Given the increasing integration of legacy operational technology (OT) with IoT solutions, implementing the "Zones and Conduits" architecture per the ISA/IEC 62443 standard is a critical step in preventing the spread of cyber threats to production assets. CTOs and IIoT architects face a significant challenge: securely connecting legacy equipment (programmable logic controllers, SCADA systems) to modern cloud or analytical platforms. Installing traditional security tools, such as antivirus software, on resource-constrained controllers is impossible, and any interference risks halting production processes.
Why classic IT security fails in OT environments: a conflict of priorities
In the field of information technology (IT), the primary priority is usually data confidentiality. In operational technology (OT), different rules apply. According to the NIST SP 800-82 Guide to OT Security, IT/OT segmentation is a fundamental control for industrial cybersecurity, as system availability is far more important in an OT environment than confidentiality. Any unplanned shutdown of a technological process due to a network failure can lead to large-scale consequences and physical damage to equipment.
This is why traditional IT security methods do not work in OT environments. Attempting to perform standard network scans with IT vulnerability assessment tools or blocking legacy protocol traffic can overload a controller's network stack and cause an emergency shutdown. Infrastructure protection must be built exclusively at the level of network architecture and data flow control, rather than by installing security software on endpoint devices.
The "Zones and Conduits" concept under IEC 62443: isolating legacy assets
The ISA/IEC 62443 series of standards, which covers more than 20 industries, provides a methodology for protecting automation and control systems. One of its fundamental tools is the division of the network into logical zones (Zones) and secure communication channels between them (Conduits).
- Zone — a logical or physical grouping of OT assets that share the same security requirements and criticality levels for business processes.
- Conduit — the only permitted path for data exchange between zones, where traffic is strictly controlled and normalized.
This approach limits the lateral movement of attackers. Even if a segment of the corporate network is compromised, direct access to PLCs on the production line remains blocked.
The role of OPC UA and edge computing in minimizing attack surfaces
Modern technological standards are used to securely transfer data from closed industrial zones to the cloud. According to the OPC Foundation, the OPC Unified Architecture (OPC UA) standard provides a platform-independent architecture for secure interoperability between industrial systems, SCADA, and business applications. However, it is important to note that implementing OPC UA does not automatically make a system secure; this protocol requires correct configuration of access policies and encryption.
According to AWS Well-Architected IoT Lens recommendations, the reliability of an IoT solution is established at the architectural design stage by properly distributing data processing between the device, the edge node, and the cloud. Instead of connecting devices directly to the global network, edge computing is implemented for initial telemetry filtering. This minimizes the number of entry points between IT and OT networks.
- Isolation of the SCADA segment from the corporate network using gateways that utilize OPC UA for data normalization.
- Implementation of edge computing for initial telemetry filtering before sending it to the cloud to reduce the attack surface on critical controllers.
- Application of access policies to legacy controllers via intermediate "conduits" that restrict communication protocols to only those necessary for operation.
Practical segmentation steps: from flow auditing to gateway configuration
Transitioning to a secure architecture requires a phased approach. The matrix below reflects the architectural transition based on IEC 62443 standards and industrial cybersecurity practices (e.g., CISA CPG):
| Purdue Model Level | Logical Zone | Conduit |
|---|---|---|
| Level 0-1 (Physical sensors, PLC) | Local isolated process zone | Complete prohibition of direct IT/Internet access. Access only via Edge gateway. |
| Level 2-3 (SCADA, HMI) | Operational management zone (OT) | Access to IT network exclusively via a demilitarized zone (DMZ) using OPC UA. |
| Level 4-5 (Enterprise ERP, Cloud IoT) | Corporate IT zone | Unidirectional data gateways (data diodes) or strict firewall rules with authentication. |
Softengi’s architectural approach to secure industrial IoT integration
Developing and designing secure IIoT architectures is a key expertise of Softengi (a member of the Intecracy Group, an alliance of independent companies linked by partner agreements and share exchanges — not a single company, not a holding). The team provides custom development of IoT/embedded solutions and integration of SCADA systems with the corporate perimeter, applying edge computing to normalize industrial data without compromising the integrity of OT processes.
For real-time event processing at the "edge" of the network, the AZIOT Platform is used — a platform for industrial and cyber-physical IoT. It is responsible for reliable telemetry collection via MQTT and Modbus protocols directly at the edge level, acting as a buffer between physical sensors and the IT environment.
To integrate cleaned data into corporate systems, the UnityBase platform is used (a joint development of Intecracy Group companies, where InBase is a key developer). UnityBase is a full-stack JavaScript low-code platform for creating enterprise applications. It provides necessary security mechanisms: role-based access control (RBAC), row-level security (RLS), detailed audit trails, and generated REST API. This set of platform tools allows data exchange between the OT zone and business applications without creating direct risks for critical production infrastructure.
FAQ
How to start industrial network segmentation per IEC 62443 without stopping production?
The process begins with a passive network audit to identify all assets and map information flows. Then, equipment is logically grouped into zones (e.g., using VLANs) in monitoring mode. Only after confirming no impact on OT processes are traffic-blocking rules on firewalls (Conduits) gradually activated.
Why is OPC UA considered more secure than Modbus or Profinet for IT integration?
Unlike legacy protocols (Modbus, Profinet), which were developed without cybersecurity requirements and transmit data in plain text, the OPC UA standard provides a platform-independent architecture for secure interoperability. It supports encryption, certificate-based authentication, and access control, which are critical when transferring data between industrial zones and the IT network.
What minimum CISA CPG requirements must be implemented to protect critical infrastructure in IoT?
Basic protection practices include complete logical or physical separation of the corporate IT network from the OT management network, prohibiting direct Internet access to industrial controllers, mandatory multi-factor authentication for remote access, and regular backups of control system configurations.