Segmentation, Zones and Conduits, and the Industrial Demilitarized Zone

If you cannot harden the endpoints, you harden the space between them. Segmentation is the primary control in OT because it works without touching the fragile controllers themselves. The reference model is the layered architecture that industrial engineers have used for decades to organize a plant into levels, from the physical process at the bottom to enterprise business systems at the top. The controllers and sensors sit at the lowest levels, the supervisory and control systems above them, and the corporate network above that. The security principle is simple to state and hard to execute: traffic should flow between adjacent levels through controlled chokepoints, never leap from the enterprise straight to a controller.

Between the enterprise levels and the control levels sits the most important structure in the whole design, the industrial demilitarized zone. The industrial demilitarized zone is a buffer network where data from the plant is published for the business to consume, so that no enterprise device ever talks directly to a control device. A historian server in the demilitarized zone collects process data from the control network and serves it upward; a patch-staging server receives updates from the enterprise and holds them for controlled deployment downward. The rule that gives the buffer its value is absolute: no protocol traverses the demilitarized zone unbroken. Every flow terminates on a broker inside the zone and a fresh session begins on the far side. An attacker who lands in the enterprise finds no straight path to the controllers because the path was deliberately severed.

Below the buffer, the control network is carved into zones and conduits. A zone groups assets that share a trust level and a function: the chiller-plant controllers form one zone, the electrical-switchgear controllers another, the building-management field devices a third. A conduit is the sole, controlled communication path between two zones, and every conduit is a place to enforce policy and inspect traffic. The discipline is to make zones small and conduits few. A flat control network where every device can reach every other device is the failure mode: a single compromised sensor gateway becomes a launch point to the entire plant. Micro-segmentation shrinks that blast radius. When the cooling-control zone cannot address the electrical zone, an intruder who takes the first cannot pivot to the second without crossing a conduit you are watching.

Enforcement uses several instruments layered together. Firewalls between zones permit only the specific protocols and endpoints each conduit requires, and an OT-aware firewall can filter at the level of individual industrial function codes, allowing a read while denying a write. Data diodes give the strongest guarantee where the direction of data is fixed: a diode is hardware that physically permits traffic in one direction only, so a monitoring feed can leave a critical zone while nothing, by physics rather than configuration, can enter it. Diodes are the right control for exporting telemetry from the most sensitive electrical and safety systems. Where a diode is too rigid, a tightly ruled firewall with unidirectional intent is the compromise.

Remote access is the conduit that deserves the most suspicion because it is the one most often abused. Vendors need to service their equipment, and the lazy answer is a persistent connection from a vendor's network into the plant. That standing path is exactly what an attacker wants, and vendor remote access has been the initial vector in real intrusions. The disciplined pattern brokers every session through a jump host inside the demilitarized zone, requires strong multi-factor authentication, grants access to one zone for one window, records the session, and closes the path when the work is done. Access is granted, used, and revoked; it never simply exists.

The engineering-workstation problem sits underneath all of this. The workstation an engineer uses to program a controller is the most dangerous machine in the facility, because it holds the software that can rewrite controller logic. Compromise that workstation and segmentation downstream barely matters, because the attacker now speaks as the trusted programmer. So the engineering workstation belongs in its own tightly controlled zone, is never used for email or web browsing, and reaches controllers only through logged conduits. Segmentation is not a diagram you draw once. It is a set of enforced boundaries you design around the assumption that any single node can fall, arranged so that no single fall reaches the machinery that moves power and heat.