Conduits: the only way across

What a conduit is made of, what it must log, and how attackers use a legitimate one.

By the end you can

Name the conduits the range models and what each carries.
Say what a conduit must record for a crossing to be reviewable afterwards.
Recognize a legitimate conduit being used by the wrong account.

A conduit is a decision you can audit

A conduit is not just a cable. It is a named crossing with an allowed direction, an allowed protocol, an allowed set of accounts, and a log that says who crossed and when. The last part is what turns it from a network control into evidence.

Attackers rarely break a conduit. They borrow it — a stolen engineer account using the jump host exactly as designed, at three in the morning, from a workstation that never used it before.

Direction: which side may open the connection, not just which may talk.
Protocol and port: a remote desktop conduit should not carry file transfer.
Identity: which accounts may cross, and whether the crossing is stepped up.
Record: a log entry per crossing that survives the machine being rebuilt.

The conduits on the range

Each of these is enforced by the firewall engine, so a rule change really changes what crosses.

Conduit	What it carries
C-01 — Z-CONTROL → Z-OPS	Historian collection, read-only, one direction. Watched for: A write function code arriving from the historian's address.
C-02 — Z-OPS → Z-DMZ	Historian replication and batch-record export. Watched for: Volume or destinations the historian has never used before.
C-03 — Z-DMZ → Z-ENTERPRISE	Brokered reads from the replica only. No session reaches the plant. Watched for: Any flow that terminates below the DMZ.
C-04 — Z-CONTROL → Z-SAFETY	Nothing. The safety system is monitored, never commanded. Watched for: Any packet at all.

Check yourself

A valid engineer account uses the jump host at 03:00 from a machine it has never used. What is that?

See the conduits and what watches them