DMZ

What is a DMZ (Demilitarized Zone)?

A DMZ (Demilitarized Zone) is an isolated network segment between a trusted internal network and a less trusted network, hosting systems that communicate with both sides without any direct traffic being possible between those two sides. Traditionally a DMZ sits between the internet and the corporate network (IT); in industry, a DMZ mainly sits between the IT network and the production network (OT). That industrial variant is also called an IDMZ and is referred to as level 3.5 in the Purdue Model. Another name for a DMZ is screened subnet.

The purpose of a DMZ is to shield sensitive systems while still making certain services available in a controlled way to the other side, for example for Remote Access, data exchange or Monitoring.

🧠 What does a DMZ do?

A DMZ is a buffer zone. Everything both networks need to share lives in that buffer; the networks themselves do not talk to each other. A DMZ:

• Isolates external access - users and systems from outside get no further than the DMZ
• Contains and slows down an attacker - whoever compromises a system in the DMZ is not yet inside the internal network and has to cross another boundary
• Enables controlled communication between IT and OT, or between the internet and internal systems, through a small number of known services
• Makes oversight possible - because all traffic passes through one point, it is easy to log and inspect there

The name is borrowed from the military term demilitarised zone: a buffer strip between two parties where military activity is not permitted, such as the zone that has separated North and South Korea since the 1953 armistice.

🔄 What is the difference between a DMZ and an IDMZ?

The principle is the same, but what is protected and which services it hosts differ:

Many organisations have both: an internet DMZ at the edge of the company and a separate IDMZ per plant or site. Do not merge the two into one zone; a compromised web server should never sit next to the production historian.

🔧 How is a DMZ built: one firewall or two?

A DMZ is created with a firewall that has at least three network interfaces, or with two firewalls in series. Revision 2 of NIST SP 800-82 (2015) described five ways to separate a corporate network from a control network, from weak to strong:

NIST concludes that the most secure and manageable solution consists of at least three zones with one or more DMZs. The paired-firewall design has two extra advantages. If you use firewalls from two different manufacturers, a single vulnerability will not get an attacker through both. And IT and OT can each manage their own firewall, which makes responsibilities clear. The downside is higher cost and more management effort.

In practice, an IDMZ is often built with next-generation firewalls or an industrial firewall on the OT side, deployed redundantly so that a failed firewall does not stop production.

📦 Which systems belong in a DMZ?

A DMZ only hosts intermediaries: systems that accept data or sessions from one side and pass them on to the other side themselves. An example of an IDMZ with typical services and data flows:

A public web server or API gateway belongs in an internet DMZ, not in the IDMZ. Domain controllers, PLCs and engineering workstations do not belong there either: whatever is needed to keep the plant running stays in the OT zone.

🔐 Which rules apply to traffic through a DMZ?

The strength of a DMZ lies not in the firewalls themselves but in the rules. The most important ones, drawn from NIST and the IDMZ design guidance from Cisco and Rockwell Automation:

• No direct traffic - no connection runs from IT straight to OT or vice versa, not even “temporarily”
• Sessions terminate in the DMZ - an inbound connection ends at a server in the DMZ; that server opens a new, separate connection inwards
• Different protocols on each side - do not use a protocol between OT and the DMZ that is also allowed between the DMZ and IT, so a worm would need two different vulnerabilities
• No industrial protocols in the DMZ - IP, Modbus TCP and similar control traffic stay in the OT zone
• Prefer connections initiated from OT - let systems in the control network push data to the DMZ rather than allowing inbound connections
• Only permitted traffic - whitelisting per source, destination and port; anything not explicitly allowed is denied
• No permanent storage - data in the DMZ is a copy or transient; the source stays in its own zone
• Can be disconnected - the DMZ must be detachable on both sides so the plant keeps running on its own during an incident
• Monitoring and Logging - all traffic to and from the DMZ is logged and watched with network monitoring or an IDS

For flows that only need to go one way, such as process data to IT, a data diode is a stronger alternative: it makes traffic in the reverse direction physically impossible.

🏭 Where does the DMZ sit in the Purdue Model?

In the Purdue Model, the IDMZ sits between:

• Level 4 - IT (ERP, email, cloud, analytics)
• Level 3 - OT operations (MES, historian, site production scheduling)

Because the DMZ is not a functional layer of its own, it is referred to as level 3.5. In IEC 62443, the DMZ is a zone in its own right, with conduits to IT and OT, following the zones and conduits model. IEC 62443-3-3 sets requirements for network segmentation (SR 5.1) and zone boundary protection (SR 5.2); IEC 62443-3-2 describes how to define zones and conduits based on risk.

Revision 3 of NIST SP 800-82 (September 2023) states that all communication between the enterprise network and the OT network must go through services in the DMZ, and that those services must themselves be closely monitored. After all, a DMZ connects to the outside world; an attacker who gets in there unnoticed can pivot onwards to OT.

🛠️ How do you set up a DMZ step by step?

1. Map every flow between IT and OT - what data, which protocol, which direction, what purpose; this becomes the basis of your rule set
2. Assign an intermediary to each flow - historian mirror, broker, patch server or jump server; flows without an intermediary are dropped or redesigned
3. Choose the architecture - preferably two firewalls, possibly from different manufacturers, deployed redundantly
4. Separate identity - use a dedicated Active Directory or local accounts in OT, not a domain that spans IT and OT
5. Harden the DMZ servers - minimal software, prompt patching and antivirus; NIST recommends prioritising DMZ systems when patching
6. Manage the rules - document every rule with an owner and a reason, and review them periodically through firewall rule management
7. Test disconnection - verify that production keeps running if the DMZ fails or is deliberately cut off

In the Netherlands and the EU, this ties in with NIS2 and the Dutch Cybersecurity Act, which require essential and important entities to take appropriate network security measures. A well-documented DMZ is concrete, auditable evidence of network segmentation and of compliance with standards such as ISO 27001 and IEC 62443.

⚠️ What are common mistakes?

• A DMZ on paper only - the DMZ exists, but a “temporary” rule lets RDP from IT straight into OT
• Dual-homed servers - a historian or engineering station with one network card in IT and one in OT bypasses the entire DMZ
• Supplier VPN straight into OT - a vendor router in the cabinet skips the DMZ; always route remote maintenance through the jump server
• Broad rules - allowing “any-any” or entire subnets instead of specific systems and ports
• IT DMZ and IDMZ merged - public services and production services in the same zone
• No monitoring - the DMZ is set up and then never looked at again, although it is the most exposed part of OT

✅ What are the benefits of a DMZ?

• Improves network segmentation and fits within a defence-in-depth strategy
• Enables secure external access and data exchange without OT being directly reachable
• Supports compliance with standards including ISO 27001 and IEC 62443
• Contains and slows down the spread of an intrusion, such as ransomware from the corporate network
• Provides a single control point for logging, inspection and rapid disconnection during an incident

❓ Frequently asked questions

Is a DMZ the same as a firewall?

No, a DMZ is a network segment and a firewall is the device that protects that segment. A DMZ is created with a firewall that has three or more interfaces, or with two firewalls in series. Only the combination of DMZ, firewalls and strict rules delivers real security separation.

Does every plant need an IDMZ?

Every plant that exchanges data between the office and production, or gives suppliers remote access, benefits from an IDMZ. NIST SP 800-82 advises against two-zone solutions without a DMZ because they offer only weak protection. Small sites can start with a single firewall with a DMZ interface.

What does level 3.5 mean in the Purdue Model?

Level 3.5 is the common name for the industrial DMZ between level 4 (IT) and level 3 (OT operations). It is not a functional layer like the other levels but a buffer zone where all traffic between IT and OT terminates. That is why it gets a “half” number.

Can a historian be placed in the DMZ?

A copy of the historian belongs precisely in the DMZ: the source historian in OT replicates to a mirror in the DMZ, and IT users only read that mirror. The original historian and data collection remain in the OT zone. This way no IT user ever needs to connect directly to the OT network.

Is a data diode better than a DMZ?

A data diode and a DMZ complement each other. A data diode lets data physically travel in one direction only, which makes it stronger for one-way flows such as process data to IT. For two-way traffic, such as patches, antivirus updates and remote maintenance, a DMZ with firewalls is still needed.

How many firewalls does a DMZ need?

A DMZ can be built with one firewall with three interfaces or with two firewalls. Two firewalls, preferably from different manufacturers, provide two independent boundaries and make the division of management between IT and OT clearer. A single firewall is cheaper and simpler, but it is a single point on which everything depends.

📌 In summary

A DMZ is a buffer zone between the internal network and the outside world, where all traffic terminates and no connection runs directly from one side to the other. In industry, an IDMZ at level 3.5 separates the corporate network from OT, so that services such as the historian, patching and remote maintenance work without directly exposing critical systems such as SCADA or MES.