OT Security Architecture, Zones & Conduits Design
Threat detection and prevention rate
Our approach applies the IEC 62443-3-2 zones-and-conduits model literally — not as a diagram in a report, but as enforced security zones with defined Security Levels (SL-T), documented conduit rulebases, and a Cybersecurity Requirements Specification (CRS) the integrator can build to.
We work greenfield (new plants, new AI data halls) and brownfield (legacy refineries, utilities, pharma lines, fabs). In brownfield environments we design around availability constraints, safety instrumented systems, and the engineering reality that you cannot take down a cracker unit to re-subnet it.
Vendor-neutral, by design. We do not resell firewalls, visibility platforms, or remote-access tools. We specify what the site needs against IEC 62443 SL targets and document the trade-offs — procurement retains full commercial freedom.
Architecture & Zoning
- Purdue Model Level 0–5 architecture design and re-architecture
- IEC 62443-3-2 zones-and-conduits definition, with Target Security Levels (SL-T) per zone
- Cybersecurity Requirements Specification (CRS) suitable for EPC or systems-integrator tender
- IT/OT convergence architecture and Industrial DMZ (iDMZ) design
- Safety-cyber interface: separation and interaction of SIS (IEC 61511) and BPCS under cyber events
Segmentation & Conduit Control
- Network segmentation strategy for brownfield sites — staged, availability-safe migration paths
- Firewall rulebase design, policy hardening, and conduit documentation
- Micro-segmentation design for high-consequence cells (SIS, turbine control, GPU fabric)
- East–west traffic control between production cells, utilities, and shared services
- Data diode and unidirectional gateway specification where one-way flow is mandated (regulated, safety-critical)
Asset Visibility as a Design Input
- Passive asset discovery and network baselining (vendor-neutral — typically Claroty, Nozomi, Dragos, Tenable OT, Armis; selection driven by environment, not partnership)
- Flow mapping and conduit validation against the as-designed architecture
- Shadow-OT identification and integration into the zone model
Secure Remote & Third-Party Access
- Remote access architecture: jump-server, broker, and zero-trust patterns for OEMs and maintenance vendors
- Privileged session recording and just-in-time access design
- Third-party risk boundary — contractual and technical, not just contractual
Outcome
Our approach applies the IEC 62443-3-2 zones-and-conduits model literally — not as a diagram in a report, but as enforced security zones with defined Security Levels (SL-T), documented conduit rulebases, and a Cybersecurity Requirements Specification (CRS) the integrator can build to.