Architecture
Segmentation
Segmentation is staged work, not a weekend project. Each stage should reduce reachable attack surface without changing process behaviour.
1. Separate IT from OT
- Establish a single, deliberately designed boundary with deny-by-default rules on both sides
- Terminate every session in the DMZ; no protocol passes straight through
- Replicate historian data outward instead of letting business systems query the control zone
- Remove enterprise domain trusts into OT and stand up independent OT identity services
2. Define zones by consequence
- Group assets that share a function, criticality and trust level — not by IP convenience
- Keep safety systems in their own zone with the tightest conduit set of all
- Separate each production line, unit or substation so a failure in one does not travel
- Document owner, purpose, criticality and allowed peers per zone
3. Control the conduits
- Every allowed flow states source, destination, protocol, direction and reason
- Prefer unidirectional or brokered data flows outward from the process
- Restrict engineering and programming traffic to named hosts during named windows
- Review rules on a fixed cadence and delete anything nobody can justify
4. Reduce east-west movement
- Block controller-to-controller traffic that the process does not require
- Restrict management protocols (RDP, SSH, SMB, WMI) inside the control zone
- Isolate engineering workstations from general-purpose networks and services
- Use host firewalls and switch ACLs where a firewall would add unacceptable latency
Why should I care?
Ransomware in the enterprise repeatedly becomes an operational shutdown because the boundary was theoretical. Segmentation is the difference between a bad IT week and a stopped plant.
How to do it safely
- Baseline flows passively for a full production cycle, including turnaround and startup traffic
- Deploy firewalls in monitor/permit mode first and study what would have been denied
- Change rules in maintenance windows with operations and engineering present
- Have a tested rollback for every rule change, and a named person who can execute it
Failure modes
- Any-any rules added during commissioning and never removed
- A DMZ that exists on the diagram but is bypassed by one legacy flow
- Segmentation without monitoring — you cannot tell whether the rules hold
- Blocking a flow that carried an unnoticed dependency, such as time sync or licence checks