A flat plant network lets one infected laptop reach every PLC on site within minutes. Segmentation breaks that path into controlled zones, and this guide shows how to plan it with IEC 62443, real firewall rules and a simple rule count calculator.
OT network segmentation splits a plant network into zones that talk only through controlled conduits. We cover a step plan, IEC 62443 3 2, Purdue levels, rule examples, the DMZ and common mistakes.
What Is OT Network Segmentation?
OT network segmentation is the practice of dividing an industrial control network into zones of assets with similar security needs, and allowing traffic between zones only through controlled conduits such as firewalls. It limits how far an attacker or a fault can spread, so a problem in one area does not stop the whole plant.
- Start with a full asset inventory and a map of real traffic flows
- Group assets into zones and define conduits as in IEC 62443 3 2
- Place an industrial DMZ between the IT and OT networks
- Allow only listed flows and deny everything else by default
- Review rules and zones after every change to the plant network
This page is a practical companion to our comparison of air gapped vs segmented ICS networks. Here we focus on how to actually design and roll out OT network segmentation in a running plant.
How to Segment an OT Network
Segmentation is a project, not a single firewall purchase. The step plan below works for both new plants and running sites where downtime must be kept to a minimum.
The first step is often the hardest, and our OT asset inventory guide shows how to collect the data without disturbing the process. Passive monitoring from an OT intrusion detection system also gives you the traffic map.
Run new firewall rules in log only mode for at least one full production cycle before you block anything. Batch jobs, monthly reports and backup tasks often use flows nobody remembers.
Zones and Conduits in IEC 62443 3 2
IEC 62443 3 2 gives the risk based method for partitioning a system into zones and conduits. The OWASP OT Top 10 project summarises it in seven steps, shown below.
Each zone and conduit gets a target security level from SL 1 to SL 4. CIMA+ notes that the risk of each zone is set with a probability and impact matrix, and the details are in our page on IEC 62443 zones and conduits.
Protection against casual or accidental violation.
Protection against intentional attack with simple means and low resources.
Protection against sophisticated attack with moderate resources.
Protection against sophisticated attack with extended resources.
Purdue Levels and OT Network Segmentation
The Purdue model gives a simple starting map for zones, even though IEC 62443 does not require it. Most plants draw their first OT network segmentation along these levels, as explained in Purdue model for ICS cybersecurity.
| Level | Typical assets | Segmentation note |
|---|---|---|
| Level 4 and 5 | Business IT, ERP, email, internet | Never talks directly to Level 2 or below |
| Level 3.5 | Industrial DMZ, patch server, historian replica | Only path between IT and OT |
| Level 3 | Site historian, MES, domain controller for OT | Its own zone with a firewall to Level 2 |
| Level 2 | HMI, SCADA servers, engineering stations | One zone per area or process unit |
| Level 1 | PLCs, DCS controllers, safety controllers | Safety system in a separate zone |
| Level 0 | Sensors, drives, actuators | Reached only through Level 1 |
NIST SP 800 82 Revision 3, published in September 2023, recommends a DMZ network architecture with firewalls so that traffic does not pass directly between corporate and OT networks. It also lists unidirectional gateways as an option.
Firewall Rules for OT Network Segmentation
Each conduit becomes a short list of allow rules, with a deny all rule at the end. Write each rule with a source, destination, protocol, port, direction and a named owner who can explain why it exists.
| Source | Destination | Protocol and port | Action |
|---|---|---|---|
| Level 3 historian | Level 2 SCADA server | OPC UA, TCP 4840 | Allow |
| Engineering station | PLC zone | EtherNet/IP, TCP 44818 | Allow, logged |
| SCADA server | Modbus devices | Modbus TCP, TCP 502 | Allow |
| SCADA server | Siemens PLC zone | S7comm, TCP 102 | Allow |
| DMZ historian replica | Level 3 historian | Vendor replication port | Allow, one way |
| IT network | Any OT zone | Any | Deny and alert |
| Any | Any | Any | Deny, default rule |
A plain port based rule cannot tell a read from a write. An industrial firewall with deep packet inspection can allow Modbus reads but block writes, which suits conduits into safety or utility zones.
VLAN vs Physical Segmentation
A VLAN splits one switch into several logical networks, while physical segmentation uses separate switches and cables. Both can work for OT network segmentation, but VLANs only separate traffic, and a router or firewall still has to control what crosses between them.
- Low cost on existing managed switches
- Fast to change during a project
- Good inside one zone or one cabinet
- A switch misconfiguration can join zones
- Offers no filtering without a firewall
- Not enough alone for a safety system boundary
NIST SP 800 82 asks designers to consider where physical separation is needed instead of logical separation. Our page on subnet and VLAN differences explains the basics, and network switches for SCADA and DCS covers switch selection.
The OWASP OT Top 10 project points out that most entry into OT zones comes from IT environments. That is why the boundary between Level 3 and Level 4 deserves the strongest controls in the plant.
The Industrial DMZ
The DMZ sits between IT and OT and holds the only servers both sides may reach, such as a historian replica, patch server and remote access jump host. EPA guidance for water utilities also asks that OT and IT connections pass through an intermediary such as a firewall, jump box or DMZ.
The design is covered in detail in industrial DMZ at Level 3.5. Where data only needs to leave the plant, a data diode gives one way transfer in hardware.
Firewall Rule Count Calculator
A quick rule estimate helps plan firewall sizing and the yearly review effort. The formula counts one allow rule per flow on each conduit plus one default deny rule per zone.
Review hours = rules × minutes per rule ÷ 60
Take a plant with 6 zones, 8 conduits, 5 allowed flows per conduit and 10 minutes to review each rule.
Review = 46 × 10 ÷ 60 = 7.7 hours
If the rule count grows much faster than the number of conduits, your flows are probably too broad or duplicated. Merge rules only when the source, destination and protocol truly match.
Common OT Network Segmentation Mistakes
The OWASP OT Top 10 lists broken zone and conduit design as a key risk, and notes that many plant networks are still flat. The table below turns its findings into field checks.
| Mistake | Why it hurts | Fix |
|---|---|---|
| No DMZ between IT and OT | Direct paths from office PCs to controllers | Add a Level 3.5 DMZ with two firewalls or a three leg firewall |
| Broad rules across whole subnets | Any host can reach any PLC | Write per host rules with exact ports |
| Dual homed or multi homed PCs | Bypass the firewall between zones | Remove the second network card or move it into a conduit |
| Forgotten vendor remote access | Hidden conduit with no control | Route all remote access through a DMZ jump host with MFA |
| DNS and email allowed inside OT | Hidden command and control channel | Block unneeded protocols at zone edges |
| No review after changes | Old rules stay open for years | Review rules yearly and after every project |
Vendor links are the most common gap, so follow the controls in PLC remote access security. A zero trust approach can then tighten access inside each zone.
Label every firewall rule with a change ticket number. When a rule has no ticket and no owner during review, disable it in log mode first and remove it if nothing breaks.
Teams new to this subject can start with our list of free OT cybersecurity training courses before a design workshop.
- Asset inventory complete and owned
- Traffic map captured for a full production cycle
- Zones and conduits drawn and approved
- DMZ in place between IT and OT
- Default deny rule on every conduit
- Remote access through a jump host with MFA
- Rule review dates in the maintenance plan
Segmentation also makes patching and recovery easier, because you can work on one zone at a time, as shown in OT patch management.
OT Network Segmentation FAQ
OT network segmentation divides an industrial network into zones of assets with similar security needs. Traffic between zones passes only through controlled conduits such as firewalls.
This limits how far malware or a mistake can spread across the plant. It also makes monitoring easier, because each conduit carries only a short list of known flows.
Segmentation splits a network into smaller parts, often with VLANs and subnets. Segregation adds rules that control and restrict the traffic allowed to flow between those parts.
In practice OT engineers use both terms together, since segments without any filtering give very little protection. NIST SP 800 82 talks about segmentation and separation as one set of practices.
A VLAN separates traffic logically, but it does not filter what crosses between networks. Without a firewall or router access list, a VLAN offers little security on its own.
VLANs work well inside a zone or to split traffic types. Critical boundaries, such as the safety system zone, are better served by a firewall and sometimes separate switches.
A zone is a group of assets that share the same security requirements, such as all controllers of one process unit. A conduit is the controlled communication path between two zones.
IEC 62443 3 2 gives the risk based method to define them. Each zone and conduit then gets a target security level from SL 1 to SL 4.
The industrial DMZ sits between the business network and the plant network, often called Level 3.5 in the Purdue model. It holds shared servers such as a historian replica and patch server.
No traffic should pass straight from IT to OT through this middle zone. Each side talks only to the servers in the middle, and a firewall controls both sides.
Related Articles
- Air Gapped vs Segmented ICS Networks
- IEC 62443 Zones and Conduits
- Purdue Model for ICS Cybersecurity
- Industrial DMZ Between IT and OT
- OT vs IT Security Differences
External References
- NIST SP 800 82 Revision 3: Guide to OT Security
- OWASP OT Top 10: Broken Zones and Conduits Design
- Wikipedia: IEC 62443
What We Learn Today
- OT network segmentation starts with an asset inventory and a traffic map, then groups assets into zones joined by controlled conduits.
- IEC 62443 3 2 gives a seven step risk method, and each zone and conduit receives a target security level from SL 1 to SL 4.
- Use a DMZ between IT and OT, default deny rules, firewalls at zone edges and yearly reviews, since VLANs alone do not filter traffic.
