ARCHITECTURE EXAMPLE
A proposed industrial network segmentation strategy with allowed-flow tests and controlled remote support.
For OT security leaders · Industrial network teams · Infrastructure managers
A manufacturing environment with broad trust between enterprise, site and cell networks needs a defined set of approved data paths and a controlled route for remote support.
Candidate stack: Siemens SCALANCE security appliances and managed switches · Virtualized industrial DMZ services · Managed remote access. Final selection depends on the actual site, supported versions, licenses and intended use.
Inventory assets and business flows, identify safety and production dependencies, and assign zone boundaries through a risk assessment. Purdue levels help describe placement; they do not by themselves establish IEC 62443 compliance.
Use firewalls and managed switching to allow named source, destination, service and direction combinations. NAT is an addressing tool, not an access-control substitute. Verify exact appliance features, firmware, licenses and rule behavior.
Use DMZ relays, proxies and controlled administrative sessions. Avoid dual-homed hosts that create an unmanaged bridge. Prohibit unapproved direct enterprise-to-controller access while preserving documented, mediated service flows.
Require managed remote entry, MFA, named users, time-limited authorization, least privilege and auditable sessions. Confirm device compatibility, disable unauthorized remote routes through an approved change, and test rollback.
Sanitized conceptual view. Each numbered boundary requires an approved interface; this is not an installation drawing.
No operational impact has been verified for this proposed architecture. The blueprint describes intended benefits; dated baseline and post-change measurements, the test period and acceptance by the responsible plant owner are needed before publishing them as achieved results.
Agree the baseline, test conditions, acceptance limits and evidence owners before implementation.
| Measure | Evidence to collect |
|---|---|
| Allowed and denied traffic | Test the complete approved-flow matrix in both directions. Capture firewall logs and verify denied paths without disrupting production. |
| Remote support governance | Verify approval expiry, identity revocation, session records and absence of unapproved bypass routes. |
| Operational behavior | Measure jitter, packet loss and required traffic before and after changes. Exercise recovery and rollback within site limits. |
These deliverables would form part of an agreed engagement. This page does not establish certification, regulatory approval, guaranteed availability or an achieved operational result.
Product documentation and guidance support design review; they do not verify a project outcome.
