OT Network Segmentation, Patterns and Failure Modes
Zone and conduit design in line with IEC 62443, the industrial DMZ at Level 3.5, unidirectional gateways for one-way flows, and a physical air gap for the copy that must survive when the rest is touched.
Zones, Conduits, Diodes and a Physical Air Gap
The segmentation patterns that survive contact with a real ransomware operator, ordered by strength.
Zone and conduit segmentation
Group assets that share security requirements into zones, then define every allowed connection between zones as an explicit conduit with a security level target. Zones map cleanly on to Purdue levels; conduits are enforced by firewalls, ACLs and, for the highest boundaries, protocol breaks.
- Zones map to Purdue levels
- Conduits are explicit, not implicit
- Security level per conduit
Industrial DMZ at Level 3.5
Level 3.5 is not a firewall rule between VLANs, it is a dedicated zone with its own hosts, its own identity domain and its own change process. Jump servers, patch mirrors, published historians and the Firevault gold copy live here. Nothing at Level 3 or below talks directly to Level 4 or above.
- Dedicated hosts, dedicated identity
- Jump servers and patch mirrors
- Firevault gold copy at 3.5
Unidirectional gateways
Where OT must publish data to IT (historian data to a cloud analytics platform, for example) a unidirectional gateway enforces one-way flow at the hardware level. The IT side receives, the OT side has no return path. This is standard practice for regulated utilities and increasingly required by NIS2.
- Hardware-enforced one-way
- Historian publish patterns
- Required by NIS2 for some sectors
Physical air gap for the gold copy
For the offline gold copy, Layer 1 isolation is the only pattern that survives when segmentation is misconfigured, when identity is compromised or when the backup platform itself is targeted. Firevault provides this at Level 3.5 or in a dedicated bunker, with connection windows switched out of band.
- No live network interface
- Out-of-band connection windows
- Tamper evident event log
Three Failure Modes We See Every Assessment
Segmentation on the diagram is not segmentation in practice. These are the patterns that turn a segmented estate back into a flat one.
Flat OT VLANs behind a single firewall
Many industrial estates still run a single flat VLAN for the plant behind one perimeter firewall. Once an attacker gets past that firewall, every controller and historian is reachable. Segmentation between Purdue levels breaks this pattern; a physical air gap for the gold copy guarantees a survivable copy regardless.
- Single perimeter, flat inside
- One compromise, full plant reach
- No lateral controls
Shared identity across L4 and L3.5
Placing the industrial DMZ inside the same Active Directory domain as corporate IT means a phished domain admin has authority on both sides. The segmentation firewall is not the boundary any more; the identity domain is. Real Level 3.5 isolation requires its own identity plane.
- Same AD forest as corporate
- Domain admin bypasses firewall
- Identity is the real boundary
Backup platform reachable from IT
Running the OT backup platform as VMs on the corporate hypervisor, or as an appliance dual-homed into the corporate LAN, undoes segmentation regardless of Object Lock or immutability. The management plane is reachable, and a management-plane compromise weakens retention before ransomware runs.
- Dual-homed appliances
- Corporate hypervisor guests
- Management plane exposure
Build checklist
Ten Checks for an OT Segmentation Design
Use this list to review a proposed OT segmentation design before it goes into production.
- Zones defined against Purdue levels, with a written security level target per zone
- Every conduit between zones documented, with source, destination, protocol and enforcement
- Industrial DMZ (Level 3.5) hosts sit in a dedicated identity domain, not the corporate forest
- No system at Level 3 or below has a route to Level 4 or above except through Level 3.5
- Backup and recovery platforms live in the OT identity plane, not the corporate one
- Unidirectional gateways used for any required OT to IT data flow that carries value
- Physical air gap for the gold copy, at Level 3.5 or in a dedicated bunker
- Connection windows to the offline copy switched out of band and logged separately
- Annual restore test across the Level 3.5 boundary, results captured for audit
- Segmentation reviewed after every change to the corporate identity domain
Continue with the Purdue pillar, the diagram reference and the physical air-gap guide.
OT Segmentation, Common Questions
Straight answers on how Offline Secure Storage® behaves in practice.
Add a Layer 1 air gap to your segmentation design
Talk to the Firevault team about placing a physical air-gapped gold copy at Level 3.5 or in a dedicated bunker, so the copy survives when segmentation does not.
Takes about 2 minutes. No account needed.