Industrial Microsegmentation Policy Examples¶
These examples show how secure overlay segmentation, authenticated session context, and the L2Proxy Rule Engine combine. They are expressed as operating policy rather than technical rule syntax so operations, engineering, cybersecurity, and asset owners can review the intended result together.
Policy model¶
Who and which session?
+
Which protected access domain and destination?
+
Which port, application, or Layer-7 protocol?
+
Which equipment, point, operation, value, or sequence?
=
Record / Allow / Block
Vendor diagnostics for a package unit¶
| Policy dimension | Approved intent |
|---|---|
| Identity | Authenticated vendor-service account during an approved work session |
| Domain | Vendor diagnostics domain |
| Reachability | Package Unit PU-07 only |
| Application | Approved engineering and diagnostic application only |
| Industrial authority | Read status, diagnostics, and health information |
| Restricted activity | Writes, controller state changes, downloads, other cells, and peer sessions |
| Evidence | User, session, application, equipment, operation, and decision |
Operational result: the vendor receives the access required for diagnosis without receiving broad plant or controller-change authority.
Modbus pump-station maintenance¶
| Policy dimension | Approved intent |
|---|---|
| Identity | Pump-maintenance technician |
| Destination | Pump Station PS-2 controller |
| Network service | Modbus communication to the approved endpoint |
| Allowed operations | Read status, run feedback, pressure, and selected diagnostics |
| Conditional operation | Write only the reviewed maintenance register within its engineering range |
| Blocked operations | Protected coil writes, unassigned registers, out-of-range values, and other stations |
L2Proxy advantage: a generic segmentation gateway may allow or deny TCP 502; L2Proxy can distinguish the requested read or write, target address, and value.
S7comm engineering session¶
| Policy dimension | Approved intent |
|---|---|
| Identity | Assigned automation engineer |
| Domain | Time-bounded controller-maintenance domain |
| Destination | PLC-CELL-04 |
| Allowed activity | Approved diagnostics and selected data reads |
| Restricted activity | PLC stop, program download, unapproved writes, and access to adjacent cells |
| Containment | Record the violation, block the operation, and permit session review or disconnection |
L2Proxy advantage: the session may reach the controller while consequential Layer-7 operations remain independently governed.
DNP3 substation control¶
| Policy dimension | Approved intent |
|---|---|
| Identity | Authorized substation operator session |
| Domain | Substation operations domain |
| Equipment | Assigned feeder breakers and reclosers |
| Allowed activity | Monitoring and approved controls |
| Stateful requirement | Operate must follow a matching Select in the same session and time window |
| Blocked activity | Direct Operate outside policy, target mismatch, replay, timeout, and unassigned equipment |
L2Proxy advantage: identity-aware microsegmentation and the state machine enforce the industrial sequence, not only connectivity to the DNP3 port.
IEC 60870-5-104 control-center access¶
| Policy dimension | Approved intent |
|---|---|
| Identity | Control-center service identity |
| Path | Approved site connection and protected access domain |
| Allowed activity | Expected telemetry, acknowledgements, and assigned station communication |
| Restricted activity | Control commands from an unauthorized session, unassigned station access, and unexpected application use |
| Evidence | Site, session, endpoint, protocol operation, direction, and policy decision |
OPC UA condition-monitoring provider¶
| Policy dimension | Approved intent |
|---|---|
| Identity | External condition-monitoring service |
| Destination | Approved OPC UA server for rotating equipment |
| Allowed activity | Required browse and read services for assigned data |
| Restricted activity | Write, method invocation, configuration, unrelated servers, and other applications |
| Evidence | Session-linked application service and asset context |
Detect an unexpected application inside an approved tunnel¶
A maintenance user is authorized for one industrial application and destination. During the session, traffic appears for an unapproved administrative application or port. Network, transport, and Layer-7 policy can record or block that traffic before it becomes an unrestricted lateral-movement path. If the behavior indicates account misuse or compromise, the session can be contained while its evidence is retained.
Review and qualification¶
The examples demonstrate policy depth, not universal plant authorization. Production values, functions, service names, timing, equipment mappings, and final outcomes are reviewed against the applicable protocol portfolio and representative customer traffic.