OT Network Segmentation: IEC 62443 Zones and Conduits

A flat plant network may let a laptop on the office VLAN reach a production HMI, a PLC, and the historian when no enforced boundary separates enterprise IT from OT. Segmentation removes that direct path.

The Purdue hierarchy describes functions and trust boundaries. IEC 62443-3-2 provides the risk-based system-design basis for grouping assets into zones and controlling communication through conduits. An industrial DMZ is a recognized pattern for brokering enterprise-to-OT exchanges, but it is not the only topology that can satisfy the standard.

TL;DR: IEC 62443-3-2 groups assets with common security requirements into zones and protects communication between them through conduits. SR 5.1 covers network segmentation; deny-by-default communication across zone boundaries is tied more precisely to SR 5.2 RE1. An industrial DMZ, often called Level 3.5 as a later security convention, can broker enterprise-to-OT exchanges. NotPetya, although not designed specifically for OT, disrupted connected enterprise and operational environments and caused an estimated $10 billion in global damage (NotebookLM, OT Segmentation notebook, 2026).

What Is the Purdue Model, and Where Does It Still Hold?

The Purdue Enterprise Reference Architecture describes a common six-level operational hierarchy, from Level 0 through Level 5 (NotebookLM, OT Segmentation notebook, 2026). Theodore J. Williams and the Industry-Purdue University Consortium developed PERA in 1992 to integrate enterprise systems, automation, and information flow. Security teams later adapted the hierarchy to discuss OT trust boundaries; it was not created as a cybersecurity standard.

Level 0 covers the physical process and sensing. Level 1 contains basic control. Level 2 provides area supervision through systems such as HMIs and SCADA. Level 3 covers site operations, including MES and plant historians. Levels 4 and 5 cover enterprise systems and external or cloud connectivity (NotebookLM, OT Segmentation notebook, 2026).

Levels 2 and 3 combine process supervision or plant-wide operational coordination with routable networks and general-purpose computing, making them high-consequence pivot targets (NotebookLM, OT Segmentation notebook, 2026). An attacker can use a compromised host as a path toward systems that influence the physical process. The site's architecture and controls still determine the risk.

Citation capsule: The Purdue hierarchy runs from Level 0 physical processes through Levels 4 and 5 enterprise and external connectivity. Levels 2 and 3 deserve close attention in segmentation design because they combine process supervision or operational coordination with routable networks and general-purpose computers. PERA supplies a useful functional hierarchy, but IEC 62443 zones, conduits, and risk assessment supply the security design basis (NotebookLM, OT Segmentation notebook, 2026).

The Purdue hierarchy does not decide where to place a unified namespace. The design team should document the broker's zone and every required conduit. The hierarchy can locate trust boundaries, but documented operational need and risk should determine allowed communication.

What Are Zones and Conduits, in Practice?

A zone groups assets that share common security requirements, while a conduit governs and protects communication between zones (NotebookLM, OT Segmentation notebook, 2026). A robotic cell, chemical dosing skid, or maintenance network may form a zone when the risk assessment supports that boundary. Firewalls and data diodes are possible conduit controls, not the definition of a conduit itself.

IEC 62443's Foundational Requirement 5 is Restricted Data Flow. SR 5.1 covers network segmentation, while SR 5.2 RE1 is the more precise basis for denying communication across zone boundaries unless explicitly permitted (NotebookLM, OT Segmentation notebook, 2026). A conduit can begin with no allowed cross-zone communication, then add only the endpoints, services, and directions justified by operational need.

Boundary controls cannot compensate for poorly grouped assets. Business systems, safety systems, temporary equipment, and wireless or mobile systems may need separate zones when the risk assessment finds different security requirements (NotebookLM, OT Segmentation notebook, 2026). IEC 62443 does not mandate that list for every site; system risk and required communication determine the zone design.

Citation capsule: IEC 62443-3-2 uses zones and conduits as the basis for risk-based segmentation. A zone groups assets with common security requirements, while a conduit governs communication between zones. Foundational Requirement 5 is Restricted Data Flow: SR 5.1 addresses network segmentation, and SR 5.2 RE1 addresses deny-by-default communication at zone boundaries (NotebookLM, OT Segmentation notebook, 2026).

Zones and conduits avoid reliance on an assumed air gap. Vendor access, cellular connections, and external analytics can create paths that must be identified and governed. Document existing connections and contain them through explicit boundaries instead of assuming physical isolation.

What Is the Industrial DMZ For?

An industrial DMZ is an intermediary trust zone between enterprise IT and OT (NotebookLM, OT Segmentation notebook, 2026). It is often labeled Level 3.5, but that number is a later industrial-security convention rather than an original Purdue level, and not every architecture numbers it the same way.

An iDMZ can terminate or broker enterprise-to-OT exchanges through controlled services instead of allowing enterprise systems to connect directly to Level 3 or below (NotebookLM, OT Segmentation notebook, 2026). Historian replication, log collection, patch or update staging, file transfer, and remote-access jump services are common examples. The exact flows must follow the site's risk assessment and operational requirements.

An outer IT-facing firewall and an inner OT-facing firewall can add defense in depth to an iDMZ. Independent administration, including the use of products from different vendors, can reduce common-mode exposure. Different vendors also add cost and operational complexity, and IEC 62443 does not universally require two firewalls or two vendors (NotebookLM, OT Segmentation notebook, 2026). Colonial Pipeline is not evidence that an iDMZ stopped ransomware: attackers used a legacy VPN profile without a one-time passcode, the ransomware affected business IT, and Colonial shut pipeline operations down as a containment and safety decision.

An iDMZ should host narrow intermediary services rather than become another general-purpose server network. Jump services, patch staging, telemetry brokers, historian replicas, controlled file transfer, and log collection are common candidates. A plant bridging OPC UA to enterprise analytics can terminate that exchange on a controlled intermediary instead of using a dual-homed host. Dual-homed systems can bypass boundary enforcement and should not casually bridge enterprise and control networks. The Triton/TRISIS incident compromised Schneider Triconex safety controllers, underscoring the importance of separating safety systems, but the evidence does not show that one segmentation topology alone would certainly have prevented it (NotebookLM, OT Segmentation notebook, 2026).

Which Firewall and Conduit Rules Survive Contact With Production?

Conduit rules should name specific endpoints, services, and directions instead of allowing unrestricted subnet-to-subnet traffic. Port-and-IP filtering cannot distinguish every legitimate industrial exchange from malicious use of the same service. OT-aware, stateful inspection can improve visibility into industrial protocols, but deploying it is a product and risk decision, not an automatic prerequisite for every boundary (NotebookLM, OT Segmentation notebook, 2026).

Each rule should state its direction, endpoints, service, owner, and business purpose. A narrow rule set can let an OT historian send data to a read-only iDMZ replica, gateways publish telemetry to a broker, OT endpoints forward logs to a collector, and remote users connect to an iDMZ gateway rather than a controller (NotebookLM, OT Segmentation notebook, 2026).

Temporary access is especially prone to drift. Assign every exception an accountable owner, a documented purpose, and an expiry tied to site policy and the approved work. Where practical, use a brokered access gateway instead of leaving a standing firewall hole (NotebookLM, OT Segmentation notebook, 2026).

Review enforced rules against documented conduits at an interval suited to the site's risk, policy, and change volume; IEC 62443 does not prescribe a universal interval. Also watch for dual-homed devices that can bypass the intended boundary by connecting enterprise and control networks.

Citation capsule: Directional rules limited to named endpoints, services, and business need are a defensible operating practice for OT conduits. Protocol-aware inspection can improve visibility when the risk and protocol justify it, while temporary exceptions should have an owner and expiry. These are architecture and governance choices applied within IEC 62443's Restricted Data Flow framework, not a universal product prescription (NotebookLM, OT Segmentation notebook, 2026).

When Are Data Diodes Justified?

A data diode or unidirectional gateway enforces one-way transfer through a physical one-way mechanism rather than a reversible firewall rule (NotebookLM, OT Segmentation notebook, 2026). That property can suit a high-consequence zone that must export approved data but has no justified inbound flow.

One-way transfer works only when the process and operational communications are compatible with it. An application that expects bidirectional exchange may require gateway services that reproduce the outward data on the receiving side, or a different controlled conduit. Start with the required flow, not a product category.

Nuclear, electric-grid, pipeline, and defense environments are examples where one-way boundaries may be suitable because the consequences are high and some flows only need to leave a protected zone (NotebookLM, OT Segmentation notebook, 2026). These are use cases, not universal prescriptions. A high Target Security Level also does not automatically make a diode mandatory; the selected controls must follow the risk assessment and applicable IEC 62443 requirements.

Use a diode for a justified one-way flow that must not accept a return connection, and a controlled bidirectional conduit when operations require traffic in both directions. Generic downtime-payback claims do not justify either design; cost and consequence are site-specific.

How Should You Frame SL1 Through SL4?

A risk assessment establishes the Target Security Level for each zone, using IEC 62443 security levels SL1 through SL4 to frame increasing attacker capability (NotebookLM, OT Segmentation notebook, 2026). A short list of authentication, firewall, or monitoring controls does not define a security level; each selected control must trace to the applicable requirements and the zone's risk.

SL1 addresses protection against casual or accidental misuse. Practical measures may include basic access control, network separation, and reducing unnecessary services, but those examples are not a complete statement of SL1 requirements (NotebookLM, OT Segmentation notebook, 2026).

SL2 raises the attacker model to intentional misuse with simple means, lower resources, generic skills, and low motivation (NotebookLM, OT Segmentation notebook, 2026). Role-based access, brokered remote access, and deny-by-default boundary rules may be appropriate design choices, but IEC 62443 does not assign SL2 to most production zones by default.

SL3 addresses a sophisticated attacker with moderate resources, IACS-specific skills, and moderate motivation (NotebookLM, OT Segmentation notebook, 2026). MFA for remote access, monitoring, and protected communications may form part of an SL3 architecture where the applicable requirements and risk call for them; they are not a complete definition of SL3.

SL4 addresses a sophisticated attacker with extended resources, IACS-specific skills, and high motivation (NotebookLM, OT Segmentation notebook, 2026). Hardware-enforced isolation can be one architecture option for the most consequential one-way flows, but neither a data diode nor any short control checklist is universally mandated for every SL4 zone.

How Do You Stage a Segmentation Project?

The following six stages form a practical brownfield plan, not a sequence prescribed by IEC 62443. Incremental enforcement reduces the chance of blocking an undocumented but required flow.

Stage one: build the asset inventory. Passive discovery and observed-flow mapping reduce operational risk (NotebookLM, OT Segmentation notebook, 2026). During planned maintenance, targeted read-only active collection can identify silent assets that passive monitoring misses.

Stage two: map data flows, not just devices. Record the endpoints, direction, services, and operational purpose of required communication (NotebookLM, OT Segmentation notebook, 2026). This map provides the basis for conduit rules; without it, enforcement relies on assumptions.

Stage three: draw zones around risk, not geography. Group assets by criticality, function, ownership, security requirements, and required communication. Safety systems and temporary contractor equipment may warrant separate zones when their risk and requirements differ; IEC 62443 does not mandate the same zone list for every site.

Stage four: establish the DMZ before changing firewall rules between existing zones. Put jump servers, historian replicas, and patch mirrors into service first. This gives remote access and IT reporting an approved path before the other paths close.

Stage five: apply deny-by-default incrementally, one conduit at a time. Blocked traffic may reveal a data flow missed in stage two.

Stage six: broker vendor remote access. Replace direct access to the OT subnet with an iDMZ gateway or jump service. Use MFA, named accounts, narrow authorization or schedules, and comprehensive session logs; record sessions where risk and policy justify it (NotebookLM, OT Segmentation notebook, 2026). Colonial Pipeline shows the risk of legacy VPN access without MFA, but the compromise was in business IT and the operational shutdown was a containment and safety decision. Oldsmar should not be treated as a settled external intrusion: later reporting indicated that internal operator action may have caused the change, but the FBI could not confirm that explanation.

If the PLC, PAC, or RTU platform choice remains open, document the required Level 1-to-Level 2 communication before finalizing boundaries. Choices such as PROFINET or EtherNet/IP affect the services and monitoring capabilities the conduit design must accommodate. These are engineering inputs, not IEC 62443 prescriptions.

Frequently Asked Questions

What is the Purdue model in OT security?

The Purdue Enterprise Reference Architecture is a six-level manufacturing automation and information-flow hierarchy, from the physical process at Level 0 to enterprise and external connectivity at Levels 4 and 5 (NotebookLM, OT Segmentation notebook, 2026). Security teams later adapted it for segmentation. Level 3.5 is a later convention for an industrial DMZ, not an original Purdue level.

What is the difference between a zone and a conduit in IEC 62443?

A zone groups assets with common security requirements into one defined perimeter (NotebookLM, OT Segmentation notebook, 2026). A conduit governs and protects communication between zones. Firewalls and data diodes are possible conduit controls, selected according to required flows and risk.

Do I need a data diode or a firewall for my OT DMZ?

Use firewalls where the required exchange is bidirectional and consider a data diode where a high-consequence zone only needs one-way transfer (NotebookLM, OT Segmentation notebook, 2026). Two independently administered firewalls can add defense in depth, but IEC 62443 does not universally require dual firewalls, different vendors, or a diode.

What security level, SL1 through SL4, does a typical plant need?

Choose a Target Security Level for each zone through risk assessment rather than assigning one level to a typical plant (NotebookLM, OT Segmentation notebook, 2026). SL1 through SL4 describe increasing attacker capability. Any control checklist must be traced to the applicable IEC 62443 requirements; it does not define a security level by itself.

How should I build an OT asset inventory?

Use passive asset discovery and observed-flow mapping to build the inventory (NotebookLM, OT Segmentation notebook, 2026). Targeted read-only active collection during a planned maintenance window can close gaps by identifying silent assets.

Conclusion

NotPetya disrupted industrial operations through connected enterprise and operational environments, although it was not designed specifically for OT. Triton/TRISIS compromised safety controllers. Colonial Pipeline's legacy VPN lacked MFA, while its pipeline shutdown followed compromise of the business network as a containment and safety decision (NotebookLM, OT Segmentation notebook, 2026). These incidents do not support a single flat-network explanation.

Inventory assets and observed flows, group assets with common security requirements into zones, and govern required cross-zone communication through conduits. Broker necessary enterprise-to-OT data and access through controlled iDMZ services instead of treating direct controller access as normal. Set each zone's Target Security Level from its risk assessment.

Roll out the design incrementally. Verify allowed and denied paths and review logs. Segmentation cannot guarantee containment, but it reduces unnecessary paths through which one compromised system can affect the rest of the plant.