The castle-and-moat model: how classic OT cybersecurity thinks (and fails)

If you've ever talked to a cybersecurity engineer about protecting an industrial plant, you've probably heard the phrase "castle-and-moat model." It's one of the oldest — and most useful — analogies in the field for explaining, without jargon, how industrial networks (OT) have traditionally been protected. It's also the perfect analogy for explaining why that protection, left as-is, is no longer enough.

The original idea: one big wall

A medieval castle defended itself with a simple logic: a tall perimeter wall, a moat around it, and a single guarded gate. Everything inside was considered "trusted"; everything outside was hostile. If the wall held, the interior was safe.

For decades, OT networks (the systems controlling PLCs, SCADA, robots and production lines) were designed exactly this way:

• The wall is the perimeter firewall between the plant network (OT) and the corporate network (IT).
• The moat is the physical or logical separation that makes direct access from outside harder.
• The guarded gate is the single remote-access point, usually a VPN or a jump server.
• The inside of the castle is the entire plant network: PLCs, HMIs, historians — all treated as a "trusted zone" once you're in.

This logic worked reasonably well while OT networks were physically isolated ("air-gapped") and nobody outside needed access. The problem is that assumption stopped being true over a decade ago.

Why the single-wall castle no longer protects you

The single-perimeter model has a structural flaw: once someone gets past the wall, they have access to everything. And today there are far more ways past that wall than there were when the model was designed:

• A third-party vendor connects with their own laptop to support a machine — and that laptop is already infected.
• An employee plugs in a USB firmware update that unknowingly carries malware.
• A remote maintenance VPN was opened years ago and nobody has reviewed it since.
• IT/OT convergence (driven by Industry 4.0, predictive maintenance, cloud dashboards) multiplies the connection points between the corporate network and the plant floor.

In every one of these cases, the attacker isn't jumping the wall from outside — they're already inside the moat, and the castle-and-moat model has no answer for that. It's the same reason IT has spent years moving toward "zero trust" models — except in OT you can't apply zero trust the same way: a 2008-era PLC can't authenticate with modern certificates, and an unplanned shutdown from a security incident can cost far more than it would on an office server.

The real translation: zones and conduits (IEC 62443)

This is where the analogy stops being a nice metaphor and becomes applied engineering. IEC 62443 — the reference standard for cybersecurity in industrial automation and control systems — doesn't propose "a bigger wall." It proposes many smaller walls, organized by criticality.

In castle terms: instead of a single outer perimeter, you have an outer bailey, an inner wall, a keep — and each ring has its own gate and its own level of watch. In IEC 62443 terms, this is called segmentation into zones and conduits:

• Zones: assets are grouped by function and criticality — a safety-critical PLC network is not the same as a label-printer network. Each zone gets its own target Security Level (SL 1 to 4).
• Conduits: every communication between zones passes through a controlled, audited point — no free traffic just "because we're already inside the castle."
• Defense in depth: if an attacker compromises one zone, segmentation limits lateral movement toward more critical zones — the outer bailey can fall without the keep falling with it.

This doesn't remove the perimeter (the outer wall is still necessary), but it stops being the only line of defense. The question is no longer "does the wall hold?" but "if the wall falls, what can the attacker actually reach?"

What this means in a real audit

When we audit a plant, the question that actually matters isn't whether you have a firewall (almost everyone does), but:

1. Is the plant network segmented into real criticality zones, or is it one flat network with a firewall at the entrance?
2. Is there visibility into what communicates between zones, or is everything internal simply assumed to be trusted?
3. Do remote access paths (vendors, maintenance) go through an audited conduit, or is it an open VPN that's been running since 2015?
4. Are the most critical assets — the ones that stop production or put people at risk — in the zone with the highest security level, or mixed in with everything else?

A single-wall castle is cheaper to build. But when it falls, it falls entirely. A plant segmented into zones and conduits costs more to design — but when something fails, only one zone fails, not the whole plant.

If you want to know where your facility sits on that spectrum, that's exactly what an IEC 62443 audit evaluates: not whether you have a wall, but how many walls you have and where they're placed.