--- title: "OT Network Segmentation, Patterns and Failure Modes" description: "How to segment an OT network in line with IEC 62443 and the Purdue Model: zones and conduits, the industrial DMZ at Level 3.5, unidirectional gateways and…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/ot-network-segmentation#webpage", "url": "https://fire-vault.com/learn/ot-network-segmentation", "name": "OT Network Segmentation, Patterns and Failure Modes", "description": "How to segment an OT network in line with IEC 62443 and the Purdue Model: zones and conduits, the industrial DMZ at Level 3.5, unidirectional gateways and…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/ot-network-segmentation#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/ot-network-segmentation#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "OT Network Segmentation, Patterns and Failure Modes", "item": "https://fire-vault.com/learn/ot-network-segmentation" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "OT Network Segmentation, Patterns and Failure Modes", "author": { "@type": "Person", "name": "Mark Fermor" }, "publisher": { "@type": "Organization", "name": "Firevault" }, "mainEntityOfPage": "/learn/ot-network-segmentation" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is OT network segmentation?", "acceptedAnswer": { "@type": "Answer", "text": "OT network segmentation is the practice of dividing an operational technology estate into zones with controlled connections between them, so that a compromise in one zone does not propagate to the rest. In IEC 62443 terms, zones are groups of assets with common security requirements and conduits are the enforced connections between them. Zones typically align to Purdue levels." } }, { "@type": "Question", "name": "How does OT segmentation differ from IT segmentation?", "acceptedAnswer": { "@type": "Answer", "text": "IT segmentation is driven by data confidentiality and least privilege. OT segmentation is driven by safety and availability: the goal is to keep a compromise in one zone from stopping the plant or endangering an operator. That is why OT segmentation places heavy emphasis on the Level 3.5 boundary and on Layer 1 isolation for the gold copy, patterns that IT segmentation rarely needs." } }, { "@type": "Question", "name": "What is the industrial DMZ (Level 3.5)?", "acceptedAnswer": { "@type": "Answer", "text": "The industrial DMZ is Level 3.5 of the Purdue Model, a dedicated zone between site operations (Level 3) and enterprise IT (Level 4 and above). It hosts jump servers, patch mirrors, published historians and the offline gold copy. Nothing at Level 3 or below talks directly to Level 4 or above; every conversation is brokered through Level 3.5." } }, { "@type": "Question", "name": "Are firewalls enough for OT segmentation?", "acceptedAnswer": { "@type": "Answer", "text": "Firewalls are the baseline for zone boundaries, but they are not sufficient for the highest-value boundaries. Regulated sectors use unidirectional gateways for OT to IT publication, and a physical air gap for the offline gold copy. Both patterns survive when a firewall rule is misconfigured or when the identity domain that manages the firewall is compromised." } }, { "@type": "Question", "name": "What is a unidirectional gateway?", "acceptedAnswer": { "@type": "Answer", "text": "A unidirectional gateway (sometimes called a data diode) is a hardware device that allows data to flow in one direction only. It is used to publish OT data to IT without opening a return path. Regulated utilities and some NIS2 sectors require unidirectional gateways for specific flows because software firewalls can be misconfigured, but the hardware cannot pass traffic the other way." } }, { "@type": "Question", "name": "How does a physical air gap fit into OT segmentation?", "acceptedAnswer": { "@type": "Answer", "text": "A physical air gap is the boundary of last resort for the offline gold copy. It is not a general-purpose segmentation pattern, it is specifically for the copy the estate needs after every other control has failed. Firevault provides this at Level 3.5 or in a dedicated bunker, with the connection windows switched out of band and logged on a separate management plane." } }, { "@type": "Question", "name": "Does OT segmentation appear in IEC 62443?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. IEC 62443-3-2 is the risk assessment and zone/conduit design part of the standard, and it requires zones and conduits to be defined with security level targets. IEC 62443-3-3 then defines the technical requirements each zone must meet. Purdue levels are the usual starting point for the zone definitions." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Why OSS # OT Network Segmentation, Patterns and Failure Modes Zone and conduit design in line with IEC 62443, the industrial DMZ at Level 3.5, unidirectional gateways for one-way flows, and a physical air gap for the copy that must survive when the rest is touched. Book a demo ![Corridor of offline storage racks inside a Firevault bunker](/assets/hero-square-bunker-BC9Flanh.jpg) R6.2 The four patterns that hold up ## Zones, Conduits, Diodes and a Physical Air Gap The segmentation patterns that survive contact with a real ransomware operator, ordered by strength. 01 IEC 62443 baseline ### Zone and conduit segmentation Group assets that share security requirements into zones, then define every allowed connection between zones as an explicit conduit with a security level target. Zones map cleanly on to Purdue levels; conduits are enforced by firewalls, ACLs and, for the highest boundaries, protocol breaks. - Zones map to Purdue levels - Conduits are explicit, not implicit - Security level per conduit 02 The enforced OT/IT boundary ### Industrial DMZ at Level 3.5 Level 3.5 is not a firewall rule between VLANs, it is a dedicated zone with its own hosts, its own identity domain and its own change process. Jump servers, patch mirrors, published historians and the Firevault gold copy live here. Nothing at Level 3 or below talks directly to Level 4 or above. - Dedicated hosts, dedicated identity - Jump servers and patch mirrors - Firevault gold copy at 3.5 03 Data diodes for one-way flows ### Unidirectional gateways Where OT must publish data to IT (historian data to a cloud analytics platform, for example) a unidirectional gateway enforces one-way flow at the hardware level. The IT side receives, the OT side has no return path. This is standard practice for regulated utilities and increasingly required by NIS2. - Hardware-enforced one-way - Historian publish patterns - Required by NIS2 for some sectors 04 Layer 1 isolation, not VLAN ### Physical air gap for the gold copy For the offline gold copy, Layer 1 isolation is the only pattern that survives when segmentation is misconfigured, when identity is compromised or when the backup platform itself is targeted. Firevault provides this at Level 3.5 or in a dedicated bunker, with connection windows switched out of band. - No live network interface - Out-of-band connection windows - Tamper evident event log Where segmentation actually breaks ## Three Failure Modes We See Every Assessment Segmentation on the diagram is not segmentation in practice. These are the patterns that turn a segmented estate back into a flat one. 01 The dominant legacy pattern ### Flat OT VLANs behind a single firewall Many industrial estates still run a single flat VLAN for the plant behind one perimeter firewall. Once an attacker gets past that firewall, every controller and historian is reachable. Segmentation between Purdue levels breaks this pattern; a physical air gap for the gold copy guarantees a survivable copy regardless. - Single perimeter, flat inside - One compromise, full plant reach - No lateral controls 02 Domain admin owns both ### Shared identity across L4 and L3.5 Placing the industrial DMZ inside the same Active Directory domain as corporate IT means a phished domain admin has authority on both sides. The segmentation firewall is not the boundary any more; the identity domain is. Real Level 3.5 isolation requires its own identity plane. - Same AD forest as corporate - Domain admin bypasses firewall - Identity is the real boundary 03 Immutable, but still on the wire ### Backup platform reachable from IT Running the OT backup platform as VMs on the corporate hypervisor, or as an appliance dual-homed into the corporate LAN, undoes segmentation regardless of Object Lock or immutability. The management plane is reachable, and a management-plane compromise weakens retention before ransomware runs. - Dual-homed appliances - Corporate hypervisor guests - Management plane exposure Build checklist ## Ten Checks for an OT Segmentation Design Use this list to review a proposed OT segmentation design before it goes into production. - Zones defined against Purdue levels, with a written security level target per zone - Every conduit between zones documented, with source, destination, protocol and enforcement - Industrial DMZ (Level 3.5) hosts sit in a dedicated identity domain, not the corporate forest - No system at Level 3 or below has a route to Level 4 or above except through Level 3.5 - Backup and recovery platforms live in the OT identity plane, not the corporate one - Unidirectional gateways used for any required OT to IT data flow that carries value - Physical air gap for the gold copy, at Level 3.5 or in a dedicated bunker - Connection windows to the offline copy switched out of band and logged separately - Annual restore test across the Level 3.5 boundary, results captured for audit - Segmentation reviewed after every change to the corporate identity domain Continue with the Purdue pillar, the diagram reference and the physical air-gap guide. [The Purdue Model for OT/ICS security](/learn/purdue-model-ot-ics-security) [Purdue Model diagram](/learn/purdue-model-diagram) [Physical air gap for ransomware protection](/learn/physical-air-gap-ransomware-protection) [OT and ICS security pillar](/learn/ot-ics-security-air-gap-storage) Questions ## OT Segmentation, Common Questions Straight answers on how Offline Secure Storage® behaves in practice. ### What is OT network segmentation? ### How does OT segmentation differ from IT segmentation? ### What is the industrial DMZ (Level 3.5)? ### Are firewalls enough for OT segmentation? ### What is a unidirectional gateway? ### How does a physical air gap fit into OT segmentation? ### Does OT segmentation appear in IEC 62443? ![Mark Fermor](/assets/mark-fermor-C-vy1NeN.jpg) ![David Bailey](/assets/david-bailey-CnLw95Ao.jpg) ![Kenny Phipps](/assets/kenny-phipps-DxIqwaIL.jpg) Online Now Concierge ## Add a Layer 1 air gap to your segmentation design Talk to the Firevault team about placing a physical air-gapped gold copy at Level 3.5 or in a dedicated bunker, so the copy survives when segmentation does not. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up