Architecture
Industrial DMZ
Ensure no traffic passes directly between the enterprise and control environments.
Defensive guide
Why should I care?
A DMZ gives you one controlled place to inspect, terminate and log everything crossing the boundary.
How to implement it
- Place brokered services in the DMZ: historian replica, patch distribution, remote access, file exchange
- Terminate sessions on both sides — nothing traverses end to end
- Keep DMZ hosts out of the enterprise domain
What good looks like
- Enterprise users consume OT data from a replica
- No protocol crosses untouched
- Full boundary logging
Common failure modes
- Firewall rules that let a flow pass through the DMZ
- DMZ hosts trusted by both sides equally
How to verify it
- Trace each enterprise-consumed data flow and confirm it terminates in the DMZ