Industrial Cybersecurity

Five phases overview

1. Plan — risk, architecture, technology selection, stakeholders and schedule
2. Configure — install, harden, users, time sync, logging and policy / ACLs
3. Test — lab or pilot: connectivity, rules, apps, performance and security
4. Deploy — staged go-live with change management and rollback
5. Manage — patch, review rules, support operations; repeat the cycle for major changes

1. Plan

Use the risk assessment to understand the threats each firewall must address. Review architecture diagrams to place devices for defence in depth — typically at IT/OT boundaries, DMZ edges and ahead of high-value control assets — without adding needless points of failure.

Select the firewall type and class for each location (packet filter, stateful, proxy, DPI / industrial) and match features to the zone or conduit. Coordinate with stakeholders, set a schedule and communicate milestones.

Architecture options

• Single firewall between two networks
• Firewall with a DMZ (three-tier buffer)
• Paired / dual firewalls isolating the DMZ from both enterprise and process networks

Many layouts are valid; choose against risk, complexity and operations — not fashion.

Technology selection checklist

• Type and class — inspection depth required for that boundary
• Extra functions — IDS/IPS, VPN, syslog / SIEM integration as needed
• Management — local vs remote admin; who owns the device
• Protocols — industrial and management protocols that must pass or be inspected
• Performance — throughput, latency, concurrent connections
• Redundancy — failover if the boundary is critical to availability
• Integration — logging, monitoring, compatibility with the rest of the stack
• Physical — space, power, ventilation, physical security of the appliance
• People — skills for configuration and ongoing maintenance
• Future — headroom for growth and regulatory change

2. Configure

Physically install hardware, software and firmware; apply patches and updates. Configure administrative users and access. Synchronise time between devices. Enable logging and alerts. Comply with organisational policy.

On greenfield sites (new networks with no prior plant network), you may need to defer full firewall tightening until control systems are stabilised — then lock down.

Policy and ACLs

Effectiveness depends more on policy than on the box. Define which traffic approved applications need (protocols, sources, destinations), including traffic the firewall itself requires for management and health.

• Build an explicit rule set (often called an access control list, ACL).
• Typical match fields: source/destination IP, TCP/UDP ports, direction, and (for stateful devices) connection state.
• Most devices evaluate rules top-down; a common pattern is deny by default, allow by exception.
• Comment rules so later changes remain understandable.
• A firewall is only as good as its ACLs — know the product syntax and processing order.

Many industrial firewalls provide GUIs and protocol libraries that simplify rule authoring compared with classic CLI ACLs. Principles stay the same: least privilege and documented intent. See also the short policy list on network security devices.

3. Test

Test a prototype in a lab or controlled environment before production. Goals: functionality, performance, scalability, security and interoperability.

Exercise at least:

• Required connectivity (does allowed traffic work?)
• Ruleset behaviour (is everything else blocked?)
• Application compatibility with control and business apps
• Management path, logging and alerting
• Performance under representative load
• Security posture and interoperability with peers
• Time synchronisation and optional features (VPN, NAT, IDS)

4. Deploy

• Notify users and operations before cutover or rule changes.
• Use change management; deploy in stages where possible.
• Keep a backup / rollback plan for last-minute surprises.
• Goal: help the business run securely without avoidable disruption.

5. Manage

After go-live, maintain the platform: security updates, firmware, rule reviews, log monitoring and operational support. When requirements or architecture change significantly, return to Plan and repeat the lifecycle.

IACS firewall configuration best practices

• Place industrial / protocol-aware firewalls where control traffic needs inspection — not only at the internet edge.
• Prefer deny-by-default; open only documented operational flows.
• Separate management plane from process traffic where practical.
• Keep NTP / secure time sync for logs and troubleshooting (NET 1.9).
• Log and alert on denied and unexpected traffic; feed monitoring / SIEM.
• Review rules regularly; remove unused “temporary” holes.
• Do not rely on router or switch ACLs alone for IT/OT or zone boundaries — see firewalls vs routers.
• Balance depth of firewalling against availability: every appliance is also a potential failure point.

Key takeaways

• Treat firewalls as a lifecycle, not a one-time install.
• Plan placement from risk and defence-in-depth; select technology for each boundary.
• Policy quality (deny default, documented ACLs) dominates hardware brand.
• Test both allow and deny paths; deploy with change control; manage continuously.