The Industrial Security Zones Designer is a skill for architecting and auditing network segmentation in Operational Technology (OT) and Industrial Control System (ICS) environments. It applies the ISA/IEC 62443 standard alongside the Purdue Enterprise Reference Architecture (PERA) and NIST SP 800-82 to guide engineers through defining security zones, managing conduits between those zones, and mapping assets according to Purdue Model levels, criticality, and functional requirements.
Industrial networks frequently operate with flat architectures or poorly managed IT/OT convergence, both of which introduce serious security risks. Manually designing segmentation that respects safety-critical constraints, process integrity, and complex traffic flows is error-prone. This skill automates the zone and conduit design logic, enforcing strict industrial safety constraints so that every conduit is justified by a business requirement, has defined directionality, and carries identified security controls.
The skill is vendor-neutral and can work with data from firewall platforms such as Fortinet, Cisco, and Palo Alto, as well as asset inventory tools including Nozomi, Claroty, and Dragos, and any network monitoring system. Its outputs include zone and conduit registers, firewall flow allowlists, and remediation roadmaps. It explicitly avoids proposing dangerous destructive testing or hallucinated network paths, which are known failure modes in generic AI-assisted network design.