Securing the Un-securable: Segmentation for Legacy OT Devices with IEC 62443

Swarnali Ghosh | Date: October 29, 2026

Introduction

Most operational technology (OT) cybersecurity programs collapse not because of weak software, but because they depend heavily on borrowed IT frameworks. Let’s face it: IT practices were never designed for industrial environments where a single misconfigured setpoint can trigger a catastrophic facility failure or endanger lives. While IT security centres around data privacy via the traditional Confidentiality, Integrity, and Availability (CIA) triad, the plant floor completely inverts these priorities. In industrial operations, operational availability and physical safety reign supreme.

This is exactly why generic IT tactics fail when applied to legacy OT devices. To bridge the widening gap between corporate IT security teams and plant-floor automation engineers, the industrial sector has rallied around a unified baseline. The IEC 62443 series has rapidly emerged as the global gold standard for securing Industrial Automation and Control Systems (IACS). By using this risk-based engineering framework, industrial enterprises can build robust resilience directly into environments plagued by ageing, unmatchable hardware.

Here's a breakdown of how modern engineering teams use the framework to secure old machinery without risking a costly process trip.

The Reality of Ageing Infrastructure: The Legacy OT Challenge

Step inside any modern manufacturing facility, water treatment plant, or chemical processing facility, and you will see a combination of state-of-the-art IoT sensors sitting right beside 20-year-old Programmable Logic Controllers (PLCs). The PLCs continue to perform their functions flawlessly. Nonetheless, they do not have any inherent security mechanisms such as encryption, user authentication, and logging. Inherently, they are insecure due to the fact that they were designed for a time when industrial control systems networks did not even have any access to the Internet.

But then, how would you protect a vulnerable asset?

You don’t actually deploy the security agent on the machine. Rather, you manipulate the surroundings. The way the IEC 62443 approach works is that it concentrates very much on the architecture of the system rather than the individual endpoints. It grades the defence strength according to a defined Security Level (SL) system. This system evaluates the defence strength according to the capabilities of the attackers it can defend against:

SL 1: 

Protection against casual or unintentional violations, such as human configuration errors.

SL 2: 

Defence against simple intentional violations executed by low-motivation actors with basic tools.

SL 3: 

Protection against sophisticated, OT-specific malware operated by highly motivated groups.

SL 4: 

Defence against nation-state actors armed with extensive resources and custom zero-day exploits.

For legacy systems, the primary goal is often achieving a robust SL 2 or SL 3 through external architectural defences.

Blueprinting Safety: Implementing Zones and Conduits

To secure vulnerable endpoints, you must eliminate the traditional flat network. In a flat network design, an attacker who compromises a single corporate laptop can move laterally across the entire network, eventually gaining direct access to the plant floor. To prevent this, the standard mandates a strict architecture of Zones and Conduits.

Zone: 

It’s a logical grouping of physical or software assets that share identical security requirements and risk profiles. For example, your highly critical Emergency Shutdown Systems (ESD) should sit in an isolated Safety Zone with a demanding SL 4 designation. Meanwhile, standard human-machine interfaces might live in a lower-tier Supervisory Zone.

Conduit: 

On the other hand, represents the only authorised communication pathway allowed between distinct zones. Traffic cannot just wander across boundaries; it must pass through a conduit controlled tightly by industrial firewalls or data diodes.

At IronQlad, our implementation teams frequently align this zones-and-conduits design with a modernised Purdue Model. This architecture guarantees that network traffic flows exclusively between adjacent functional layers. By using this setup, a direct, unfiltered connection from a corporate business application down to a field controller becomes structurally impossible.

Consequence-First Risk and Passive Asset Discovery

Before creating network boundaries, you have to know exactly what is sitting on your wire. But here is a major warning: never run active network scanning tools inside a live OT environment. Active scanners blast networks with aggressive ping sweeps and packet requests. While corporate IT servers handle this easily, legacy controllers frequently lock up, crash, or trigger unexpected, million-dollar plant shutdowns under the strain.

Instead, the baseline safety standard requires passive asset discovery. This method involves mirroring network traffic via SPAN ports or physical network taps to safely analyse data streams without injecting a single rogue packet.

Is a spreadsheet system sufficient? Far from it. Asset discovery on its own can uncover 46% to 78% more active assets than those previously found in the outdated internal register. Typically, the assets that were missed are the third-party modem, the maintenance laptop, and the unrecorded wireless access point. This is what an attacker seeks.

Compensating Controls: Jump Hosts and Virtual Patching

What happens when an asset register reveals an ancient Windows OS controlling a multi-million dollar production line? You can't patch it because an update might break the legacy control software, and you can't take the machine offline without halting company production.

In these tough spots, IEC 62443 relies on highly effective compensating controls to mitigate risk:

Two-Jump-Host Architecture: To completely block direct remote paths from corporate Office spaces to raw industrial machinery, companies should channel sessions through an Industrial DMZ (IDMZ). An engineer looking to tweak a program must first log into an initial jump host in the DMZ. From there, they open a completely separate, isolated session from the DMZ host down to the actual OT engineering workstation. This broken-path design ensures that even if an employee's corporate credentials are stolen, the attacker cannot establish a direct tunnel to a PLC.

Network-Level Virtual Patching:

For 20 to 30 years, they outlive their software support cycles. Virtual patching tackles this by deploying industrial Intrusion Prevention System (IPS) signatures directly into the network conduits. These signatures inspect industrial protocols, intercepting and blocking known exploit attempts at the network layer before they ever reach the vulnerable controller. Think of it as an external proximity shield that keeps the device safe while production continues running smoothly.

Long-Term Governance: 

Without proper governance. Operational resilience can only be achieved when the CSMS is deployed in order to turn the security effort from a project into a process.

Conclusion

Organisations working in enterprises achieve their objectives by integrating these frameworks by adopting NIST SP 800-82 or CSF 2.0 as the overall management framework and then diving deeper into the technical implementation with the help of IEC 62443. You may implement the "Identify" function in the NIST Framework through the process of risk assessment explained in IEC 62443-3-2. Furthermore, you may implement the "Protect" pillar through the technical controls stated in IEC 62443-3-3.

Protecting industrial infrastructure is not about having advanced firewalls; it involves taking a more engineering approach to cyber threats. Using the concept of zones and conduits, adopting passive monitoring, and designing hardened remote access architecture, you will be able to secure your production availability and field staff.

Curious about how to safely segment your legacy plant floor without risking an operational shutdown? Explore how IronQlad can support your industrial cybersecurity journey today.

KEY TAKEAWAYS

Reversed Priorities: O

T security focuses on personnel safety and uptime ahead of any data privacy, which mandates a specific engineering approach instead of standard corporate IT techniques.

Isolation by Means of Zones and Conduits: 

The deployment of a zero-trust architecture based on IEC 62443 zones and conduits prevents hackers from lateral movement across plant floors.

Passive Visibility Is Mandated: 

Active scanning of a network may disrupt legacy plants; therefore, passive traffic analysis is necessary for discovering all vendor access points and unknown devices safely.

Virtual Patching and Jump Hosts: 

Using network-based virtual patches and multi-tiered jump hosts enables businesses to isolate legacy equipment without interrupting the processes.