Security design review for capital projects
We review the plans for a new production line, site, or control system from a security standpoint before construction starts, while changes are still cheap.
Security by design
Why at the design stage
When security requirements are part of the design, the network and the equipment are built to meet them from the start.
Much of it can't be fixed afterwards
Once a network is built or a machine is delivered, changing it means rebuilding it.
It runs for many years
OT devices stay in service many times longer than office computers. What goes into the design now shapes the plant's security for years.
Updating it later is hard
A PLC firmware update needs planned downtime. Vendor support can run out, and an update can also void the system's certification.
Review criteria
What we look at in the design
We break the design down into zones and the conduits that run between them. That shows where the boundaries of the new system will be and what is allowed to cross them.
-
The IT/OT boundary
What we look for
Whether there is an industrial DMZ between the corporate network and the new system, or the design allows a direct connection between the office and the plant.
Why it matters
This is the most important zone boundary. Data is exchanged through intermediate systems in the DMZ, such as a replicated historian, a jump server, and a file transfer server.
-
Zones
What we look for
How the design groups the devices, whether the production lines are separated from each other, and whether the safety systems (SIS) get a zone of their own.
Why it matters
If one line is compromised, the attack should not spread to the next. The SIS gets the strictest controls.
-
Conduits between zones
What we look for
Whether each connection between zones records what traffic may cross it, in which direction, and which control protects it.
Why it matters
Anything not explicitly allowed on a conduit is denied. Without documented communication, the firewall rules end up either too strict, causing downtime, or too loose to protect anything.
-
Supplier remote maintenance
What we look for
How the machine builder or the maintenance contractor will reach the equipment after commissioning.
Why it matters
Supplier maintenance channels are the most common entry points. A supplier connecting straight to the equipment over its own VPN is an unchecked door into the network, so it needs a separate, tightly controlled path.
-
Security capabilities of the equipment
What we look for
Whether the devices you plan to buy can reach the Security Level their zone requires.
Why it matters
The target level set for the zone (SL-T) and the capability of the product (SL-C) can differ, so the required level has to be demanded from the supplier.
Deliverables
What you get at the end
items handed over
- Security assessment of the design documentation
- Deviations and recommended fixes
- Security requirements for suppliers
Related services
From design to working protection
The review improves the design. Mapping the existing environment and implementing the design are separate services.
OT security assessment
Asset inventory and communication map of the existing OT environment, including undocumented external connections.
OT network segmentation
A zone model with a target state and firewall rules between the zones, rolled out on a schedule.
Secure remote maintenance access
A single access point where every connection needs approval and is logged, with personal, time-limited supplier access.
Frequently asked questions
The questions we hear most
Which standard does the review follow?
IEC 62443, the international family of standards for the security of industrial automation and control systems. We review the design against its zone and conduit model and its Security Levels. The plant engineer, IT, and the equipment supplier all understand the standard's terms, so the deviations and requirements are clear to everyone. Part 4 of the series sets out requirements for products, and the supplier requirements can refer to it. We covered the basics in our article on IEC 62443.
When should supplier requirements go into procurement?
Ideally they go into the procurement documents before you reach an agreement with the supplier. It is also worth clarifying up front whether the supplier accepts later updates and the installation of OT-specific protection tools on its equipment, because these can raise warranty questions. Many vendors now support such tools.
Does it require an assessment of the existing plant?
The review works from the design documentation and does not touch running systems. If the new system connects to an existing OT network, judging the connection point means knowing what talks to what on that network, because the communication matrix is a prerequisite for the zone design. If you don't have one, the OT security assessment fills the gap.
