Network Segmentation

What is Network Segmentation?

Network segmentation is the practice of dividing a computer network into smaller, separated segments (zones) in which traffic between segments may only pass through controlled crossings, so that a failure or attack in one segment cannot spread unhindered across the entire network. In industrial environments, segmentation separates the IT network from the OT network, for example, and shields critical systems such as PLCs, SCADA and safety systems from less trusted networks such as the internet or a guest network. Network segmentation is the technical implementation of the zones and conduits model in IEC 62443 and a core measure of defence in depth.

🎯 Why is network segmentation so important in OT?

In a flat network, every device can reach every other device. An infected office laptop then, in principle, also has a route to the controllers of the production line. Segmentation breaks that path:

• Containment — Ransomware and other malware cannot simply move laterally; an incident stays confined to one zone
• Protection of legacy systems — much OT equipment runs on outdated operating systems or protocols without authentication, such as Modbus TCP; segmentation compensates for what the device cannot do itself
• Access control per segment — only authorised systems and people reach a zone, and only via defined routes, which strengthens overall security
• Better detection — at a boundary between zones, anomalous traffic is far more visible to network monitoring
• More stable performance — smaller broadcast domains limit unnecessary traffic, which improves the predictability of industrial networks
• Compliance — segmentation is expected by IEC 62443, ISO 27001, NIST SP 800-82 and NIS2

Recital 89 of the NIS2 Directive explicitly lists network segmentation as part of basic cyber hygiene, alongside zero-trust principles, software updates and identity management. In the Netherlands, NIS2 has been transposed into the Cyberbeveiligingswet, which entered into force on 15 August 2026. For digital service providers such as cloud and managed service providers, Implementing Regulation (EU) 2024/2690 goes further and explicitly requires network segmentation, including separation from third-party systems.

🔧 Which methods can you use to segment a network?

Segmentation can be implemented at different layers. The more critical the zone, the stronger the separation needs to be.

A VLAN on its own is not a security boundary: as long as a router connects all VLANs without filtering, the network is effectively still flat. Nor is a VPN a segmentation method; it is a secured connection into a segment and should itself terminate in a controlled conduit.

🏭 What does segmentation look like in the Purdue model?

The Purdue Model (Purdue Enterprise Reference Architecture) was developed at Purdue University in the early 1990s and forms the basis of ISA-95. It was originally a model for information flows, but it is now almost universally used as the starting point for OT segmentation.

The key rule: there is no direct connection at all from level 4 to level 3 or below. All traffic between IT and OT terminates in the IDMZ, where it is re-established. A guest network for suppliers or visitors should sit entirely outside the OT zones.

🔄 How does network segmentation relate to zones and conduits?

IEC 62443 describes segmentation in terms of zones: groups of assets with the same security requirements, and conduits: the controlled communication paths between them. Two parts of the standard are leading:

• IEC 62443-3-2 (2020) — its zone and conduit requirements (ZCR) state that you group assets into zones based on risk (ZCR 3.1), separate business systems from control systems (ZCR 3.2), put safety-related systems in their own zones (ZCR 3.3), separate temporarily connected devices such as laptops (ZCR 3.4) and isolate wireless devices (ZCR 3.5)
• IEC 62443-3-3 — system requirement SR 5.1 Network segmentation requires the system to support network segmentation; its requirement enhancements determine the security level: physical segmentation (RE 1, from SL 2), independence from non-control system networks (RE 2, from SL 3) and logical and physical isolation of critical networks (RE 3, SL 4)

Each zone is thus given a target security level, and the conduit determines which traffic may cross the boundary, for example through a firewall or data diode.

🔄 What is the difference between segmentation and microsegmentation?

In OT, microsegmentation is an addition, not a replacement: start with coarse zones and refine where the risk justifies it.

🧭 How do you segment an existing plant step by step?

In a brownfield environment, production keeps running while you segment. A phased approach avoids downtime:

1. Map assets and traffic — build an asset inventory and use passive monitoring to record who talks to whom, without active scanning
2. Carry out a risk assessment — determine, in line with IEC 62443-3-2, which assets belong together and which security level each zone needs
3. Design zones and conduits — draw the target network with the permitted protocols, sources and destinations for each conduit
4. Separate IT and OT first — place a firewall and an IDMZ at the IT/OT boundary; this delivers the largest risk reduction
5. Set up secure remote access — suppliers and engineers only get in via a jump server with MFA in the IDMZ
6. Segment within OT — first in learning or monitoring mode, then block zone by zone during a planned maintenance window
7. Embed ongoing management — record firewall rules, owners and changes through firewall rule management and change management

⚠️ Which mistakes are commonly made?

• VLANs without filtering — logically separated, but a router or L3 switch routes everything freely
• “Any-any” rules — temporary broad rules that are never cleaned up
• Dual-homed systems — a server or engineering laptop with one network card in IT and one in OT bypasses every firewall
• Forgotten connections — supplier 4G routers, unmanaged remote access or wireless access points
• Shared services — one Active Directory for IT and OT, so stolen credentials work in both worlds
• One-off project — segmentation that is no longer tested after handover erodes within a few years

🧪 How do you test and validate segmentation?

Segmentation only works if the rules do in practice what the design promises. Common checks are:

• Configuration review — compare firewall rules against the permitted conduits and remove unused or overly broad rules
• Traffic analysis — use network monitoring to check for traffic that should not cross zone boundaries
• Penetration test — have a specialist try to reach OT from an IT segment; in OT, preferably in a test environment or during a shutdown
• Periodic repetition — repeat the test after every major change and at least once a year

🔐 Which incidents show why segmentation matters?

Both cases show that the initial infection is rarely the real problem; the lack of barriers afterwards determines the extent of the damage.

❓ Frequently asked questions

Is a VLAN enough for network segmentation?

A VLAN on its own is not full network segmentation, because VLANs are often connected to each other without filtering on a router or L3 switch. Network segmentation also requires a firewall or ACL that restricts traffic between the VLANs to what is strictly necessary.

What is the difference between a DMZ and an IDMZ?

A DMZ is a buffer zone between an internal network and the internet. An IDMZ (industrial DMZ) is a buffer zone between the IT network and the OT network, at level 3.5 of the Purdue model, in which all traffic between the two worlds terminates and is re-established.

Does NIS2 require network segmentation?

NIS2 does not prescribe a specific technique, but it explicitly names network segmentation as part of basic cyber hygiene and requires appropriate network security measures. For organisations covered by the Dutch Cyberbeveiligingswet, network segmentation is therefore an expected measure in practice.

How many zones does an OT network need?

The number of zones in an OT network follows from the risk assessment, not from a fixed number. A simple plant can start with IT, an IDMZ, one OT zone and a safety zone; larger installations divide OT further by production line or process unit.

Can network segmentation be done without production downtime?

Network segmentation can largely be introduced without downtime by monitoring first, placing firewalls in transparent or learning mode, and only activating rules during planned maintenance windows. Physically rerouting cabling usually does require a short stop.

What is a data diode and when do you use one?

A data diode is hardware that physically allows traffic in one direction only, for example from OT to IT. A data diode is used for highly critical processes where any possible return path to the control system must be ruled out, such as in energy, nuclear facilities and defence.

📌 In summary

Network segmentation is a fundamental cybersecurity measure that divides a network into zones with controlled crossings, so that an attack or failure in one part does not affect the entire company or plant. In OT, this means strictly separating IT and OT through an IDMZ, defining zones according to IEC 62443 and the Purdue model, and continuously testing and maintaining the rules.