Skip to main content

Pro audit program · v1.0

OT Network Segmentation & DMZ

The Purdue model still matters. Quick check on the boundary between IT and OT, the OT DMZ, and what crosses it.

  • General target area
  • ISA/IEC 62443 framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

The Purdue model still matters. Quick check on the boundary between IT and OT, the OT DMZ, and what crosses it.

Risks addressed

  • Critical Ransomware on IT side propagates to OT
  • High OT engineers bridge networks with a laptop
  • Critical Vendors connect direct to PLCs / HMIs from corporate VPN

Controls (6)

  1. IT / OT boundary firewall with explicit allowlist

    Critical

    IT / OT boundary firewall with explicit allowlist

    How to test + evidence

    Testing procedure: Firewall rules list documented; default-deny between IT and OT zones.

    Evidence to collect: Firewall rules export.

  2. Industrial DMZ between IT and OT

    Critical

    Industrial DMZ between IT and OT

    How to test + evidence

    Testing procedure: Historian / Jump host / Update server live in the IDMZ, not directly inside OT.

    Evidence to collect: Network diagram.

  3. No direct internet egress from OT networks

    Critical

    No direct internet egress from OT networks

    How to test + evidence

    Testing procedure: OT zones cannot reach the internet directly; only via brokered services.

    Evidence to collect: Egress rule export.

  4. No dual-homed laptops or "swing" devices

    High

    No dual-homed laptops or "swing" devices

    How to test + evidence

    Testing procedure: Engineering laptops connect to OT OR IT, never both. Enforce with NAC.

    Evidence to collect: NAC policy + audit log.

  5. Vendor remote access via jump host + MFA

    Critical

    Vendor remote access via jump host + MFA

    How to test + evidence

    Testing procedure: Vendors connect to a brokered jump host with session recording, MFA, time-limited tickets.

    Evidence to collect: Remote-access platform config.

  6. Inter-zone communications logged

    High

    Inter-zone communications logged

    How to test + evidence

    Testing procedure: Boundary firewall + IDMZ flows mirrored to SIEM (or OT-specific monitoring).

    Evidence to collect: SIEM source inventory.