Zones and Conduits

Zones and conduits are the IEC 62443 approach to network architecture, grouping assets with common security requirements into zones and controlling all communication between zones through defined conduits with target security levels.

Zones and conduits are the IEC 62443 method for structuring an industrial control system into security domains. A zone is a grouping of logical or physical assets that share common security requirements, for example the controllers and HMIs of one production line or a safety system. A conduit is a logical grouping of the communication channels that connect zones, such as the link between a control zone and a site operations zone, together with the devices that protect it.

Each zone and conduit receives a target security level based on risk, and countermeasures are chosen to meet it: firewalls and data diodes on conduits, and hardening, access control and monitoring within zones. The model lets asset owners concentrate protection where consequences are highest, contain the spread of malware between areas and give integrators and suppliers clear security requirements. Zones often align with Purdue levels, process areas or safety boundaries.

IEC 62443-3-2 describes how to partition a system into zones and conduits as part of the security risk assessment, including keeping safety-related assets, wireless devices, temporarily connected devices and systems reached through external networks in separate zones. Good practice documents every conduit with its permitted protocols and data flows and denies all other traffic by default. The model only works if it is maintained as systems change and if undocumented connections, such as forgotten modems or dual-homed computers, are found and removed.

Key points

A zone groups assets that share common security requirements
A conduit groups the communication channels that connect zones
Each zone and conduit is assigned a target security level based on risk
IEC 62443-3-2 recommends separating safety, wireless and externally connected assets

Where AiVibe comes in

In AiVibe's AiAmbA AI Factory, the AiAmbA IoT edge layer keeps writes to machines deny-by-default and AI agents only propose changes that a trained operator confirms. AiVibe's security services include vulnerability assessment and penetration testing, and AiVibe is ISO/IEC 27001:2022 certified.

Explore AiVibe’s work in OT & Industrial Cybersecurity →

Zones and Conduits

Key points

Where AiVibe comes in

Related terms

Terms that refer to Zones and Conduits