Why most factories lack IT/OT segmentation
Historically, OT (Operational Technology) systems operated in isolation — they were not connected to IT networks. PLC controllers communicated over dedicated serial networks, and SCADA systems ran on isolated workstations. Segmentation was unnecessary because physical separation provided security.
IT/OT convergence — driven by the need for production data access, remote diagnostics and Industry 4.0 — connected these worlds. The problem is that the connection was most often made without proper security: an Ethernet cable from an office switch to a shop floor switch.
The result? In many factories, the network is flat — a computer in HR and a PLC controller on the production line are on the same network. Ransomware initiated by phishing can reach control systems within minutes.
The Purdue model — reference architecture
The Purdue model (ISA-95/IEC 62264) defines a hierarchical industrial network architecture:
Level 0: Physical process
Sensors, actuators, valves, motors — devices directly interacting with the physical process. No IP communication capability.
Level 1: Basic control
PLC, RTU, DCS controllers — devices executing control logic in millisecond cycles. Communication via industrial protocols (Modbus, PROFINET, EtherNet/IP).
Level 2: Supervisory control
SCADA/HMI systems, engineering workstations — process visualization, parameter changes, alarms. Typically Windows with dedicated software.
Level 3: Manufacturing operations
MES (Manufacturing Execution System), batch management, historian servers — production planning and tracking.
Level 3.5: DMZ (Demilitarized Zone)
Critical layer — buffer between IT and OT. Intermediary servers, data replication, jump servers. No direct IT↔OT communication should exist here.
Level 4-5: Enterprise
Corporate networks, ERP, email, Internet. Traditional IT infrastructure.
Zones and conduits per IEC 62443
The IEC 62443 standard formalizes segmentation through zones and conduits:
Zone
A group of assets sharing a common required Security Level. Examples:
- Line 1 control zone (PLCs, HMIs for production line A)
- Line 2 control zone (PLCs, HMIs for production line B)
- Safety zone (SIS — Safety Instrumented Systems)
- DMZ zone
Conduit
A controlled communication path between zones. Each conduit has defined:
- Allowed protocols and ports
- Communication direction (e.g., OT→DMZ: yes, DMZ→OT: monitoring only)
- Control mechanisms (firewall, ACL, data diode)
- Logging and monitoring policy
OT segmentation technologies
Industrial firewalls
Dedicated firewalls understanding OT protocols:
- Deep Packet Inspection for Modbus, OPC UA, S7comm, EtherNet/IP
- Rules at OT command level (e.g., allow read, block write to PLC)
- Industrial construction (temperature, vibration, DC power)
- Vendors: Fortinet FortiGate Rugged, Palo Alto PA-220R, Cisco IE
Data diodes (Unidirectional Gateways)
Physical assurance of one-way communication:
- Data from OT to IT: yes (e.g., historian data)
- Data from IT to OT: physically impossible
- Ideal for transferring production data to ERP without reverse attack risk
- Vendors: Waterfall Security, Owl Cyber Defense
VLANs and managed switches
Basic Layer 2 segmentation:
- Separate VLANs for each Purdue zone
- Industrial managed switches (Cisco IE, Siemens SCALANCE)
- ACLs between VLANs on router/L3 switch
Microsegmentation
Granular traffic control within zones:
- Isolation of individual machines or production lines
- Per-device policies based on OT device identity
- Software-defined segmentation for environments with limited infrastructure
Common OT segmentation mistakes
1. DMZ on paper only
Many companies declare a DMZ, but in practice the historian server has interfaces in both IT and OT (dual-homed). That is not a DMZ — it is a bypass.
2. Exceptions for “convenience”
Engineers need remote access to PLCs “just for a moment” — the temporary VPN tunnel stays forever. Every segmentation exception must be documented, approved and regularly verified.
3. Flat OT network
IT/OT segmentation is not enough if everything within OT is on a single network. An attacker who passes the DMZ has access to all PLCs. Segmentation within OT is needed — between lines, between control and safety.
4. No segmentation monitoring
A firewall without monitoring is a false sense of security. Firewall rules must be monitored, and violation attempts detected and alerted.
IT/OT segmentation implementation plan
Phase 1: Audit and mapping (months 1-2)
An OT security audit includes:
- Inventory of all OT devices and their network connections
- Mapping current network topology (often undocumented)
- Identifying IT↔OT data flows (historian, ERP→MES, remote access)
- Identifying dual-homed devices and uncontrolled paths
Phase 2: Zone design (months 2-3)
- Zone definition per IEC 62443 and the Purdue model
- Required Security Level per zone
- Conduit design — allowed flows
- Segmentation technology selection per conduit
Phase 3: DMZ implementation (months 3-5)
The most important element first — separating IT from OT:
- Industrial firewall deployment at the IT/OT boundary
- Moving historian/MES to the DMZ zone
- Jump server configuration for remote access
- Monitoring mode — firewall logs but does not block (learning period)
Phase 4: Rule tightening (months 5-7)
- Analysis of learning period logs
- Gradual enabling of blocking rules
- Testing during maintenance windows
- Eliminating uncontrolled paths
Phase 5: Segmentation within OT (months 7-12)
- Separating production lines from each other
- Isolating safety systems (SIS) from the rest of OT
- Microsegmentation of critical assets
- Data diode deployment where required
Phase 6: Monitoring and maintenance
- SOC monitoring segmentation rules and violation attempts
- Regular firewall rule reviews
- Exception and remote access management
- Segmentation updates when infrastructure changes
Does your factory need IT/OT segmentation? Schedule a security audit — we will map your network, identify gaps and design IEC 62443-compliant segmentation.
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- FortiGate — Fortinet
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
