Cybersecurity and Safety in Smart Manufacturing
This domain tests defense-in-depth for OT, IEC 62443 zoning, risk-based patching, remote-access control, and the distinction between functional safety and cybersecurity.
Core rules
- IEC 62443 uses zones (assets with common security requirements) and conduits (controlled communication paths). Security levels describe resistance to defined threats.
- OT priorities are commonly safety, availability, integrity, then confidentiality. A security control that stops production or blocks a safety function is unacceptable without compensating design.
- Patch OT on a risk-based schedule with testing and rollback. When patching is impossible, compensate with segmentation, allowlisting, monitoring, or virtual patching.
- Safety instrumented systems (SIS) are independent of basic process control. SIL or performance level comes from risk assessment, not from a firewall or antivirus product.
- Remote vendor access goes through a jump host with MFA, least privilege, session logging, and time-limited approval.
Worked example
A legacy CNC is on a flat plant network. Create a “Cell 1” zone and a conduit to the DMZ. Allow only OPC UA from the cell to the DMZ; block SMB and direct internet access. Keep the SIS on its own zone and conduit. Give the vendor remote access through a jump host with MFA and session recording, not a direct VPN into the cell. The reasoning: zoning limits lateral movement, the conduit enforces least privilege, and SIS independence preserves safety even if the business network is compromised.
Traps
Applying IT patch deadlines to controllers without testing; treating an air gap as complete protection; sharing administrator accounts; placing SIS on the business network; and confusing SIL with a cybersecurity rating.
Key points
- IEC 62443 zones and conduits limit blast radius.
- OT security must preserve safety and availability.
- Patch by risk, with tested rollback and compensating controls.
- SIS independence is a safety requirement.
- Remote access needs MFA, least privilege, and logging.