A decade ago, the furnace was often among the most isolated systems on a plant site. Today, its control network may carry historian feeds, Level-2 process-model traffic, energy dashboards, OEM remote-support sessions and cloud analytics. Each connection creates a conduit toward PLCs commanding combustion air, fuel trains, quench systems and molten-metal handling.
That changes the risk calculation. A compromised furnace network is not simply an IT incident or a data breach. It can become a physical-process event, affecting people, equipment, product quality and production continuity. The right response is not to disconnect every useful system indiscriminately. It is to define, control and monitor the required communications using risk-based defense in depth.
How furnace control networks get exposed
Common design and operational weaknesses include:
- Flat networks that let an intrusion on one workstation spread toward controllers and HMIs.
- A missing industrial DMZ, leaving direct or insufficiently restricted connections between enterprise IT and OT.
- Overly broad firewall rules or ACLs that permit whole address ranges and unnecessary ports.
- Multi-homed engineering laptops or other devices connected to multiple zones, creating a potential lateral-movement bridge.
- Forgotten remote-access links that bypass the intended zone-and-conduit controls.
- Unused hardware debug interfaces, such as JTAG or SWD, left accessible after shop-floor physical access.
- Enterprise services, including email or command-and-control-capable DNS and IMAP traffic, leaking into control networks.
- Reliance on VLANs or different subnet masks alone. ISA’s published discussion notes that some manufacturers, particularly in APAC, have treated these as adequate separation. They limit broadcast domains, but do not by themselves provide security enforcement. [2]
OWASP identifies missing DMZs, broad ACLs, multi-homed devices, forgotten debug interfaces and ungoverned remote access among the common zones-and-conduits design errors. [1]
Zones and conduits: the IEC 62443 method
Under the ISA/IEC 62443 approach, assets with similar security requirements are grouped into zones, based on risk. A conduit is the controlled communication path between zones. Firewalls, access-control lists and other enforcement mechanisms restrict that path to necessary communications, supporting defense in depth and least privilege.
IEC 62443-3-2’s methodology, summarized by OWASP, can be organized as a 7-step process:
- Identify the system under consideration, including assets and communications links.
- Conduct an initial cyber-risk assessment.
- Partition the system into zones and conduits.
- Check whether the initial risk is tolerable.
- Where required, assess risk in greater detail for each zone and conduit.
- Document requirements, assumptions and constraints.
- Obtain asset-owner approval. [1]
The ISA article describes four security levels: SL 1 addresses non-targeted attackers, SL 2 hacktivist or hobbyist hackers, SL 3 professional hackers, and SL 4 nation-state actors. The asset owner determines the target security level. These are published reference definitions, not universal requirements or a substitute for a site-specific risk assessment. [2]
The strongest architecture is not automatically the most complex. OWASP’s guidance is to choose the design that meets operational and security needs without unnecessary complexity. [1]
A practical Purdue-style view of furnace zones
The mapping below is illustrative. Site architecture and risk assessment determine the actual boundaries and required controls. Safety systems should receive dedicated consideration and strong enforcement boundaries.
| Purdue level | Typical furnace-plant assets | Primary control objective |
|---|---|---|
| Level 0: Process and field devices | Valves, sensors, actuators, drives and safety instrumented functions | Keep essential process paths isolated; enforce boundaries around safety functions |
| Level 1: Local control | Furnace PLCs, burner-management controllers, quench and handling controllers | Restrict controller communications to specifically authorized control and engineering paths |
| Level 2: Supervisory control | HMIs, SCADA and local supervisory servers | Permit required supervisory flows; prevent direct enterprise access |
| Level 3: Manufacturing operations | MES, historian, maintenance systems and energy dashboards | Control data exchange and separate OT security operations services where appropriate |
| Level 3.5: Industrial DMZ | Remote-access broker, patch staging and approved data-exchange services | Terminate and inspect authorized exchanges; prevent direct IT-to-OT connections |
| Level 4: Business logistics and enterprise IT | ERP, business systems, email and enterprise services | Apply enterprise perimeter controls and explicitly deny unnecessary traffic to lower OT levels |
The industrial DMZ: where IT meets the furnace
An industrial DMZ, often described as Level 3.5, sits between enterprise systems and manufacturing operations. It is an enforcement boundary, not simply another subnet. Connections should terminate at approved DMZ services rather than pass directly from IT to OT. Typical sub-zones can include:
- Remote access: brokered vendor and engineering sessions.
- Cloud access: specifically authorized services for approved data exchange.
- Patch staging: updates and endpoint signatures reviewed before release into OT.
- Data exchange: controlled transfers from plant systems to business or reporting systems.
Define every flow by source, destination, protocol, direction and business purpose. Apply outbound rules as rigorously as inbound rules. Where historian exports only need to flow outward, a unidirectional gateway or data diode can provide one-way transfer, if that fits operational needs. A simple proxy is not sufficient protection if it blindly forwards harmful traffic. [2][3]
Securing remote access to furnace controls
Remote OEM support can shorten troubleshooting, but persistent or loosely governed access creates an out-of-band path into control zones. Establish remote connectivity through a controlled DMZ access point and use:
- A hardened jump server or access broker, with MFA.
- Individual, attributable accounts and credentials scoped to approved assets and tasks.
- Time-limited support windows, approved by the asset owner.
- Session recording and logging, with review of privileged activity.
- Vendor-laptop quarantine or validation before connection.
- Deny-by-default network rules for every remote path, with connections removed when work ends.
NIST SP 800-82r3 recommends defense in depth, controlled remote access and layered architectures that account for OT safety, availability and reliability requirements. [3]
Hardening the brownfield furnace network
Legacy systems may not support modern endpoint security or safe, immediate patching. Begin with passive asset discovery and communication mapping, then re-architect in stages planned around production constraints.
- Inventory controllers, HMIs, engineering stations, switches, gateways and every known remote link.
- Put safety-related systems in their own segments, separated by major enforcement boundaries.
- Use a separate OT directory domain where appropriate, without a trust relationship to enterprise IT.
- Stage and test patches through the industrial DMZ before scheduled deployment.
- Where fieldbus or legacy equipment cannot be hardened directly, segment around it and restrict the paths reaching it.
- Monitor network flows and configuration changes using methods tested for the plant’s operational conditions.
The purpose is not to impose IT controls blindly. It is to reduce exposure without creating unacceptable process or availability risks.
What the steel sector has already learned
Danieli’s 2021 account of its automation solution for the ABS QWR4.0 special-steel wire-rod mill provides a published reference implementation, not a normative requirement. The reported measures included:
- Physical LAN segregation between IT, OT, Voice/CCTV and building management systems.
- VLAN use to enhance separation between access and data flows.
- Hardware and software controls for data flows and anomalous behaviour.
- Fieldbus network monitoring.
- High-availability virtualized IT and geographically redundant remote backup to support continuity of service. [4]
The case illustrates a key principle: connectivity can support modern operations, but the architecture must deliberately control how systems communicate and how service is restored after disruption.
Apply the discipline to each operation
The trust boundaries should reflect the process: a steel rolling mill must account for furnace and mill-line control; heat treatment furnaces need controlled links between supervisory systems and batch controls; an aluminum melting furnace and a melting furnace for steel require careful protection of process and material-handling networks. The same approach extends across thermal processing equipment, a hot dip galvanizing plant, a metal recycling furnace, and integrated systems supplied by an industrial furnace manufacturer. In the wire and cable industry, remote support and production data flows should use approved conduits, while industrial furnace systems and furnace spare parts planning should also address configuration integrity and recovery readiness.
For information on furnace automation and control, see Continental Furnaces’ automation and control services.
Keep the control layer stocked
Cyber resilience includes the ability to restore trusted operation, not only block intrusions. Consider maintaining:
- Spare industrial firewalls, switches and media converters.
- Cold-standby PLC modules with validated configuration backups.
- A documented firmware-version and configuration-management record.
- Network-configuration backups stored off-network.
- Recovery runbooks that identify restoration order, approval points and verification steps.
A backup is valuable only when it can be located and restored confidently. Include representative recovery testing in a safe test environment or planned maintenance window. Explore furnace spares and accessories.
A five-phase implementation roadmap
- Asset inventory and risk assessment: Use passive discovery where appropriate; map devices, dependencies and every conduit.
- Zone-and-conduit design: Apply IEC 62443-3-2, document the risk basis and agree target security levels with asset owners.
- Phased implementation: Introduce firewalls, an industrial DMZ, data diodes where suitable and safety-system segregation with minimal production disruption.
- Remote access and monitoring: Deploy jump servers, MFA, session recording and OT-aware anomaly monitoring.
- Governance and recovery: Establish patching through the DMZ, periodic reassessment, incident-response runbooks and supplier access policies. Test isolated backups and recovery plans.
Build an enduring resilience partnership
Continental Furnaces brings 35+ years of expertise, ISO-certified quality and customized engineering to industrial thermal processing. As an industrial furnace manufacturer, we work with customers on solutions tailored to their process, including furnace automation and control considerations. Engage our team to assess your requirements and plan for lifecycle reliability and sustained competitive advantage. Request a consultation or quote.
References
- OWASP, OT Top 10 #7: Broken Zones and Conduits Design, summarizing IEC 62443-3-2.
- M. Yousuf Faisal, “OT Security Dozen Part 3: Network Security Architecture & Segmentation”, Automation.com/ISA, October 2022.
- NIST, SP 800-82r3, Guide to Operational Technology Security, September 2023.
- Danieli, “Steel plants cybersecure by design”, 2021.
- CISA, Cybersecurity Practices for Industrial Control Systems.
