OT Network Segmentation: How to Isolate Industrial Systems
A single flat plant network means a compromised engineering laptop can reach PLCs, historians and corporate email in one hop. OT network segmentation breaks that path. It divides industrial systems into zones, controls the conduits between them and keeps production running while you harden the plant floor.
What Is OT Network Segmentation?
OT network segmentation is the practice of dividing an industrial network into zones, such as control, supervisory and enterprise layers, and controlling traffic between them through conduits and security devices. The aim is to stop attackers and faults from spreading across the plant while keeping required process communications working.
Why Flat Industrial Networks Are So Risky
Flat networks were common when plants were air-gapped. Today remote vendors, Windows jump hosts and IIoT devices sit on the same paths as controllers. Ransomware or a wrong engineering change can halt production, damage equipment or create safety risk.
OT vs IT Segmentation: What Changes on the Plant Floor
IT segmentation often uses aggressive scanning, frequent patching and active blocking. OT prioritizes availability and safety: changes are scheduled, many assets cannot run modern agents and you must understand process traffic before you cut anything. Passive discovery and vendor-approved change windows are the norm.
The Frameworks Behind OT Segmentation
The Purdue Model Levels (0 to 5) and the Industrial DMZ
The Purdue Enterprise Reference Architecture groups industrial systems into levels from physical process (0) through basic control (1), supervisory (2), operations (3) and enterprise/IT (4-5). An industrial DMZ usually sits between Level 3 and Level 4 so IT and OT exchange data without giving either side a direct flat path into the other.
ISA/IEC 62443 Zones and Conduits
ISA/IEC 62443 defines zones as groups of assets with a shared security level, and conduits as the controlled paths between zones. Segmentation work maps those zones on paper first, then puts firewalls, proxies or data diodes on the conduits.
NIST SP 800-82 Rev. 3 and NCSC OT Guidance
NIST SP 800-82 Revision 3 (2023) is NIST’s guide to operational technology security and strongly supports defense in depth and network separation for OT. The UK NCSC publishes operational technology guidance that likewise stresses understanding assets, limiting connectivity and monitoring.
Is the Purdue Model Still Relevant With Cloud and IIoT?
Yes as a planning lens, with updates. Cloud historians, remote access and IIoT gateways blur Level 3 and 4, so many plants add zones for cloud connectors and vendor access rather than abandoning Purdue. The industrial DMZ idea still holds: mediate every path that leaves the control domain.
How to Isolate Industrial Systems in 7 Steps
Step 1: Build a Complete OT Asset Inventory
List controllers, HMIs, servers, switches, wireless access points and vendor devices. Include firmware versions, network location and who owns each asset. You cannot zone what you have not found.
Step 2: Map Communication Flows Passively
Capture traffic with OT-safe monitoring. Record which devices talk, on which protocols and ports, and which flows are required for production versus convenience.
Step 3: Define Zones by Risk and Function
Group assets that share function and risk, for example safety systems, cell controllers, SCADA servers and engineering workstations. Align zone boundaries with Purdue levels and 62443 security levels where possible.
Step 4: Build an Industrial DMZ Between IT and OT
Place brokers, reverse proxies, patch mirrors and jump hosts in the DMZ. Block direct sessions from corporate laptops to PLCs.
Step 5: Control Conduits With OT-Aware Firewalls or Data Diodes
Allow only documented protocols and ports between zones. Use industrial firewalls that understand OT protocols. Where data must flow one way only, consider data diodes.
Step 6: Lock Down Remote and Vendor Access
Replace shared VPN sprawl with brokered, time-bound access through the DMZ, with MFA, session recording and just-enough permissions.
Step 7: Monitor, Test and Maintain Without Downtime
Deploy continuous OT network monitoring, test failover paths during planned outages and review firewall rules after every project, plant expansion or vendor campaign so temporary allows do not linger on production conduits.
OT Microsegmentation: When Zones Aren’t Enough
Plant-wide zones stop many attacks but a compromised HMI inside a cell can still reach every PLC in that zone. OT microsegmentation tightens controls between cells, VLANs or even individual controllers. It needs deeper traffic knowledge and careful change control; treat it as a later maturity step after solid zone boundaries exist.
Common OT Segmentation Mistakes
- Cutting links before mapping required process traffic
- Leaving engineering workstations dual-homed to IT and OT
- Allowing “temporary” any-any firewall rules that never expire
- Ignoring wireless access points and cellular modems
- Skipping vendor and remote-access paths
- Assuming VLANs alone equal segmentation without enforced ACLs
Real Incidents That Show Why Segmentation Matters
High-profile OT incidents, including ransomware that crossed from IT into industrial environments and attacks that abused remote access into control networks, keep proving the same point: once an attacker or worm is on a flat plant LAN, blast radius is enormous. Segmentation and a hardened DMZ buy time and contain damage.
US and UK Compliance Drivers
In the US, CISA ICS advisories and NIST SP 800-82 Rev. 3 guide OT defenses, and some sectors face directives that expect network protection and monitoring. In the UK, NCSC OT guidance and duties under the NIS Regulations for operators of essential services push organizations toward segmented, monitored industrial networks. EU NIS2 can also affect UK firms that operate in the EU.
OT network segmentation is also a people problem: operations, engineering and IT must share one inventory and one change calendar. Without that, firewall rules drift and temporary exceptions become permanent holes.
Isolating Industrial Systems Without Guesswork
OT network segmentation succeeds when a shared inventory, traffic maps and change windows come before firewall cuts. Start with the IT/OT boundary and remote access, then tighten cell by cell as traffic baselines mature. For help planning plant segmentation, contact Cyber Security Solutions Ltd through our contact page.
FAQs
The Purdue model is a reference layout of industrial levels from the process up to enterprise IT. ISA/IEC 62443 is a standards family that defines zones, conduits and security levels you can apply to that layout. Many programs use Purdue to visualize the plant and 62443 to specify how strong each zone and conduit must be.
Not safely. VLANs separate broadcast domains, but without ACLs, firewalls or enforced conduits, traffic can still move freely between them. Use VLANs as a building block inside a zone design that includes inspected conduits, default-deny rules and monitored jump paths.
Leaving standing dual-homed engineering or vendor access that bridges IT and OT, often with broad firewall exceptions. That single path undoes months of zoning work. Brokered DMZ access with MFA, session recording and expiring firewall rules fixes that failure mode.
Map flows passively first, pilot rules in monitor mode, cut over during planned outages and keep rollback plans. Involve operations, engineering and safety stakeholders before every change. Rushing active blocks without a traffic baseline is how plants cause their own downtime.
They change it; they do not remove the need for it. Treat cloud connectors and IIoT gateways as their own zones with tight conduits through the industrial DMZ. Never give a cloud agent a flat route to Level 1 controllers.
Review after any major project, new vendor connection or architecture change, and at least annually otherwise. Recheck firewall rules for temporary allows, confirm that monitoring still sees each conduit and update the asset inventory whenever devices are added, replaced or retired.
