Segmentation

What is segmentation?

Segmentation is the division of networks, systems, applications, data or responsibilities into separate logical or physical parts, where communication and access between those parts may only pass through controlled transitions. It lets you limit risks, contain failures and keep complex environments manageable. Within OT and industrial automation environments, segmentation is a fundamental principle for both operational stability and cybersecurity.

Segmentation is a broader concept than network segmentation, its technical implementation through subnets, VLANs and firewalls, which is covered in depth in a separate article. This article describes segmentation as the overarching principle behind architectures such as the Purdue Model, the Zones and Conduits Model, Zero Trust and Defense in Depth. Within OT convergence, segmentation is becoming increasingly important because OT networks are ever more closely connected to IT, cloud and IIoT platforms.

🎯 Why do you segment networks and systems?

By dividing systems into separate segments, you can:

• Reduce the attack surface - an attacker or malware in one segment does not automatically reach the rest
• Isolate failures - a broadcast storm or faulty device stays confined to one part of the network
• Limit network load - smaller broadcast domains mean less unnecessary traffic
• Enforce access control - per segment you decide who and what may communicate
• Support Compliance - standards and legislation expect demonstrable separation

In industrial environments, segmentation prevents problems from spreading uncontrolled across the network. Without segmentation, malware outbreaks can spread freely, broadcast storms can develop, unwanted access can occur and real-time performance can deteriorate.

🧠 What types of segmentation exist?

Segmentation operates at several layers. In a mature architecture these types complement each other:

ISO 27002:2022 has a dedicated control for three of these types: 8.22 Segregation of networks, 8.31 Separation of development, test and production environments and 5.3 Segregation of duties. The latter reduces the risk of fraud, error and bypassing of security controls by separating conflicting duties.

🏭 How is segmentation applied in industrial automation?

OT environments contain systems with differing criticality, protocols and lifecycle requirements:

That is why OT networks often have separate segments for production lines, safety systems, engineering, historian systems, remote access and guest access. The common techniques for the network separation itself are:

A VLAN on its own is not a security boundary. As long as a router connects all VLANs without filtering, the network is effectively flat; only filtering between segments makes the separation effective.

🧱 What does segmentation look like in the Purdue Model?

The Purdue Model was developed at Purdue University in the early 1990s and is the most widely used reference for segmentation in industrial environments:

IT and OT differ in security requirements, lifecycle, performance requirements and risk profile. Communication between levels is therefore controlled through a firewall, the IDMZ, jump servers, proxies and protocol filtering. The IDMZ typically hosts historian replication, patch servers, antivirus updates, remote access gateways and data brokers. This prevents uncontrolled lateral movement between IT and OT and centralises monitoring.

🔐 How does IEC 62443 handle segmentation with zones and conduits?

The Zones and Conduits Model from IEC 62443 is the key OT security concept for segmentation. A zone groups systems with similar risk profiles, functionality and security requirements, such as a PLC zone, SCADA zone, safety zone or historian zone. Conduits are the controlled communication paths between zones, implemented with firewalls, data gateways or secure proxies. Communication thus remains controlled and auditable.

When partitioning a system, IEC 62443-3-2 (2020) requires business and control system assets to be separated (ZCR 3.2), safety-related assets to get their own zone (ZCR 3.3), and temporarily connected devices such as laptops (ZCR 3.4) and wireless devices (ZCR 3.5) to be kept apart. IEC 62443-3-3 groups the technical requirements under Foundational Requirement 5, Restricted Data Flow:

The required security level of each zone therefore determines how strong the separation must be.

🔄 What is the difference between segmentation, microsegmentation and isolation?

Microsegmentation is a fine-grained form of segmentation in which individual systems or workloads are protected separately, policy-driven and with dynamic access control. It fits the zero trust principle of NIST SP 800-207 (2020), which grants no implicit trust based on network location. Microsegmentation is increasingly applied in virtualisation, cloud environments, data centres and modern OT platforms. In industrial networks, implementation remains complex because of legacy systems and real-time requirements.

Fully air-gapped architectures still exist, but they are not infallible: Stuxnet reached an isolated network via USB sticks. Modern OT environments therefore more often use controlled segmentation with strict rules for removable media.

📡 How does segmentation protect insecure protocols and wireless networks?

Many industrial protocols were originally designed without security:

Because secure variants are rarely available in existing installations, segmentation limits exposure through OT firewalls, protocol filtering, whitelisting and dedicated VLANs.

Wireless networks such as Wifi, Bluetooth and WirelessHART need additional segmentation: separate SSIDs, VLAN isolation, NAC solutions, firewalling and device authentication. This prevents uncontrolled access to OT assets.

📈 How does segmentation affect performance?

Good segmentation means less broadcast traffic, lower network load, less congestion and better real-time performance. That matters in OT, where low latency, limited jitter, deterministic behaviour and high availability are required. Poor segmentation can lead to network congestion, unstable communication, delayed HMIs and PLC timeouts. Conversely, a firewall performing heavy inspection can itself add delay, which is why lighter filtering is often chosen within the control zone.

🔍 How do you monitor and test segmented networks?

Monitoring helps to detect lateral movement, validate firewall policy and support incident response. Segmentation must also be tested periodically. PCI DSS 4.0.1 (requirements 11.4.5 and 11.4.6), for example, requires a penetration test of segmentation controls at least every 12 months and after every change, and every six months for service providers.

🧭 How do you approach segmentation in practice?

A modern factory can set up segmentation as follows:

Communication is restricted by firewalls, ACLs, protocol filtering and whitelisting. A phased approach works best:

1. Inventory assets and communication flows, preferably with passive monitoring.
2. Assess risks and determine the required security level per zone.
3. Separate IT and OT first with an IDMZ; this delivers the greatest risk reduction.
4. Segment within OT per line or function, starting in monitoring mode.
5. Organise governance of who may change firewall rules and how remote access works.

Common challenges are:

Segmentation changes in OT must be carefully tested to avoid production impact. Good segmentation often keeps a ransomware infection in IT away from OT systems, but only if OT is also functionally independent. At Colonial Pipeline (May 2021) the ransomware hit only IT, yet the pipeline was shut down for five days as a precaution because business processes depended on IT.

Cloud and hybrid architectures add secure gateways, API security, VPN segmentation, identity-based access and edge isolation. Critical real-time systems usually remain segmented locally.

In the Netherlands, the NIS2 Directive has been transposed into the Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026. NIS2 explicitly lists network segmentation as basic cyber hygiene in recital 89, and Implementing Regulation (EU) 2024/2690 requires digital infrastructure and service providers, such as cloud, data centre and managed service providers, to segment systems into zones based on risk and to separate them from third-party systems.

🏗️ What role does segmentation play in IT/OT convergence?

Within IT/OT convergence, segmentation is one of the most important architectural principles. It enables secure data exchange, cloud integration, IIoT connectivity, predictive maintenance and remote operations without exposing control systems. Modern concepts such as Zero Trust, microsegmentation, Defense in Depth and IEC 62443 all build on it. Segmentation thus forms the foundation for secure, scalable and manageable industrial networks and cyber-physical systems.

❓ Frequently asked questions

What is the difference between segmentation and network segmentation?

Segmentation is the overarching principle of separation and covers networks, hardware, applications, data and organisational roles. Network segmentation is its most widely used form and specifically divides network traffic into subnets and zones with controlled transitions.

What is application segmentation?

Application segmentation separates applications and workloads from each other, so that a compromised application cannot communicate freely with other applications. IEC 62443-3-3 calls this application partitioning (SR 5.4); in practice it is done with microsegmentation, host firewalls or network policies in container platforms.

What is organisational segmentation?

Organisational segmentation is the separation of tasks, roles and privileges so that no single person can carry out and verify critical actions alone. ISO 27002 describes it as segregation of duties, for example between the person who requests firewall rules and the person who approves them.

Is segmentation mandatory under NIS2?

NIS2 does not prescribe a specific technique, but it explicitly lists network segmentation as part of basic cyber hygiene. For organisations covered by the Dutch Cyberbeveiligingswet, segmentation is therefore an expected measure in practice, and for digital infrastructure and service providers such as cloud and managed service providers network segmentation is explicitly required by Implementing Regulation (EU) 2024/2690.

Is an air gap better than segmentation?

An air gap provides the strongest separation, but it makes data exchange, updates and monitoring difficult and is not infallible, as Stuxnet showed. For most industrial environments, controlled segmentation with zones, conduits and possibly a data diode offers a better balance between security and usability.

How often should segmentation be tested?

Segmentation should be tested after every change to zones or firewall rules and periodically in addition, in practice at least once a year. PCI DSS 4.0.1 requires a segmentation test every 12 months, and every six months for service providers; the NIS2 implementing rules require a periodic review of its effectiveness.

📌 In summary

Segmentation divides networks, systems, applications, data and responsibilities into separate parts with controlled transitions, so that an attack, error or failure in one part does not affect the whole. In OT this means separating IT and OT through an IDMZ, setting up zones and conduits in line with IEC 62443 and the Purdue Model, and continuously monitoring and testing the separation.