Tool
Communication matrix builder
Zones and conduits only work when every crossing flow is written down. List the flows you believe exist, and this tool tells you which ones a deny-by-default OT boundary should refuse, broker or pin.
Why should I care?
Most OT firewall rule sets are archaeology: rules added during a commissioning weekend and never removed. A communication matrix — the artefact ISA/IEC 62443-3-2 expects alongside your zone and conduit design — forces each flow to name a source, a destination, a protocol, an initiator and a business reason. Anything without all five is a candidate for removal.
Step 1
Add a flow
Everything runs in your browser. Nothing is transmitted or stored.
Step 2
Review the matrix
2 flows documented · 1 needs attention
Level 2 — Supervisory / HMI → Level 3.5 — Industrial DMZ
OPC UA 4840/tcp · Source initiates · Historian collection
- Outbound to a lower-trust zone. Pin the rule to specific hosts and ports, log it, and confirm the destination cannot write back.
Level 4/5 — Enterprise IT → Level 3 — Site operations
RDP 3389/tcp · Source initiates · Engineer desktop access
- No flow should cross directly between enterprise IT and OT. Terminate it in the industrial DMZ and broker it — replicated historian, update mirror, jump host or data diode.
- Control protocols carry unauthenticated write and program-download functions. Do not allow this inbound into a higher-trust zone; pull data outward to a collector instead.
Using it
How to turn this into firewall rules
- Walk the matrix with the controls engineers who own the process — they know flows that no documentation records.
- Capture a passive traffic baseline and compare it with the matrix. Flows in traffic but not the matrix are undocumented; flows in the matrix but not in traffic are candidates for removal.
- Convert each surviving row into one directional rule pinned to named source and destination hosts, then finish the policy with an explicit deny-and-log.
- Re-validate the matrix at every management-of-change event: new skid, new vendor, new historian tag, new remote access request.
- Never test rule changes on a live process without a maintenance window and an agreed rollback.