Network
Industrial Firewall
A firewall, often with industrial protocol awareness, enforcing conduit rules between zones.
Critical criticalityLevel 3.5 / zone boundaries
What it does
Permits explicitly approved flows, denies everything else and produces boundary telemetry.
Typically locatedIT/OT boundary, industrial DMZ, between cell zones.
At a glance
PurdueLevel 3.5 / zone boundaries
CategoryNetwork
Protocolsmodbus-tcp, opc-ua, dnp3
Talks toEverything crossing a boundary, Log collectors, Management systems
Common vendorsCisco, Fortinet, Palo Alto Networks, Siemens (SCALANCE S), Moxa
Why should I care?
Industrial Firewall sits at Level 3.5 / zone boundaries. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Any/any rules added 'temporarily'
- Rule bases that outlive their purpose
- Management plane reachable from IT
If it is compromised
- Segmentation collapses; attacker controls what crosses the boundary
What to monitor
- Rule changes
- Denied traffic patterns
- Admin logins
- Unexpected permitted flows
How to defend it
- Deny by default with documented purpose per rule
- Periodic rule recertification
- Out-of-band management
Hunting
Hunt ideas for this component
Related