the other side. The ASD's principles put it plainly: the supply chain must be secure, because the vendor's laptop, the integrator's USB stick and the cloud service the equipment phones home to are each a path into the plant. Equipment is specified with its security requirements, in the language of IEC 62443-4-2, and a vendor's remote connection is a conduit like any other, with a rule.
Where it goes wrong
- A flat network, where the office printer and the crusher PLC can see each other.
- A DMZ in the diagram and a firewall rule that allows any to any through it.
- A modem in a panel, or a vendor tunnel, that nobody on site can see or close.
- Controller programs backed up once at commissioning, to a laptop that has since been replaced.
- OPC UA with security off, MQTT with anonymous access, Modbus reachable from the business network.
- Active vulnerability scanning run against the control network by an IT team that did not know what was on it.
- Patches applied to a SCADA server in production without the vendor's qualification, and the HMI that stopped afterwards.
- Shared accounts, so the recording of who did what records nothing.
Common questions
What is OT security?
The protection of operational technology, which is the hardware and software that monitors and controls physical plant: controllers, safety systems, drives, SCADA, historians and the networks between them. It differs from IT security in what is at stake, which is safety and production rather than data, and in what the systems can tolerate, which is less change and less interruption. NIST SP 800-82 is the reference guide, and the IEC 62443 series the standard.
What is IEC 62443?
A series of standards for the security of industrial automation and control systems, developed by ISA and published by the IEC. Its parts cover the owner's security program, the risk assessment that divides a system into zones and conduits, the technical requirements for a system at each of four security levels, and the requirements on the vendors who develop and supply components. It is the common reference across industries for how a plant's security is structured and specified.
What are zones and conduits?
A zone is a group of assets with the same security requirements, usually by function and by the consequence of their compromise: the safety system, the process control network, the supervisory systems, the site operations systems. A conduit is the communication path between two zones, with the devices, protocols and ports that may use it named and enforced by a firewall. IEC 62443-3-2 describes how to divide a system this way and assess the risk of each zone.
What is the Purdue model?
A reference model, formalised in ISA-95, that layers a plant's systems from the process at level 0, through basic control at level 1, supervisory control at level 2, site operations at level 3 and the business at level 4. OT security uses it as the starting shape for zones, with an industrial DMZ at level 3.5 as the only crossing between the plant and the business. It is a map, not a rule, and a real plant's zones follow its risk assessment.
Does the Essential Eight apply to OT?
Yes, with judgement. The eight controls from the Australian Signals Directorate were written for office systems, and each has to be read for what a plant can bear. Application control and restricting administrative privileges fit OT well, because the systems change rarely. Multi-factor authentication fits at the point of remote access. Patching and backups apply, with the timing set by maintenance windows and the vendor's qualification rather than by a monthly cycle. Where a control cannot be applied as written, a compensating control is recorded in its place.
How should vendor remote access to a plant be set up?
Through the same path as any other remote access: a jump host in the industrial DMZ, multi-factor authentication, a named person rather than a shared vendor account, a session opened for a time window by the site and closed afterwards, and a recording of what was done. Not a cellular modem on the panel, not the vendor's own tunnel, and not an always-on connection. The ASD's principles of OT cyber security treat the supply chain as a path into the plant for this reason.
Key terms
Plain-language definitions from our glossary for the concepts this article leans on.
Standards and further reading
- ISA/IEC 62443 series of standards (ISA)
- SP 800-82 Rev. 3, Guide to operational technology security (NIST)
- Principles of operational technology cyber security (Australian Signals Directorate)
- Essential Eight (Australian Signals Directorate)
- ISO 55001:2024 Asset management system requirements (ISO)
Related case studies and tools
- Bridging OT and IT with custom software (case study)
Related reading
Working through something like this?
See how we approach these initiatives, or tell us what you are dealing with.