Industrial IoT Security at Scale: IEC 62443 Zones, Conduits, and the IACS Architecture

IEC 62443 is the international standard series for Industrial Automation and Control System (IACS) security. Part 3-3 specifies system-level security requirements, defining four Security Levels based on the sophistication of the adversary assumed. The zone-and-conduit model partitions the IACS into security zones with defined Security Level Targets, connected by conduits whose security controls are sized to bridge the difference. The OPC-UA security architecture — used extensively for industrial data aggregation across heterogeneous equipment — adds a layer of session-based authentication and encryption that the underlying fieldbus protocols lack. What 'defence in depth' means in this context is not deploying a firewall at the IT/OT boundary. It is implementing security controls at every zone boundary so that compromise of one zone does not provide access to adjacent zones.

Facing This?