Designs IEC 62443-3-2 security zones and conduits for IACS/OT networks via risk-based zoning, SL-T assignment, industrial firewalls for microsegmentation, and Purdue model verification with traffic analysis and pentesting.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 为新工业设施设计全新OT网络架构
Implements IEC 62443-3-2 security zones and conduits for IACS: zone partitioning by risk assessment, SL-T assignment, microsegmentation with industrial firewalls, Purdue Model validation.
Designs IEC 62443-3-2 security zones/conduits for IACS/OT networks via risk partitioning, SL-T targets, firewall microsegmentation, and Purdue model validation.
Implements network segmentation in OT environments using VLANs, industrial firewalls, data diodes, SDN based on Purdue model. Covers zero-downtime migration from flat networks, DPI firewall config for industrial protocols, and traffic analysis verification.
Share bugs, ideas, or general feedback.
不适用于纯IT网络分段（参见implementing-network-microsegmentation）、云原生工作负载分段（参见securing-kubernetes-on-cloud），或没有网络安全组件的物理安全区域设计。
根据功能要求、安全要求、关键性和攻陷后果将IACS划分为区域。每个区域包含具有共同安全要求的资产。
# IEC 62443-3-2 区域定义文档
facility: "石化炼厂 - 3号装置"
assessment_date: "2026-02-23"
standard: "IEC 62443-3-2:2020"
zones:
- zone_id: "Z1-SIS"
name: "安全仪表系统"
purdue_level: 1
security_level_target: "SL 3"
criticality: "安全关键"
assets:
- "Triconex 3008安全控制器 (SIS-01)"
- "Triconex 3008安全控制器 (SIS-02)"
- "SIS工程师工作站"
security_requirements:
- "与所有其他区域物理隔离（气隙）"
- "专用工程师工作站，配有可移动介质控制"
- "任何情况下不允许远程访问"
- "变更管理需要双重授权"
allowed_conduits: [] # 无网络管道 - 完全气隙隔离
- zone_id: "Z2-BPCS"
name: "基本过程控制系统"
purdue_level: "1-2"
security_level_target: "SL 2"
criticality: "高"
assets:
- "Allen-Bradley ControlLogix PLC（PLC-01至PLC-12）"
- "Rockwell FactoryTalk View HMI（HMI-01至HMI-06）"
- "工程师工作站 (EWS-01)"
security_requirements:
- "区域边界配置带协议检测的工业防火墙"
- "来自3级的只读数据采集访问"
- "写入访问限制于工程师工作站子网"
- "HMI的USB端口已禁用"
allowed_conduits: ["C1-BPCS-OPS"]
- zone_id: "Z3-OPS"
name: "站点运营"
purdue_level: 3
security_level_target: "SL 2"
criticality: "中"
assets:
- "OSIsoft PI历史数据库 (HIST-01)"
- "OPC UA服务器 (OPC-01)"
- "MES应用服务器 (MES-01)"
- "报警管理服务器 (ALM-01)"
security_requirements:
- "运营区与控制区之间设防火墙"
- "运营区与DMZ之间设防火墙"
- "无直接互联网访问"
- "使用OT批准签名的防病毒软件"
allowed_conduits: ["C1-BPCS-OPS", "C2-OPS-DMZ"]
- zone_id: "Z4-DMZ"
name: "工业非军事化区"
purdue_level: 3.5
security_level_target: "SL 2"
criticality: "中"
assets:
- "PI-to-PI接口 (DMZ-HIST-01)"
- "补丁管理服务器 (DMZ-WSUS-01)"
- "远程访问跳板服务器 (DMZ-JUMP-01)"
- "数据二极管 - Waterfall Security (DMZ-DD-01)"
security_requirements:
- "两侧均配置双宿主防火墙"
- "无直接流量穿越 - 所有连接终止于DMZ"
- "用于单向历史数据库复制的数据二极管"
- "带MFA的跳板服务器用于远程访问"
allowed_conduits: ["C2-OPS-DMZ", "C3-DMZ-ENT"]
- zone_id: "Z5-ENT"
name: "企业网络"
purdue_level: 4
security_level_target: "SL 1"
criticality: "低（从OT角度）"
assets:
- "访问OT数据的企业系统"
security_requirements:
- "企业与DMZ之间设防火墙"
- "不允许直接访问DMZ以下的任何OT区域"
allowed_conduits: ["C3-DMZ-ENT"]
conduits:
- conduit_id: "C1-BPCS-OPS"
name: "控制到运营管道"
connects: ["Z2-BPCS", "Z3-OPS"]
security_level: "SL 2"
protocols_allowed:
- protocol: "OPC UA"
port: 4840
direction: "Z2 -> Z3（只读）"
security_mode: "SignAndEncrypt"
- protocol: "Modbus/TCP"
port: 502
direction: "Z3 -> Z2（只读，仅FC 3/4）"
security_mode: "防火墙强制功能码过滤"
controls:
- "带OT协议DPI的工业防火墙"
- "源/目标IP对白名单"
- "功能码过滤（阻止来自L3的所有写入操作）"
- "连接速率限制"
- conduit_id: "C2-OPS-DMZ"
name: "运营到DMZ管道"
connects: ["Z3-OPS", "Z4-DMZ"]
security_level: "SL 2"
protocols_allowed:
- protocol: "PI-to-PI"
port: 5450
direction: "Z3 -> Z4（通过数据二极管单向传输）"
- protocol: "HTTPS"
port: 443
direction: "Z4 -> Z3（仅补丁下载）"
controls:
- "用于历史数据库复制的数据二极管（Waterfall Security）"
- "带应用层检测的防火墙"
- "补丁服务器仅从批准的厂商存储库拉取"
- conduit_id: "C3-DMZ-ENT"
name: "DMZ到企业管道"
connects: ["Z4-DMZ", "Z5-ENT"]
security_level: "SL 1"
protocols_allowed:
- protocol: "HTTPS"
port: 443
direction: "Z5 -> Z4（历史数据库读取、远程访问门户）"
- protocol: "RDP"
port: 3389
direction: "Z5 -> Z4（带MFA的跳板服务器）"
controls:
- "带SSL检测的下一代防火墙"
- "所有远程访问会话需要MFA"
- "跳板服务器上的会话录制"
在每个区域边界部署和配置带OT协议感知深度包检测的工业级防火墙。
# Cisco ISA-3000工业防火墙配置
# 管道C1：BPCS（区域2）<-> 运营（区域3）
# 定义区域接口
interface GigabitEthernet1/1
nameif zone-bpcs
security-level 90
ip address 10.20.1.1 255.255.0.0
interface GigabitEthernet1/2
nameif zone-ops
security-level 70
ip address 10.30.1.1 255.255.0.0
# 从BPCS到运营的OPC UA（只读数据流）
access-list BPCS-to-OPS extended permit tcp 10.20.0.0 255.255.0.0 host 10.30.1.50 eq 4840
# 从运营历史服务器到PLC的Modbus读取（仅FC 3,4）
access-list OPS-to-BPCS extended permit tcp host 10.30.1.50 10.20.0.0 255.255.0.0 eq 502
# 拒绝区域间的所有其他流量
access-list BPCS-to-OPS extended deny ip any any log
access-list OPS-to-BPCS extended deny ip any any log
# 应用访问列表
access-group BPCS-to-OPS in interface zone-bpcs
access-group OPS-to-BPCS in interface zone-ops
# 启用带功能码过滤的Modbus协议检测
policy-map type inspect modbus MODBUS-INSPECT
parameters
# 仅允许来自运营区的读取操作
match func-code read-coils
match func-code read-discrete-inputs
match func-code read-holding-registers
match func-code read-input-registers
# 阻止所有写入功能码
match func-code force-single-coil action drop log
match func-code preset-single-register action drop log
match func-code force-multiple-coils action drop log
match func-code preset-multiple-registers action drop log
# 应用到服务策略
policy-map global_policy
class inspection_default
inspect modbus MODBUS-INSPECT
# 记录到OT SIEM
logging host zone-ops 10.30.1.60
logging trap informational
logging enable
配置网络交换机在第2层强制执行区域边界，防止Purdue层级之间的广播域重叠。
# Cisco工业以太网交换机配置
# 基于区域的VLAN分配
# 与区域对齐的VLAN定义
vlan 10
name Z1-SIS-Safety
vlan 20
name Z2-BPCS-Control
vlan 30
name Z3-OPS-Operations
vlan 35
name Z4-DMZ
vlan 40
name Z5-Enterprise
# PLC端口 - 区域2 BPCS
interface range GigabitEthernet1/0/1-12
description PLC connections - Zone 2
switchport mode access
switchport access vlan 20
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation shutdown
spanning-tree portfast
spanning-tree bpduguard enable
no cdp enable
no lldp transmit
# HMI端口 - 区域2 BPCS
interface range GigabitEthernet1/0/13-18
description HMI connections - Zone 2
switchport mode access
switchport access vlan 20
switchport port-security
switchport port-security maximum 1
switchport port-security mac-address sticky
switchport port-security violation restrict
spanning-tree portfast
# 到工业防火墙的中继
interface GigabitEthernet1/0/24
description Trunk to ISA-3000 Firewall
switchport mode trunk
switchport trunk allowed vlan 20,30,35
switchport trunk native vlan 999
# 禁用未使用端口
interface range GigabitEthernet1/0/19-23
shutdown
switchport access vlan 999
在运营区和DMZ之间安装硬件强制的数据二极管（Data Diode），确保数据从OT单向流向IT。数据二极管从物理上防止任何数据回流到OT网络。
#!/usr/bin/env python3
"""数据二极管配置验证器。
验证跨数据二极管的历史数据库复制
（Waterfall Security、Owl Cyber Defense或Siemens）
是否正常运行并执行单向通信。
"""
import socket
import struct
import time
import json
from datetime import datetime
class DataDiodeValidator:
"""验证数据二极管的单向执行。"""
def __init__(self, diode_tx_ip, diode_rx_ip, historian_port=5450):
self.tx_ip = diode_tx_ip # OT侧（发送）
self.rx_ip = diode_rx_ip # IT/DMZ侧（接收）
self.port = historian_port
self.results = []
def test_forward_flow(self):
"""验证数据从OT（TX）通过数据二极管流向DMZ（RX）。"""
test_payload = f"DIODE_TEST_{datetime.now().isoformat()}"
try:
# 向TX接口发送测试数据
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(5)
sock.sendto(test_payload.encode(), (self.tx_ip, self.port))
sock.close()
self.results.append({
"test": "forward_flow",
"status": "PASS",
"detail": f"数据已发送到TX接口 {self.tx_ip}:{self.port}",
})
except Exception as e:
self.results.append({
"test": "forward_flow",
"status": "FAIL",
"detail": f"无法到达TX接口: {e}",
})
def test_reverse_flow_blocked(self):
"""验证反向流（DMZ到OT）被数据二极管物理阻断。"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(3)
result = sock.connect_ex((self.tx_ip, self.port))
sock.close()
if result != 0:
self.results.append({
"test": "reverse_flow_blocked",
"status": "PASS",
"detail": "到OT侧的反向连接被正确拒绝",
})
else:
self.results.append({
"test": "reverse_flow_blocked",
"status": "CRITICAL_FAIL",
"detail": "反向流可能存在 - 检测到数据二极管绕过！",
})
except (socket.timeout, ConnectionRefusedError):
self.results.append({
"test": "reverse_flow_blocked",
"status": "PASS",
"detail": "反向连接超时（硬件数据二极管预期行为）",
})
def test_historian_replication_latency(self):
"""测量跨数据二极管的复制延迟。"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(10)
start = time.time()
sock.connect((self.rx_ip, self.port))
latency = (time.time() - start) * 1000
sock.close()
status = "PASS" if latency < 1000 else "WARN"
self.results.append({
"test": "replication_latency",
"status": status,
"detail": f"复制端点延迟: {latency:.1f}ms",
})
except Exception as e:
self.results.append({
"test": "replication_latency",
"status": "FAIL",
"detail": f"无法到达RX历史服务器: {e}",
})
def run_all_tests(self):
"""运行完整的数据二极管验证套件。"""
print("=" * 60)
print("数据二极管验证报告")
print("=" * 60)
self.test_forward_flow()
self.test_reverse_flow_blocked()
self.test_historian_replication_latency()
for r in self.results:
status_icon = "+" if r["status"] == "PASS" else "-"
print(f" [{status_icon}] {r['test']}: {r['status']}")
print(f" {r['detail']}")
return self.results
if __name__ == "__main__":
validator = DataDiodeValidator(
diode_tx_ip="10.30.1.100", # 运营区TX
diode_rx_ip="172.16.1.100", # DMZ区RX
)
validator.run_all_tests()
实施后，通过验证只有授权的管道流量能在区域间通过、所有禁止的跨区路径都被阻断来验证区域架构。
# 来自企业区的验证测试 - 应被阻止无法到达BPCS
nmap -sT -p 502,44818,102,4840 10.20.0.0/16 --reason
# 预期：所有端口过滤/关闭
# 来自运营区的验证测试 - 只读Modbus应可正常工作
python3 -c "
from pymodbus.client import ModbusTcpClient
client = ModbusTcpClient('10.20.1.10', port=502)
client.connect()
# 读取应成功
result = client.read_holding_registers(0, 10, slave=1)
print(f'读取测试: {\"PASS\" if not result.isError() else \"FAIL\"}')
# 写入应被防火墙阻止
result = client.write_register(0, 100, slave=1)
print(f'写入被阻止: {\"PASS\" if result.isError() else \"FAIL - 写入被允许！\"}')
client.close()
"
# 验证数据二极管阻止反向流量
ping -c 3 10.30.1.100 # 从DMZ到OT - 应超时
# 预期：100%丢包（硬件数据二极管阻止ICMP）
| 术语 | 定义 |
|---|---|
| 安全区域（Security Zone） | 按照IEC 62443-3-2定义的具有共同安全要求的逻辑或物理资产分组 |
| 管道（Conduit） | 连接两个或多个区域的通信信道逻辑分组，受共同安全策略约束 |
| 安全级别目标（SL-T） | 区域的目标安全级别，从SL 1（偶然违规）到SL 4（国家级攻击） |
| 数据二极管（Data Diode） | 硬件强制单向网络网关，从物理上阻止数据反向流动 |
| 微分段（Microsegmentation） | 设备级别的精细网络分段，基于角色和功能逐设备管理通信 |
| 深度包检测（DPI） | 防火墙能力，可检查第4层以上的工业协议载荷（Modbus功能码、OPC UA服务调用） |
| 纵深防御（Defense in Depth） | 多层安全方法，在架构不同层次通过多种安全控制保护资产 |
背景：某制造工厂所有OT设备运行在单一VLAN（10.10.0.0/16）上，PLC、HMI、历史服务器和企业网络之间无任何分段。IEC 62443差距评估将此识别为需要实施区域的关键发现。
处理方法：
注意事项：在没有完整流量基线的情况下实施区域防火墙会中断未知但合法的通信路径。在生产期间而非维护窗口期间进行区域切换有导致过程中断的风险。将SIS控制器与BPCS放在同一区域违反IEC 62443安全系统隔离要求。
IEC 62443区域实施报告
=====================================
设施: [名称]
实施日期: YYYY-MM-DD
标准: IEC 62443-3-2/3-3
区域架构:
区域 [ID]: [名称] (SL-T: [1-4])
资产: [数量]
管道: [列表]
控制: [防火墙类型、数据二极管等]
管道配置:
管道 [ID]: [区域A] <-> [区域B]
协议: [允许的协议及方向]
防火墙规则: [允许数量 / 拒绝数量]
DPI已启用: 是/否
验证结果:
跨区域测试: [通过/失败数量]
禁止路径测试: [全部阻断 / 例外]
协议执行: [功能码过滤已验证]