domains / families / security / implementing-network-segmentation-for-ot

implementing-network-segmentation-for-ot

separate

'Implements OT network segmentation using VLANs, OT-aware firewalls, data diodes,

When to use

• When an OT security assessment reveals a flat network with no segmentation between Purdue levels
• When implementing IEC 62443 zone/conduit architecture after completing risk assessment (IEC 62443-3-2)
• When separating IT and OT networks as part of an IT/OT convergence security initiative
• When deploying a DMZ between corporate IT and OT to protect industrial systems from IT-originating threats
• When segmenting safety instrumented systems (SIS) from basic process control systems (BPCS)

When not to use

• IT-only microsegmentation without OT components
• initial zone design without prior traffic analysis

Skill page

Source