Chapter 12 — Segmentation and firewall rules
Lesson map
Lesson 12 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["12.1 Zones and conduits"]
N2["12.2 The DMZ"]
N3["12.3 Reading rules"]
N4["12.4 Weak rules"]
N5["12.5 Do not edit on your own"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["12.1 Zones and conduits"]
N2["12.2 The DMZ"]
N3["12.3 Reading rules"]
N4["12.4 Weak rules"]
N5["12.5 Do not edit on your own"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX045"]
[Learning outcomes]
|
v
[12.1 Zones and conduits]
|
v
[12.2 The DMZ]
|
v
[12.3 Reading rules]
|
v
[12.4 Weak rules]
|
v
[12.5 Do not edit on your own]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) explain zones and conduits from IEC 62443 in plain words; (2) read a firewall rule table; and (3) spot rules that weaken segmentation.
12.1 Zones and conduits
IEC 62443 groups assets with similar security needs into zones and calls the controlled connections between them conduits. At HPFL: the line zone (PLCs, HMI, camera), a DMZ (historian copy, remote access gateway, file transfer server) and the office zone. Traffic only crosses through conduits that are firewalled and documented.
Write each conduit with its purpose, the traffic it allows and its owner. At HPFL the conduits are the line pushing to the DMZ historian, ENG-LT reaching the PLCs, and vendor access through the gateway in the DMZ. Anything else crossing a zone boundary is a finding.
12.2 The DMZ
Office users want production data; the line must not accept office connections. So the line pushes data to a server in the DMZ and the office reads it there. No connection then needs to go straight from office to line.
At HPFL the line pushes data to the historian copy in the DMZ, and office users read it there. Vendor access and file transfer also land in the DMZ. That way FW-1 needs no rule allowing office machines straight into the line, which is exactly the kind of rule the worked example below removes.
12.3 Reading rules
Each rule has source, destination, port and action, read top to bottom; the first match wins. A last "deny everything" rule makes anything not listed blocked.
Reading top to bottom matters because a broad allow rule placed above a narrow deny makes the deny useless. When reviewing a table, ask for each rule: who owns it, why it exists, and whether a rule above it already decides the same traffic. FW-1's table at HPFL has four rules, which makes this easy to practise.
12.4 Weak rules
Look for "any" sources, broad port ranges, rules with no comment or owner, and temporary rules that were never removed. Each one should be questioned and either justified or removed through change control.
At HPFL rule 3, office any to line any marked temp 2025, showed all of these warning signs at once. It was removed through change control and tested at the next stop. Record each question raised and its answer, so that a removed rule is not later re-added without review.
12.5 Do not edit on your own
Firewall changes are made by the network owner with a change ticket and a rollback plan; a wrong rule can stop the line.
If you find a weak rule, report it with the rule number and your reason. The network owner decides how to change it, prepares a rollback and tests at a planned stop. Your role is to notice and explain the risk. At HPFL the network owner removed rule 3 only after raising a change and agreeing a test at the next stop. A rule changed by someone else, however well meant, leaves no record and no rollback, and could stop the line.
Worked example (synthetic HPFL)
Tomás reviews FW-1's table with the network owner. Rule 1 allows ENG-LT to the PLCs' programming port; rule 2 lets the line push to the DMZ historian; rule 3, "office any → line any allow — temp 2025", has no owner. Rule 4 denies all. They raise a change to delete rule 3, test at the next stop, and the line runs normally afterwards.
Synthetic case — HPFL. The rule table is invented.
Errors and limits
A good rule table can be undone by an unmanaged switch or modem bypassing the firewall; walk-downs and diagrams complement rule review.
Exercises
- EX045 — Zones at HPFL. Name the three HPFL zones and one asset in each. Rubric: 3 = line/DMZ/office with correct assets; 2 = two; 1 = one; 0 = none.
- EX046 — First match. With rule 3 above rule 4, what happens to office traffic to HMI-1? Rubric: 3 = allowed by rule 3 before deny applies; 2 = allowed; 1 = denied; 0 = none.
- EX047 — Why a DMZ. Explain how the DMZ lets office staff see production data without connecting to the line. Rubric: 3 = line pushes to DMZ server, office reads there, no office→line rule; 2 = partial; 1 = "it's safer"; 0 = none.
- EX048 — Removing a rule. Outline the safe steps to remove rule 3. Rubric: 3 = change ticket, owner confirms, planned window, rollback, test, record; 2 = some; 1 = delete now; 0 = none.
Synthesis
Zones are separated by documented, owned conduits; broad or ownerless rules are removed through change control.
Continue studying — chapter 12 of 18
← Chapter 11 (draft) · Course chapter index · Chapter 13 (draft) →