OT network safety (IEC 62443)

This page explains the deployment guidance behind ReduceWaste’s network posture on the OT side. It is background for why the edge component is placed the way it is — it is not a substitute for a real IEC 62443 security assessment of your own network, and ReduceWaste does not claim certification to that standard.

Zones and conduits, briefly

Instead of treating an industrial network as one flat trust domain, group devices into zones that share a similar security requirement — for example, a production cell’s PLC and field I/O, versus the plant’s general IT network, versus a vendor’s remote-support connection. Any path that crosses from one zone to another is a conduit, and a conduit is exactly where a control belongs — a firewall rule, a one-way data diode, a jump host — because that is the one place traffic between differently-trusted zones is forced through.

A single weak or compromised device matters far less if the zone it sits in cannot reach the zone holding safety interlocks or the plant historian’s write path. This is also why read-only access matters on its own: a conduit that can only read from OT, never write setpoints or coil values, removes a whole class of attack even if the device at the far end is weak.

Where ReduceWaste’s edge component sits

rw-edge sits in the DMZ position relative to the OT zone: it opens read-only sessions to PLCs and sensors only (Modbus write function codes are rejected in code; OPC UA sessions are read-only), and it is the only component that talks to field devices at all. It publishes already-processed samples outward over MQTT; nothing downstream of it is ever given a path back into the OT zone. Everything downstream — the broker, historian, agent control plane, operator app — lives in its own separate zone again, reachable only through the gateway described in Architecture & isolation, never directly.

Deployment guidance for your network

• Put rw-edge on a network segment that can reach the specific PLCs/sensors it polls and the broker — nothing else.
• Treat the link between rw-edge and the broker as a conduit: restrict it to the broker’s listening port, with credentials unique to the edge reader.
• Keep the broker, historian and app on a segment with no direct route back to OT.
• If a remote-support connection is ever opened, treat it as its own conduit with its own time-boxed, logged, admin-approved control — never as a standing path into either zone.

What this does not cover

Physical access control, patching of the PLCs and field devices themselves, and a full asset/vulnerability inventory of the OT network are outside what ReduceWaste can see or control — they remain the plant’s own responsibility and a real security assessment’s scope.