OT security: why isolation is no longer enough, and how to segment with IEC 62443
Connecting machines to enterprise IT creates value and exposure. IEC 62443 provides a method: zones, conduits, security levels, controlled remote access.
For a long time, industrial (OT) security relied on isolation: a shop-floor network not connected to the rest. Remote supervision, predictive maintenance and performance analysis changed that: data has to leave the shop floor, and providers access it remotely. The model moves from isolation to segmentation, visibility and access control (SRQL, IIoT World).
Why OT is an attractive target
Halting production forces payment faster than encrypting office files: attackers have understood this, and ransomware now targets production lines. Yet industrial equipment has lifecycles of several decades, old operating systems, and doesn't always tolerate frequent patching. Office-IT rules can't simply be applied to the shop floor.
The IEC 62443 method in five ideas
- Inventory: you can't protect what you don't know. Machines, controllers, gateways, versions, connections.
- Divide into zones: group equipment of the same criticality and security needs (a production line, a supervision system, the "enterprise" zone).
- Control the conduits: flows between zones are limited to what is necessary, filtered and logged. This is what reference models (including the Purdue model) call separation between IT, a demilitarized zone and OT.
- Size by security level: the standard defines four levels, SL1 to SL4. Not everything needs the highest; effort is proportioned to each zone's risk.
- Govern remote access and suppliers: named accounts, multi-factor authentication, time-limited access, traceability of interventions.
The link with regulation
The NIS2 directive extends cybersecurity obligations to many industrial players and requires supply-chain risk management. Sector guides present IEC 62443 as a coherent technical framework to meet it on the OT side. An equipment manufacturer or integrator may also be asked by clients for evidence of control: segmentation, patch management, incident response procedure.
A realistic trajectory
- Map existing assets and flows, without changing anything.
- Close the most obvious risks: uncontrolled permanent remote access, default passwords, equipment exposed to the internet.
- Segment in stages, starting by separating OT from enterprise IT, then critical lines from each other.
- Monitor traffic to detect unusual behavior, without disturbing controllers.
- Prepare the response: backups of controller configurations, a manual fallback procedure, a recovery exercise.
What holds for all connected objects
The same logic applies to the sensors, gateways and devices we design: unique credentials, encrypted communications, signed updates and a minimal exposure surface (see the CRA and the RED directive, and predictive maintenance). For a specific project, describe your context to us.
Sources
Have an IoT project in mind?
Describe your context, we'll propose a tailored solution.