Zones, conduits and a one-way wire: separating a utility's control network from the corporate network
A regional electric and gas utility with 140 substations and two control centers, a leader in its segment.
- Scale
- 140 substations, 2 control centers, ~600,000 meters, 1 Gb/s unidirectional gateway, 4 security zones
- Engagement
- Assessment, design and phased substation rollout over 18 months
The challenge
The control network had grown by exception. Engineering workstations, vendor laptops and the corporate network all reached the SCADA servers through a handful of firewall rules nobody could fully explain, and the operations team needed live data in the business systems without opening a door back into the control room. The utility needed to know what was on the network, what it talked to, and to be sure that ransomware on the corporate side could not travel into operations.
Utility control networks were built to last decades, and they were connected to the business a little at a time. At this regional electric and gas utility, vendor laptops, engineering workstations and the corporate network reached the SCADA servers through a few firewall rules that no one could fully explain. Operations needed live data in the business systems, and security needed to be sure that ransomware on the office side could never reach the control room.
We started by listening. Passive taps and SPAN ports built an inventory of every device and conversation without scanning anything fragile, and we mapped it to the Purdue model. From that we drew zones and conduits in the style of IEC 62443-3-2: control center, substation, distributed energy and metering, and a DMZ. Each zone got a target security level and a short list of permitted protocols, such as DNP3, IEC 60870-5-104, IEC 61850 MMS and Modbus/TCP.
Inside substations we kept IEC 61850 GOOSE and sampled values on layer-2 VLANs with 802.1Q priority, made redundant with PRP and HSR from IEC 62439-3, so a cable failure costs no data. These flows never leave the substation zone. What leaves is a summary: telemetry, alarms and logs, sent through a unidirectional gateway.
The gateway is a hardware data diode. On the control side the fiber carries transmit only, so no packet can come back, whatever software runs on either side. Protocol proxies on each end replicate historian data, alarms and syslog into the DMZ, and the business reads from the DMZ. Because nothing flows in, updates and vendor files arrive through a scanned transfer station, and remote access goes through a hardened jump host with multi-factor authentication, time-limited accounts and session recording.
Industrial firewalls inspect DNP3 and Modbus function codes, so a write from a host that should only read is dropped and logged. Passive OT monitoring feeds the security team, and PTP with the power profile keeps timing honest. We finished with a tabletop exercise for a ransomware scenario and wrote a runbook for isolating a substation by pulling one conduit. We rolled out substation by substation over 18 months, with nothing touching a live protection scheme without the operations team present.
What our team delivered
- An asset and flow inventory built passively from network taps and SPAN ports, so nothing was scanned in a way that could upset a relay or a PLC, then mapped to the Purdue model from Level 0 field devices to Level 5 enterprise
- Zones and conduits defined per IEC 62443-3-2: control center, substation, DER and metering, and DMZ, each with a target security level and a short list of permitted protocols such as DNP3, IEC 60870-5-104, IEC 61850 MMS and Modbus/TCP
- IEC 61850 GOOSE and sampled values kept inside the substation zone on layer-2 VLANs with IEEE 802.1Q priority, redundant by PRP and HSR (IEC 62439-3) so a cable failure costs zero milliseconds of data
- A unidirectional gateway (hardware data diode) between the control zone and the Level 3.5 DMZ: optical transmit only on the control side, with protocol proxies that replicate historian data, alarms and syslog outward and cannot carry a single packet back
- Remote access by exception through a hardened jump host in the DMZ with multi-factor authentication, time-limited vendor accounts, and session recording; updates and files arrive inbound through a scanned transfer station, never directly
- Firewalls and industrial switches with deep inspection of DNP3 and Modbus function codes, so a write command from a host that should only read is dropped and logged
- Passive OT monitoring feeding the security team, with PTP (IEEE C37.238 power profile) timing, a tabletop exercise for a ransomware scenario, and a runbook for isolating a substation by pulling one conduit
Result
There is now no network path from the corporate network into the control zone, and the only path out is one that physically cannot carry traffic back. Operations keep live telemetry in the business systems, the utility has an inventory it can defend, and the isolation drill takes a few minutes.
Purdue levels, zones and conduits
Industrial networks are split into Purdue levels, grouped into IEC 62443 zones, and joined only by controlled conduits. Plant data climbs one way through a data diode into an industrial DMZ; nothing in the enterprise zone has a direct route down to operations or the controllers.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Defense in depth, on a loop
Every device on your network sits behind a monitored firewall with two internet circuits, so attacks are stopped at the door and a provider outage does not stop the business.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.