SCADA network segmentation
How to segment SCADA and other operational technology (OT) networks so that a compromise in corporate IT cannot reach the systems that control physical processes, and a compromise inside OT stays contained. For engineers, architects and security teams designing a new control network or changing an existing one.
The short version
IT and OT never connect directly. Everything that crosses between them stops in a DMZ, every path between zones allows only documented traffic, vendors come in through one controlled door, and the control network is split so that one compromised screen cannot reach every controller. In OT, availability and safety come before confidentiality: every control must fail safe and must not disrupt real-time control traffic.
On this page
The reference model
Design zones using the Purdue model, and treat the boundaries between them as ISA/IEC 62443 conduits: controlled paths that carry only approved traffic. Below, the model is drawn as a staircase: enterprise IT at the back and highest, the physical process at the front and lowest.
- L4–5Enterprise IT: business systems, email and cloud services.
- L3.5IT/OT DMZ (blue): replica historian and remote-access jump host, a firewall on each side.
- L3Site operations: the historian and site-wide operations servers.
- L2Supervisory control: HMIs and SCADA servers.
- L1Basic control: PLCs and RTUs.
- L0The process: sensors, actuators and the plant itself.
- Safety instrumented system (gold): a zone of its own beside the controllers.
- Firewalls at the IT/DMZ and DMZ/OT boundaries.
Below the DMZ, each level and each site is separated again, and safety instrumented systems sit in their own zone.
Eight principles
These eight principles govern every segmentation decision. A departure from any of them needs a documented risk acceptance.
| Principle | Rule | Why it matters |
|---|---|---|
| IT/OT DMZ | No traffic passes directly between IT and OT. Connections end in the DMZ and new ones start from it, ideally initiated from the OT side. | Removes the direct path attackers use to pivot from corporate IT into control systems. |
| Default-deny conduits | Allow only documented, justified flows between zones: specific sources, destinations, ports and protocols. Deny everything else. | Limits how far a compromise can spread, and makes unexpected traffic visible. |
| One-way flows | Use data diodes or unidirectional gateways for data that only needs to leave OT, such as historian data. | Physically prevents inbound traffic on high-assurance paths. |
| Protocol awareness | Use industrial firewalls or deep packet inspection to restrict which commands are allowed, such as reads but not writes. | Industrial protocols such as Modbus, DNP3, IEC 61850 and IEC 60870-5-104 have little or no authentication. |
| Secure remote access | Vendor and engineer access goes through MFA, a jump host in the DMZ, privileged access management with session recording, and time-limited approval. Never a direct VPN into the control network. | Remote access is the most common route attackers use to get into OT. |
| Micro-segmentation | Separate OT internally by site, function or criticality. Safety instrumented systems always sit in their own zone. | One compromised HMI cannot reach every controller. |
| Availability first | Controls fail safe, add no latency to control traffic, and change only under strict change control. Prefer passive monitoring to active scanning. | Active scans and badly timed changes can crash controllers or stop a process. |
| Visibility | Maintain an asset inventory and monitor every conduit passively, feeding alerts to the SOC. | You cannot segment or defend what you have not identified. |
The next three sections draw the principles that are easiest to get wrong.
Conduits and one-way flows
A conduit is a decision written down: this source may talk to that destination, on this port and protocol, in this direction, for this reason, and nothing else may. Where data only ever needs to leave OT, such as historian data for the business, a data diode or unidirectional gateway makes the rule physical: nothing can come back the other way, however the firewall is configured.
- OT zone: controller, HMI and historian.
- Data diode: the only opening in the firewall, and it works one way.
- Replica historian in the DMZ, which IT reads instead of the original.
- Inbound attempt from IT, refused (grey dashed line).
Every conduit needs an owner and a justification, and every firewall between zones defaults to deny. Where the risk justifies it, add protocol-aware controls that let an HMI read a value but not write one, because the industrial protocols themselves will not stop it.
Secure remote access
Remote access is the most common way attackers get into OT, usually through a vendor's VPN account. Route all vendor and engineer access through one controlled path: multi-factor authentication, a jump host in the DMZ, privileged access management with session recording, and time-limited approval. Never a direct VPN into the control network.
- Vendor or engineer, and the jump host in the DMZ.
- MFA before anything else.
- Control network: the HMI the session lands on, and the controllers behind it.
- Direct VPN into OT: not allowed (grey dashed line).
Micro-segmentation
A flat control network means one compromised HMI can reach every controller on it. Separate OT internally by site, function or criticality, with firewalls between the zones, and always give safety instrumented systems a zone of their own.
- Compromised HMI, contained in its own zone.
- Another site: its HMI and controllers, untouched.
- Safety instrumented system, in a zone of its own.
- Firewalls between the zones.
Ten steps to implement it
Implement segmentation in stages, starting with the highest-risk paths, and test every change before it reaches a live control network.
- Inventory assets and data flows. Use passive discovery to identify every OT asset, its firmware and its communication partners. Record which flows the process genuinely needs.
- Define zones. Group assets with the same security requirements and criticality into zones aligned with the reference model. Place safety instrumented systems in their own zone.
- Define conduits. Document every permitted flow between zones with its source, destination, port, protocol, direction, owner and business justification.
- Build the IT/OT DMZ. Move shared services, such as replica historians, patch and antivirus staging and remote-access jump hosts, into the DMZ so that IT and OT never connect directly.
- Enforce default-deny boundaries. Configure firewalls between zones to allow only the documented conduits. Use protocol-aware controls or one-way gateways where the risk justifies them.
- Secure remote access. Route all vendor and engineer access through MFA, a DMZ jump host and privileged access management with session recording and time-limited approval.
- Segment within OT. Separate sites, functions and criticality levels so that a compromise in one area cannot reach the rest.
- Monitor every conduit. Deploy passive OT monitoring at zone boundaries and send alerts to the SOC, so unexpected flows are detected and investigated.
- Test and change safely. Validate rule changes in a test environment or maintenance window, with operations staff present and a rollback plan ready.
- Review and maintain. Review firewall rules and remote-access accounts on a set schedule, and remove temporary vendor rules when their purpose ends.
Regulatory alignment
Segmentation is core evidence for critical infrastructure obligations in Australia.
| Framework | What it asks | Where segmentation fits |
|---|---|---|
| SOCI Act and CIRMP | A critical infrastructure risk management program must identify and mitigate cyber and information security hazards. The CIRMP Rules also require compliance with a recognised cyber security framework, such as the AESCSF, the Essential Eight, the NIST Cybersecurity Framework, the C2M2 or ISO/IEC 27001. | Documented zones, conduits and remote-access controls show that hazards to OT have been treated. See our SOCI Act guide. |
| AESCSF | The Australian Energy Sector Cyber Security Framework is the usual maturity yardstick for electricity and gas entities. | It includes practices for network segmentation and OT access. |
| ISA/IEC 62443 | The international standard for industrial automation and control system security. | Defines the zone and conduit model, and the security levels, used in this guide. |
| ACSC guidance | The Australian Cyber Security Centre's principles of operational technology cyber security. | Reinforce safety, knowledge of the OT environment and control of third-party access. |
Confirm the current versions of these frameworks and the applicable CIRMP rules before relying on them for compliance.
Design review checklist
Use this checklist when reviewing a new OT design or a change to an existing control network. Ticks are kept in this browser only; print the page to keep a copy.
Questions
What is the Purdue model?
A reference model that divides an industrial network into levels, from the physical process at Level 0, through controllers, supervisory systems and site operations, up to enterprise IT at Levels 4 and 5. An IT/OT DMZ, sometimes called Level 3.5, sits between IT and OT so that the two never connect directly.
What is the difference between a zone and a conduit?
In ISA/IEC 62443, a zone is a group of assets with the same security requirements, and a conduit is the controlled path between two zones. A conduit carries only documented, approved traffic; everything else is denied.
When should a data diode be used?
For data that only needs to leave OT, such as historian data sent to the business. A data diode or unidirectional gateway physically prevents traffic flowing back in, which a firewall rule cannot guarantee.
Can we run vulnerability scans on an OT network?
Prefer passive monitoring. Active scans can crash controllers or stop a process, so any active testing should be planned with operations staff, in a maintenance window, with a rollback plan.
Does the SOCI Act require network segmentation?
Not by name. A critical infrastructure risk management program must identify and mitigate cyber and information security hazards, and the CIRMP Rules require compliance with a recognised cyber security framework. Documented zones, conduits and remote-access controls are core evidence that hazards to OT have been treated.