A security configuration system in an industrial environment, comprising: a memory that stores executable components; one or more processors, operatively coupled to the memory, that executes the executable components, the executable components comprising: an interface component configured to: receive zone configuration input that assigns respective industrial assets to selected security zones (Z1, Z2, Z3), wherein the industrial assets include industrial devices (504, D1,..., D8) and network infrastructure devices and receive conduit configuration input specifying an allowed communication path (304, 302, 306) between a first industrial device of the industrial devices and a second industrial device of the industrial devices, wherein the first industrial device is in a first zone of the security zones and the second industrial device is in a second zone of the security zones; an instruction translation component configured to generate one or more security configuration instructions directed to the first industrial device and the second industrial device based on the zone configuration input and the conduit configuration input, wherein the one or more security configuration instructions are configured to set respective device-level security settings on the first industrial device and the second industrial device to allow communication between the first industrial device and the second industrial device; and a communication component configured to send the one or more security configuration instructions to the industrial assets. a memory that stores executable components; one or more processors, operatively coupled to the memory, that executes the executable components, the executable components comprising: an interface component configured to: receive zone configuration input that assigns respective industrial assets to selected security zones (Z1, Z2, Z3), wherein the industrial assets include industrial devices (504, D1,..., D8) and network infrastructure devices and receive conduit configuration input specifying an allowed communication path (304, 302, 306) between a first industrial device of the industrial devices and a second industrial device of the industrial devices, wherein the first industrial device is in a first zone of the security zones and the second industrial device is in a second zone of the security zones; an instruction translation component configured to generate one or more security configuration instructions directed to the first industrial device and the second industrial device based on the zone configuration input and the conduit configuration input, wherein the one or more security configuration instructions are configured to set respective device-level security settings on the first industrial device and the second industrial device to allow communication between the first industrial device and the second industrial device; and a communication component configured to send the one or more security configuration instructions to the industrial assets. an interface component configured to: receive zone configuration input that assigns respective industrial assets to selected security zones (Z1, Z2, Z3), wherein the industrial assets include industrial devices (504, D1,..., D8) and network infrastructure devices and receive conduit configuration input specifying an allowed communication path (304, 302, 306) between a first industrial device of the industrial devices and a second industrial device of the industrial devices, wherein the first industrial device is in a first zone of the security zones and the second industrial device is in a second zone of the security zones; receive zone configuration input that assigns respective industrial assets to selected security zones (Z1, Z2, Z3), wherein the industrial assets include industrial devices (504, D1,..., D8) and network infrastructure devices and receive conduit configuration input specifying an allowed communication path (304, 302, 306) between a first industrial device of the industrial devices and a second industrial device of the industrial devices, wherein the first industrial device is in a first zone of the security zones and the second industrial device is in a second zone of the security zones; an instruction translation component configured to generate one or more security configuration instructions directed to the first industrial device and the second industrial device based on the zone configuration input and the conduit configuration input, wherein the one or more security configuration instructions are configured to set respective device-level security settings on the first industrial device and the second industrial device to allow communication between the first industrial device and the second industrial device; and a communication component configured to send the one or more security configuration instructions to the industrial assets.