IEC 62443 asks you to divide a control system into zones and conduits before deciding which security measures it needs. This structure is described in IEC 62443-3-2, the standard for security risk assessment and system design.
Zones
A zone is a group of assets that share the same security requirements. Typical examples are a substation's protection and control equipment, a plant's DCS, or a group of engineering workstations. Assets end up in the same zone because they have similar criticality, similar exposure and the same owner.
Conduits
A conduit is a group of communication channels that connect zones and share the same security requirements. A firewalled link between the control zone and the supervisory zone is a conduit; so is a remote-access path for a vendor. Conduits are where most protection is applied: filtering, authentication, encryption and monitoring.
Security levels
Each zone and conduit is given a target security level (SL-T) from 1 to 4, describing the strength of attacker it must resist:
- SL 1: casual or accidental violation
- SL 2: intentional violation using simple means
- SL 3: sophisticated means with moderate resources and system-specific skills
- SL 4: sophisticated means with extended resources
The achieved security level (SL-A) is what the built system actually provides, and the capability security level (SL-C) is what the products can provide when properly configured. Design work closes the gap between SL-T and SL-A using the requirements in IEC 62443-3-3.
Common pitfalls
- Zones drawn around the network diagram instead of around risk and function.
- Conduits that are missing from the drawings, especially remote access, USB and maintenance laptops.
- Target security levels chosen once and never tied back to the risk assessment.
- No record of why each zone and conduit has its level, which makes later audits harder.
A clear zone and conduit model, with documented reasoning, makes every later step easier: design, testing, audits and changes over the plant's life.