Zones & Conduits
Workshop 1.7: security architecture — split the system into zones connected by conduits, and check that each zone's compliance level is compatible with the targeted level.
Not to be confused with ZCR 3
This page is the EBIOS equivalent of zoning. The IEC 62443 module has its own, normative breakdown, with an SL-T per zone. The two are not automatically synchronised.
Creating a zone
Name, target level, and attachment of workshop 1 objects:
- Business values (BV) — defined in workshop 1;
- Supporting assets (SA) — defined in workshop 1.
A zone with no BV or SA is of no use: the attachment is what enables the compliance calculation.
A zone's three tabs
| Tab | Content |
|---|---|
| Assets | Attachment of business values and supporting assets |
| Security checklist | Article-by-article assessment against a chosen framework, with justification and compensating measures |
| Summary | Average compliance score, weak points to address, compatibility with the target level |
The compatibility verdict
The summary compares the current score to the zone's target level and concludes: compatible or insufficient.
A methodological lock
When a zone is declared insufficient, the page states that corrective actions are needed before generating scenarios. This is deliberate: building attack scenarios on an architecture whose baseline is not up to level produces scenarios of little use.
Conduits
A conduit connects a source zone to a destination zone, with a direction (bidirectional or not) and the protocols / services it carries.