One of the most common risky structures in industrial networks is the flat network: the office network, SCADA, PLCs and remote access share the same broadcast domain. On such a network a single compromised computer can reach the entire control system. Segmentation is the most basic way to limit that impact.
The Purdue Model: a shared map
The Purdue Model is a reference architecture that layers industrial control networks:
| Level | Contents |
|---|---|
| 0 | Process: sensors, actuators, field devices |
| 1 | Basic control: PLCs, RTUs, DCS controllers |
| 2 | Supervision: SCADA, HMI, operator stations |
| 3 | Site operations: MES, historians, engineering stations |
| 3.5 | The IT/OT DMZ (commonly referred to this way) |
| 4–5 | Business planning and enterprise IT |
The main rule: traffic should not skip levels and pass directly; it should flow through adjacent levels and controlled points. Direct access from IT to Level 1 violates the model.
The DMZ: a buffer between IT and OT
The DMZ (Level 3.5) hosts services that IT and OT must share: patch/antivirus update servers, historian replicas, remote-access jump hosts and data transfer gateways. The principle is: the connection terminates in the DMZ. The IT side connects to a service in the DMZ and the OT side connects to a service in the DMZ; no session is opened directly between the two networks.
IEC 62443: zones and conduits
IEC 62443 groups assets with similar security requirements into zones and the controlled paths between zones into conduits. Unlike copying the Purdue layers, this offers a risk-based view: a zone can be a production line, a safety instrumented system or a vendor-access area. The target security level (SL-T) of each zone is derived from risk assessment, and for each conduit the permitted protocols, directions and inspection points are defined explicitly.
A practical segmentation roadmap
- Inventory first. Without knowing what talks to what and over which protocol, segmentation is guesswork. (OT asset inventory)
- Build the communication matrix. Which device talks to whom, on which port and protocol? This is the raw material for firewall rules.
- Define zones. By function and criticality: for example “packaging line control”, “SCADA servers”, “engineering”, “DMZ”.
- Write conduits and rules. An allow-list approach: deny everything except what is explicitly required. Document rules with their rationale.
- Consolidate remote access. Route vendor and remote maintenance access through one controlled path (jump host, multi-factor authentication, session recording).
- Roll out gradually. Start in monitoring mode to validate the rules, then move to blocking; do changes that can affect production in planned downtime windows.
- Monitor continuously. Unexpected new connections and out-of-policy traffic show whether segmentation is working.
When one-way flow is needed
Some flows should go only from OT outward (for example transferring production data to the enterprise network). In these cases a data diode (a hardware-enforced one-way link) or OT-initiated connections are preferred, closing the inbound request path from the outside network to OT.
How modern connectivity changes the model
IIoT and cloud projects open new data paths that cross the traditional layers. These paths must be included in the segmentation design. If a Unified Namespace is being built, for example, decide from the start which zone the MQTT broker lives in, which clients may connect from outside and how access rules are defined. Use the model as a way of thinking rather than a rigid rule.
Common mistakes
- Enabling “block” rules straight away without monitoring first and stopping production.
- Mistaking VLAN separation for segmentation; without a firewall inspecting inter-VLAN traffic the separation is only cosmetic.
- Leaving temporarily opened remote access rules in place permanently.
- Not defining rule documentation and ownership.
Platforms such as Industrial Defender ASM provide asset visibility and configuration tracking by safely collecting existing data from control systems, which helps put segmentation on the right foundations. To plan your program together, see our OT/ICS cybersecurity page.
