Network Segmentation

Network segmentation is the practice of dividing a computer network into smaller, isolated sections (segments) with controlled communication between them.

Its primary objectives are to:

Improve cybersecurity
Limit the spread of cyber attacks
Reduce the attack surface
Improve network performance
Simplify network management
Protect critical Industrial Automation and Control Systems (IACS)

Each segment has its own security rules and access controls, allowing only authorised communication between networks.

Why Network Segmentation is Important

Without Segmentation

Malware can spread freely across the network.
An attacker gaining access to one device may gain access to the entire network.
IT incidents can impact operational technology (OT) systems.
Critical industrial processes become vulnerable to corporate network threats.

With Segmentation

Incidents are contained within a single segment.
Critical systems remain isolated.
Only authorised traffic is allowed.
Defence-in-depth is strengthened.

IT and OT Separation

Industrial control systems should not be directly connected to the corporate IT network. Instead, the OT network should be isolated behind a dedicated industrial firewall.

Corporate Network (IT)
      │
  Firewall
      │
Industrial Network (OT)

This creates a secure boundary between:

Enterprise systems
Plant floor equipment

Firewalls vs Routers

Firewalls

Firewalls are designed to enforce security policies.

Capabilities include:

Packet inspection
Stateful inspection
Deep packet inspection (DPI)
Access control
Threat detection
Traffic filtering
Logging and monitoring

Firewalls are essential for controlling communication between network segments.

Routers

Routers are designed primarily for forwarding network traffic. Although many modern routers include basic firewall features, routing is their primary function.

Typical router capabilities:

Route traffic between networks
Forward packets
Support VLANs
Perform Network Address Translation (NAT)

Limitations compared to dedicated firewalls:

Limited threat detection
Limited traffic inspection
Limited application awareness
Not intended as the primary security boundary for industrial networks

For OT security, routers should not replace dedicated industrial firewalls.

Demilitarized Zone (DMZ)

A Demilitarized Zone (DMZ) is a secure buffer network positioned between the corporate IT network and the industrial control system (ICS/IACS) network. Its purpose is to allow controlled communication without permitting direct connectivity between IT and OT.

Corporate Network
      │
  Firewall
      │
      DMZ
      │
  Firewall
      │
Industrial Network

Purpose of the DMZ

The DMZ:

Prevents direct IT-to-OT communication
Reduces exposure of industrial assets
Provides a secure exchange point
Enables monitoring of traffic crossing security boundaries
Supports defence-in-depth

Typical Systems Located in a DMZ

Common services include:

Historians
Patch management servers
Antivirus update servers
Backup servers
Jump servers
Remote access gateways
OPC gateways
Data replication servers
Authentication proxies

These systems communicate with both IT and OT, but only through tightly controlled firewall rules.

DMZ Communication Rules

Communication should occur only between:

Corporate Network ↔ DMZ
DMZ ↔ IACS Network

Direct communication between:

Corporate Network ↔ IACS Network

should not be permitted.

Every permitted connection should be:

Explicitly authorised
Restricted to required ports and protocols
Logged
Monitored
Periodically reviewed

Three-Tier Architecture

A common industrial architecture consists of three security zones:

Enterprise Network
      │
  Firewall
      │
      DMZ
      │
  Firewall
      │
Industrial Control System

Benefits include:

Multiple security boundaries
Reduced attack surface
Easier monitoring
Stronger defence-in-depth
Better containment of security incidents

Attackers must bypass multiple independent security layers before reaching critical control systems.

One Firewall or Two?

Single Firewall Architecture

Suitable when:

The environment is small
The DMZ contains few services
Budget is limited
Simplicity is important

Requirements:

Well-designed firewall policies
Strict rule management
Strong change control
Continuous monitoring

Dual Firewall Architecture

Recommended when:

Higher security assurance is required
Multiple DMZ services exist
Separation of duties is desired
Defence-in-depth is a priority
Regulatory compliance demands stronger isolation

Advantages:

Independent security boundaries
Reduced single point of failure
Better isolation of the DMZ
More granular security controls
Increased resilience against firewall compromise

Security Best Practices

Segment networks based on function and risk.
Separate IT and OT environments.
Use industrial firewalls to control communication.
Implement a DMZ for systems requiring both IT and OT connectivity.
Deny all traffic by default and allow only required communications.
Monitor and log all inter-network traffic.
Regularly review firewall rules and access permissions.
Apply the principle of least privilege.
Design for defence-in-depth using multiple security layers.

Key Takeaways

Network segmentation isolates critical assets and limits cyber attack propagation.
Dedicated firewalls—not routers—should enforce security between network segments.
A DMZ provides a secure intermediary for communications between IT and OT.
Direct communication between enterprise and industrial networks should be avoided.
Three-tier architectures strengthen defence-in-depth by introducing multiple security boundaries.
Dual-firewall DMZ designs provide greater assurance and resilience for high-security industrial environments.

Standards References

ISA/IEC 62443-3-2 – Security Risk Assessment and System Design (zones and conduits).
ISA/IEC 62443-3-3 – System Security Requirements and Security Levels.
ISA/IEC 62443-2-1 – IACS Security Program Requirements (network architecture and segmentation practices).
ISA/IEC 62443-1-1 – Concepts and Models (defence-in-depth, zones and conduits).