Operational technology
Every article on this subject reproduces the Purdue diagram. Far fewer deal with what happens when the model meets a plant that grew organically over twenty years. This is the implementation judgement rather than the reference architecture.
Segmentation is the control that repays effort fastest in an industrial environment. It limits how far a compromise travels, and unlike patching, it does not depend on a vendor still supporting equipment commissioned in 2011.
It is also the control most often designed on paper and never quite delivered. The design assumes a plant that matches the reference diagram. The plant that exists has a shared switch in a motor control centre, a historian with a network card in each world, and a vendor VPN nobody can find the paperwork for.
This article assumes you already know what the Purdue model is. If you need that context first, our guide to IT and OT convergence covers it, and you will need a current inventory before any of this is actionable, so see OT asset visibility for how to build one safely.
Reference, not requirement
The Purdue Enterprise Reference Architecture separates an industrial estate into levels: field devices and instrumentation at the bottom, then controllers, then supervisory systems, then site operations, with the enterprise network above and a demilitarised zone between plant and business.
It is a reference architecture. It is not a standard, and no auditor certifies conformance to it. Where you need a standards-based expression of the same thinking, IEC 62443 provides it through zones and conduits, which is the vocabulary a regulator or customer is more likely to recognise.
Its practical value is that it gives engineering and security a shared language for two questions: which systems may talk to which, and where does traffic between business and plant get inspected. Treating it as a checklist to conform to, rather than a model to reason with, is where segmentation projects start going wrong.
The real starting point
Almost no operating plant resembles the diagram. The gap between model and reality is the actual work, so it is worth naming what you will find.
Flat networks that grew by accretion. A line was added, and the quickest way to connect it was the switch that had a free port. Repeat across several capital projects and the plant network is one broadcast domain with no internal boundaries at all.
Shared infrastructure across the boundary. A single switch or VLAN carrying both business traffic and control traffic, often because a contractor needed connectivity during commissioning and the temporary arrangement became permanent.
Dual-homed servers. A historian or data server with one interface on the plant network and another on the business network, bridging precisely the boundary you are trying to establish. This is common because it is the simplest way to get production data to the enterprise, and it defeats a firewall that sits alongside it.
Undocumented remote access. Vendor VPNs, cellular routers inside panels, and remote desktop paths set up for a support call. Each is a conduit into a zone, and none appears on the network diagram.
Equipment that cannot be moved. A controller with a hard-coded IP address referenced by a dozen other systems, or a device whose vendor will not support it on a different subnet. Re-addressing is sometimes impossible within the project window.
A design that does not account for these produces a diagram that will never be built. Survey first, design second.
The boundary
The demilitarised zone between plant and business is the single most valuable structural change in most environments. The principle is that no enterprise system holds a direct path to a controller, and no plant system reaches the internet directly. Data the business needs is brokered.
What belongs in the DMZ: replicated historian instances that enterprise systems query instead of the plant original, patch and antivirus distribution points that pull from outside and serve inward, jump hosts for remote access, and file transfer staging. Each of these exists so that a system on one side never needs to connect to a system on the other.
What should not traverse it: direct database connections from enterprise applications into control systems, domain authentication where plant systems depend on an enterprise domain controller, and any protocol that would let a business-network host address a controller directly.
The dual-homed historian deserves a specific mention because it is so common. Replacing it with a replicated instance in the DMZ is usually the highest-value single change available, and it is often resisted because the existing arrangement works. It works until the business network is compromised.
Zone design
The instinct is to draw zones around physical areas, because buildings and panels are visible and easy to reason about. It produces the wrong boundaries.
Zones should follow process function and criticality. Systems that must communicate constantly to run a process belong together; systems that merely happen to sit in the same room do not. A packaging line and a utilities system in the same building have different criticality, different downtime tolerance, and different sets of people who touch them.
Three groupings deserve particular attention:
The asset inventory drives all of this. The communication-partner data tells you which systems genuinely need to talk, and the failure-impact data tells you which groupings matter most.
Enforcement
A conduit is the controlled path between two zones. Defining zones without controlling the conduits between them achieves nothing, and this is where designs most often stop short.
Enforcement should be protocol-aware where the traffic warrants it. A firewall rule permitting a port between two zones says nothing about whether the traffic on that port is a legitimate read or a command to change a controller operating mode. Where the technology supports inspection of the industrial protocol in use, it distinguishes those cases.
Default-deny is the right posture, built up from the inventory rather than down from a permissive baseline. Start with nothing permitted, add what the communication data shows is genuinely required, and validate against the process. Working the other way, permitting everything and removing rules later, almost never completes, because nobody wants to be the person who removed the rule that stopped the line.
Unidirectional gateways and data diodes have a genuine place where the requirement is truly one-way and the consequence of compromise is severe. They also carry cost and operational constraints that make them disproportionate in many plants. Justify them against the specific boundary rather than adopting them as a default.
The overlooked conduit
Third-party access is a conduit, and it is routinely omitted from segmentation designs because it does not appear on the network diagram.
The pattern to move away from is standing connectivity: a permanent VPN or always-available remote desktop path, often with a shared account, established during commissioning and never reviewed. It provides a route into a plant zone that bypasses whatever boundary controls were built.
The pattern to move toward is brokered access. Sessions are requested and authorised, terminate at a jump host in the DMZ rather than reaching plant systems directly, are time-bound so access expires, are attributable to a named individual rather than a shared credential, and are recorded so there is a record of what was done.
This is as much a contractual matter as a technical one. Support agreements that promise a response time imply access, so the access model belongs in the agreement rather than being improvised when a vendor calls at midnight.
Delivery
Segmentation changes traffic paths, and traffic paths in a plant have process consequences. A big-bang cutover is the approach most likely to cause the outage everyone was trying to prevent.
A workable sequence:
Monitor mode is the step most often skipped under schedule pressure, and skipping it is the most reliable way to cause an unplanned stoppage.
Assurance
A segmentation design that has never been tested is a hypothesis. Rules get added during troubleshooting, a temporary permit becomes permanent, and a new device arrives in the wrong zone.
Verification means confirming both that permitted traffic works and that non-permitted traffic is actually blocked. The second half is the one that gets skipped, because the first half is proven by the plant continuing to run.
Any active testing in a control network carries the same constraint as active scanning: it needs engineering agreement, a planned window, and an understanding of how the equipment behaves under test. Where that is not available, configuration review and passive traffic analysis establish a great deal without touching the process.
Where a managed SOC monitors the environment, the conduits are the highest-value place to watch. Traffic crossing a zone boundary that the design does not anticipate is a strong signal, and far more meaningful than most alerts generic tooling produces.
Pitfalls
Caveo approach
Our OT security services cover zone and conduit design grounded in an asset inventory rather than a reference diagram, DMZ architecture, vendor access models, and phased enforcement planned around production windows with engineering involvement throughout.
Because we also run managed SOC operations, conduit monitoring can be built into the design from the start rather than retrofitted, and boundary violations feed the same escalation process as the rest of security monitoring. Sector context shapes the priorities, so see cybersecurity for manufacturing and energy and critical infrastructure security.
The useful first conversation is about which processes cannot stop, what connectivity exists today between business and plant, and what your regulatory position requires.
The Purdue Enterprise Reference Architecture is a reference model that separates an industrial estate into levels, from field devices and controllers at the bottom through supervisory and site operations to the enterprise network, with a demilitarised zone between plant and business. It is a reference architecture rather than a standard, and nobody certifies conformance to it. IEC 62443 expresses similar thinking through zones and conduits in a standards-based form.
An industrial DMZ is a buffer zone between the plant and business networks where data is brokered rather than passed directly. It typically holds replicated historian instances, patch distribution points, jump hosts for remote access, and file transfer staging. Most converged environments benefit from one, because it removes any direct path between an enterprise system and a controller.
Largely, if it is sequenced properly. Survey and design carry no production risk. Where the technology supports a monitor-only mode, intended rules can run without blocking to surface traffic the design missed. Enforcement itself usually needs a planned window, applied one zone at a time starting with the lowest-criticality area, with a rollback position agreed in advance.
Safety systems should sit in their own zone with the tightest conduits in the plant, and the design should be reviewed with the safety engineer. Any control that could interfere with a safety function requires engineering sign-off before it is applied.
Not on its own. What matters is what the firewall permits, not that one is present. A permissive rule set, a dual-homed server bridging around it, or a vendor VPN terminating inside the plant all defeat the boundary. Segmentation also needs to account for identity, since a plant system authenticating against the enterprise domain inherits that domain compromise.
Replace standing connectivity with brokered sessions: requested and authorised, terminating at a jump host in the DMZ rather than reaching plant systems directly, time-bound so access expires, attributable to a named individual rather than a shared account, and recorded. Because support agreements that promise response times imply access, the access model belongs in the contract.
Talk to Caveo about zone and conduit design, DMZ architecture, and phased enforcement planned around production.