CYBRARY Unit 1 — Zones, conduits and levels
10 minConduits, and what is watched on each
The four declared crossings on the range, what each allows, and the thing each one is watched for.
By the end you can
- List the declared conduits and what each is allowed to carry.
- Say what an undeclared conduit looks like in the logs.
- Explain why a dual-homed laptop is a conduit nobody wrote down.
Declared crossings
A conduit is declared, so it can be watched and switched off. Each one on the range carries a stated kind of traffic and is monitored for a stated abuse.
| Conduit | Allowed, and watched for |
|---|---|
| C-01 — Z-CONTROL → Z-OPS | Historian collection, read-only, one direction. Watched for: A write function code arriving from the historian's address. |
| C-02 — Z-OPS → Z-DMZ | Historian replication and batch-record export. Watched for: Volume or destinations the historian has never used before. |
| C-03 — Z-DMZ → Z-ENTERPRISE | Brokered reads from the replica only. No session reaches the plant. Watched for: Any flow that terminates below the DMZ. |
| C-04 — Z-CONTROL → Z-SAFETY | Nothing. The safety system is monitored, never commanded. Watched for: Any packet at all. |
The undeclared kind
An undeclared conduit is the one that hurts. It rarely appears as a firewall rule; it appears as a host holding an address on two networks at once, a remote session with no matching leg in the DMZ, or a replica that turned out to be writable. Each of those has a detection on the range, and each is written up as a boundary finding.
- A plant-side session with no DMZ leg: somebody crossed outside the conduit.
- A second address on an engineering laptop: the laptop is the conduit.
- A new egress destination from the historian: the data is leaving by a path nobody declared.