Skip to main content

Pro audit program · v1.0

OT Network Segmentation & DMZ

The Purdue model still matters. Quick check on the boundary between IT and OT, the OT DMZ, and what crosses it.

  • General target area
  • ISA/IEC 62443 framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

The Purdue model still matters. Quick check on the boundary between IT and OT, the OT DMZ, and what crosses it.

Risks addressed

  • Critical Ransomware on IT side propagates to OT
  • High OT engineers bridge networks with a laptop
  • Critical Vendors connect direct to PLCs / HMIs from corporate VPN

Controls (6)

  1. IT / OT boundary firewall with explicit allowlist

    Critical

    This control enforces network segmentation between Information Technology (IT) and Operational Technology (OT) environments using a dedicated firewall configured with an explicit allowlist (default-deny) ruleset. All traffic crossing the IT/OT boundary must be explicitly permitted based on documented business justification,…

    How to test + evidence

    Testing procedure: Firewall rules list documented; default-deny between IT and OT zones.

    Evidence to collect: Firewall rules export.

  2. Industrial DMZ between IT and OT

    Critical

    An Industrial Demilitarized Zone (DMZ) is a network segmentation architecture that establishes a controlled buffer zone between corporate IT networks and operational technology (OT) environments. This architecture typically consists of dual firewalls or similar boundary protection devices creating an intermediary…

    How to test + evidence

    Testing procedure: Historian / Jump host / Update server live in the IDMZ, not directly inside OT.

    Evidence to collect: Network diagram.

  3. No direct internet egress from OT networks

    Critical

    This control enforces network segmentation by prohibiting operational technology (OT) devices from establishing direct outbound connections to the internet. All internet-bound traffic from OT networks must traverse controlled security zones with inspection, logging, and policy enforcement capabilities such as demilitarized…

    How to test + evidence

    Testing procedure: OT zones cannot reach the internet directly; only via brokered services.

    Evidence to collect: Egress rule export.

  4. No dual-homed laptops or "swing" devices

    High

    This control prohibits endpoints from simultaneously connecting to both trusted corporate networks and untrusted external networks (e.g., connecting via VPN while also connected to a public Wi-Fi hotspot). Dual-homed configurations create network bridging risks where an attacker on the untrusted…

    How to test + evidence

    Testing procedure: Engineering laptops connect to OT OR IT, never both. Enforce with NAC.

    Evidence to collect: NAC policy + audit log.

  5. Vendor remote access via jump host + MFA

    Critical

    This control requires that all vendor or third-party remote access to internal systems be routed exclusively through a dedicated jump host (bastion host) with multi-factor authentication enforced at the point of entry. The jump host serves as a hardened, monitored…

    How to test + evidence

    Testing procedure: Vendors connect to a brokered jump host with session recording, MFA, time-limited tickets.

    Evidence to collect: Remote-access platform config.

  6. Inter-zone communications logged

    High

    Inter-zone communications logging captures and records network traffic that crosses defined security boundaries or zones within a network architecture (e.g., DMZ to internal, trust to untrust, production to development). This control requires firewall, router, or next-generation firewall (NGFW) devices to…

    How to test + evidence

    Testing procedure: Boundary firewall + IDMZ flows mirrored to SIEM (or OT-specific monitoring).

    Evidence to collect: SIEM source inventory.