Explainer | 5 min read
Zones and conduits in OT network segmentation
A security zone groups assets with shared security requirements; a conduit groups communication channels between zones. Use both to define required OT connectivity and the evidence needed before changing a PLC or SCADA network.
Worked example: an existing PLC and SCADA network
A production area shares an OT network with engineering workstations and vendor support. Start with asset roles, operating dependencies and observed communication evidence. Record uncertain flows rather than assuming that every existing connection is required.
A proposed model might distinguish production control, engineering support and external support connections, subject to risk assessment. For each proposed conduit, record source and destination roles, service, purpose, owner and the proposed control. A VLAN label alone does not establish a security boundary.
Inputs, outputs and brownfield limitations
Useful evidence
- Inputs: system boundary, asset records, current drawings, required flows, support arrangements and operational constraints.
- Outputs: a zone/conduit model, communication register, assumptions, design decisions and staged verification actions.
- Common mistakes: grouping only by physical location, assuming all assets need the same security level, or treating firewall installation as proof of effective segregation.
- FAT can review proposed rules and representative flows. SAT needs to address installed interfaces and site conditions; agree safe checks, rollback and outage constraints before changes.
- Segmentation alone does not make a system secure. Account management, maintenance, monitoring and recovery remain relevant to the agreed risk treatment.
What a zone represents
A security zone groups assets with similar security requirements, operational function or trust level. In an industrial environment, zones should reflect how systems are engineered and operated, not just how they appear on a network diagram.
Typical discussions include PLC and safety systems, SCADA servers, engineering workstations, historians, vendor support routes and site-to-business interfaces.
What a conduit represents
A conduit is the controlled communication path between zones. It should describe what needs to communicate, why it communicates, who owns it and what control or monitoring evidence exists.
For brownfield sites, the first useful outcome is often a clearer map of existing conduits before any firewall changes are proposed.
Related support and guidance
Where this connects to project work
If the issue described here forms part of a wider assessment or engineering programme, Meridian's network segmentation engineering covers the scope, evidence and technical decisions needed for a defined engagement.