Chapter 8 — Security architecture basics
Lesson map
Lesson 08 published. Map, example, EX022.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Zones for NCS"]
N2["8.2 Conduits"]
N3["8.3 Why a DMZ"]
N4["8.4 Defence in depth"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX022"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Zones for NCS"]
N2["8.2 Conduits"]
N3["8.3 Why a DMZ"]
N4["8.4 Defence in depth"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX022"]
[Learning outcomes]
|
v
[8.1 Zones for NCS]
|
v
[8.2 Conduits]
|
v
[8.3 Why a DMZ]
|
v
[8.4 Defence in depth]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX022]
Learning outcomes
You will (1) divide a small facility into zones; (2) define conduits between zones with allowed traffic; (3) place a DMZ for shared services; and (4) explain defence in depth with concrete layers.
8.1 Zones for NCS
IEC 62443-3-2 introduces zones (groups of assets with common security requirements) and conduits (the communication paths between them). NCS needs at least four zones: office, refrigeration control (PLC-R1, PLC-R2, HMI-C), logging and cameras (loggers, GW-LOG, CAM-DOCK), and a small DMZ holding the historian replica and the remote-access jump host.
Priya's zone diagram showed rule 9 crossing office → control directly; because no listed conduit allowed it, the architecture document itself gave the reason to remove it.
The diagram also made the DMZ's purpose concrete: it is where office users read data without entering the control zone.
8.2 Conduits
Each conduit lists what may cross it. Office → DMZ: HTTPS to the historian replica's reports. DMZ → control: none initiated from the DMZ except the jump host's session to HMI-C when enabled. Control → DMZ: historian replication. Logging zone → internet: GW-LOG to vendor cloud on 443 only. Everything else is denied.
Priya's conduit table has five columns: source zone, destination zone, protocol, initiator and purpose. The initiator column matters most: replication from control to DMZ is initiated by the control side, so the DMZ never needs a rule allowing it to open sessions inward.
8.3 Why a DMZ
Without a DMZ, office users who need temperature reports connect straight into the control zone. With it, they reach a copy, and the control zone accepts no sessions from the office at all. That single change removes the path that most commodity ransomware uses to reach HMIs.
At NCS the reports users want are temperature certificates and compressor run hours. OFFICE-7's energy macro read run hours directly from PLC-R2 over rule 9; Priya's fix had it read the same values from the historian replica in the DMZ, and only then was office → control blocked.
8.4 Defence in depth
Layers at NCS: zone firewalls; named accounts; allow-listing on HMI-C; passive monitoring of the control zone; offline backups; and, outside the security team's control, independent ammonia detection and emergency ventilation. Each layer assumes the one before it can fail.
Priya's evaluation in Chapter 23 shows the assumption at work: five of six controls passed, but the camera-zone rule allowed CAM-DOCK to reach HIST on a web port. The other layers, named accounts, allow-listing on HMI-C and passive monitoring, were still in place while the rule was narrowed.
Worked example (synthetic NCS)
Priya draws the zone diagram and lists conduits in a table with source zone, destination zone, protocol, initiator and purpose. Comparing it with the current firewall, she finds the commissioning rule from Chapter 2 crossing office → control directly. The architecture document gives the reason to remove it: it is not a listed conduit.
Synthetic case — Northgate Cold Storage. The zones are a teaching design.
Errors and limits
Zones on paper mean nothing until enforced in switches and firewalls. Cameras often get forgotten; they are network devices with their own vulnerabilities and belong in a zone too.
Exercises
- EX022 — Placing CAM-DOCK. Which NCS zone should the dock cameras join and why not the control zone? Rubric: 3 = logging/camera zone (or own zone); unrelated to control and frequently vulnerable; 2 = zone only; 1 = control zone; 0 = none.
- EX023 — A conduit table row. Write the row for historian replication. Rubric: 3 = control → DMZ, protocol/port, initiator control side, purpose; 2 = three fields; 1 = vague; 0 = none.
- EX024 — Layers that assume failure. Name two NCS layers and say which failure each covers. Rubric: 3 = two layers with specific failure covered; 2 = layers only; 1 = one; 0 = none.
Synthesis
Zones, conduits and a DMZ convert "segment the network" into a checkable design, and defence in depth makes each layer's failure survivable.
Continue studying — chapter 08 of 30
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →