🎓 Lesson 12
D5
OT Network Segmentation Design for SCADA Power Control
OT network segmentation for SCADA power control means dividing the mine’s industrial control network into isolated zones so that a cyberattack in one area can’t spread to critical power systems like substations or hoist drives.
🎯 Learning Objectives
- ✓ Design a zone-and-conduit architecture for a mine’s SCADA power control system using ISA/IEC 62443-3-3 zoning principles
- ✓ Analyze traffic flow between SCADA HMIs, RTUs, and medium-voltage switchgear to identify and eliminate unauthorized cross-zone pathways
- ✓ Apply firewall rule sets and VLAN ACLs to enforce segmentation policies for Modbus TCP and DNP3 protocols
- ✓ Explain the security and functional trade-offs of physical vs. logical segmentation in underground mine power infrastructure
📖 Why This Matters
In modern mines, power control SCADA systems manage everything from ventilation fans to conveyor drives—and a single unsegmented network breach has led to unplanned shutdowns costing >$500k/hour. In 2022, a segmented OT network at the BHP Olympic Dam site contained a ransomware attempt within Zone 2 (non-safety monitoring), preventing compromise of Zone 4 (substation protection relays). Segmentation isn’t just cybersecurity—it’s power system resilience.
📘 Core Principles
Segmentation follows the Purdue Model’s five levels (L0–L4), where mine power control resides primarily at Levels 2 (SCADA) and 3 (Operations). ISA/IEC 62443 defines Zones (groups of assets with similar security requirements) and Conduits (controlled communication paths between zones). Critical power assets—e.g., SEL-487B relays, Siemens S7-1500 PLCs controlling 33kV breakers—must reside in high-assurance zones (Zone 4+) with strict inbound/outbound filtering. Conduit design requires protocol-aware inspection: Modbus TCP requires port 502 whitelisting; DNP3 needs application-layer validation to prevent spoofed ‘cold restart’ commands. Physical segmentation (dedicated fiber, air-gapped controllers) provides higher assurance than VLAN-based logical segmentation—but adds cost and maintenance complexity in harsh mine environments.
📐 Zone Assurance Level (ZAL) Scoring
ZAL quantifies the security assurance of a zone based on asset criticality, threat exposure, and mitigation maturity. Used during ISA/IEC 62443 gap assessments to prioritize segmentation investments.
Zone Assurance Level (ZAL)
ZAL = Σ(S_i) for i = 1 to nQuantitative score reflecting maturity of security controls within a zone; used to verify compliance with target Security Level (SL).
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| S_i | Control maturity score | points (0–3) | Score per control domain: isolation, filtering, authentication, patching, audit logging |
Typical Ranges:
SL2-compliant power SCADA zone: 5 – 8
SL3-compliant substation protection zone: 9 – 12
💡 Worked Example
Problem: A mine’s 11kV feeder SCADA RTU zone contains 12 devices. It uses VLAN segmentation (not physical isolation), has no application-layer firewall, but enforces role-based HMI access. Its SLT (Security Level Target) is SL2 per ISA/IEC 62443-3-2. Calculate ZAL and interpret.
1.
Step 1: Assign scores: Physical isolation = 0 (not used); Logical isolation (VLAN) = 2; Application-layer filtering = 0 (absent); Authentication strength = 3 (RBAC + MFA); Patch cadence = 2 (quarterly updates).
2.
Step 2: Sum scores = 0 + 2 + 0 + 3 + 2 = 7.
3.
Step 3: Compare to SL2 target range (5–8): ZAL = 7 → meets SL2 but falls short of SL3 (9–12). Recommendation: Add DNP3-aware firewall to raise filtering score to 3, achieving ZAL = 10 (SL3).
Answer:
The result is ZAL = 7, which meets SL2 but not SL3. To protect critical power tripping logic, SL3 is recommended—requiring ≥1 additional mitigation point.
🏗️ Real-World Application
At Newmont’s Boddington Gold Mine (WA), engineers segmented the 220kV substation SCADA network into three zones: Zone 4 (Protection & Control: SEL relays, trip circuit monitors), Zone 3 (Supervisory: redundant SCADA servers, historian), and Zone 2 (Monitoring: environmental sensors, non-critical telemetry). Conduits used Cisco IRB firewalls with deep packet inspection for IEC 61850 GOOSE messages. After implementation, mean time to contain OT incidents dropped from 14 hours to <22 minutes, and no unauthorized command reached Zone 4 during 3+ years of operation.
✏️ Design Exercise
You are tasked with segmenting the power SCADA system for an underground copper mine with: (a) Surface 33kV substation (SEL-751 relays, Modbus TCP), (b) Shaft hoist drive PLC (Siemens S120, PROFINET), (c) Ventilation SCADA HMI (Windows Server, OPC UA), and (d) Wireless mesh sensor network (temperature, airflow). Using ISA/IEC 62443-3-3 Annex A, assign each asset to a Purdue Level and Zone, define required Conduits, specify allowed protocols/ports, and list two technical controls per Conduit.