Network Security Basics in OT Environments

Learning objectives

Design a layered OT network at a conceptual level.
Compare firewalls, DMZs, one-way gateways, IDS and secure remote access.
Write a default-deny conduit policy.
Explain why monitoring must be engineered for OT.

Introduction

This module introduces network security controls in operational environments.

Planned video lesson

Module 10 video lesson

Video lesson coming soon. The written module can be completed without the video.

Planned recording: 10-12 minutes turning a flat Riverside network into zones, an industrial DMZ and a controlled remote-support path.

Transcript will be added with the video.

Main lesson

Architecture before appliances

Network security begins by reducing unnecessary communication paths. A common pattern is:

Separate enterprise and OT networks.
Place shared exchange services in an industrial DMZ.
Divide OT into zones based on function and risk.
Permit only required conduits.
Control privileged and remote access through managed intermediary systems.
Monitor boundary and high-value activity.
Provide a tested isolation and recovery strategy.

The Purdue model or ISA-95 levels can help describe hierarchy, but they do not replace a risk-based zone model. Modern systems may include cloud services, IIoT gateways and remote operations that do not fit a simple pyramid.

What the main controls do

Control	Useful purpose	Limitation to manage
Industrial firewall	Enforce approved communication between zones	Weak rules or unmanaged changes defeat the boundary
Industrial DMZ	Prevent direct enterprise-to-control connections and host exchange services	A DMZ is not a dumping ground for every shared server
One-way gateway / data diode	Strongly constrain flow direction	Return traffic, control and maintenance use cases may need another design
Passive IDS / network monitoring	Detect unusual assets, flows and protocol actions	Requires a baseline, tuning and an owned response
VPN	Protect a network path across an untrusted network	Does not by itself ensure the user, device, destination or activity is authorised
Jump host	Concentrate and control administrative access	Becomes a high-value asset needing hardening, logging and recovery
MFA	Add independent evidence during authentication	Must cover the real privileged path, including emergency and vendor access

Default deny requires engineering evidence

For every conduit:

Deny traffic unless a requirement justifies it.
Limit source and destination.
Limit service, direction and initiator.
Separate administration from normal process traffic where practicable.
Log relevant permitted and denied activity.
Review temporary rules and expiry.
Test normal operation and failure behaviour.

“Allow any from OT to IT” is not a designed conduit.

Secure remote access as a controlled session

A strong remote-support path normally includes:

Business approval and a valid work request.
Named user identity and MFA.
Managed and security-checked remote device.
VPN termination outside the control zone.
Access through a hardened jump host.
Time-limited authorisation to named assets and services.
Session logging or supervision appropriate to risk.
Change recording and post-session checks.
Disabled access when no approved session exists.

Avoid direct vendor VPN access to controllers.

Monitoring without harming the process

Passive monitoring is often preferred because aggressive discovery or vulnerability scanning can overload or destabilise legacy devices. Build a baseline of:

Expected assets.
Expected communication pairs.
Protocols and functions.
Engineering downloads.
New or changed devices.
Authentication failures.
Boundary-policy changes.
Time, backup and security-service failures.

Detection is only useful when an owner can assess and respond. Define the escalation path before enabling alarms.

Design isolation and degraded operation

Ask:

Can enterprise connectivity be removed while local control continues?
Can remote access be disabled without losing essential maintenance?
Can the site operate locally if central SCADA is unavailable?
Which protective functions must remain independent?
How will operators know the system is degraded?
How will normal connectivity be restored safely?

Planned original figure — M10-F01

Create a layered Riverside architecture with enterprise, industrial DMZ, operations, control, protective-function and remote-access zones. Label every conduit.

Planned asset: /static/training/ot-cyber-security/module-10/figure-01.svg

Engineering example

Riverside application

Riverside combines local control, central telemetry, business reporting and vendor support, so its architecture needs several controlled trust boundaries.

Practical activity

Apply what you learned

Write a conceptual rule for each conduit using:

Source zone - destination zone - initiator - service - purpose - logging - owner

Then write the station's degraded-mode statement if:

Enterprise reporting is lost.
Central SCADA is lost.
Remote support is disabled.
The protective-function network boundary fails.

Your response (optional)

Record your reasoning and project notes here. Your response stays in this browser and is not submitted to the website.

Loading saved response…

0 / 10,000

Do not enter real credentials, confidential network details, sensitive asset information or security-sensitive project data.

Knowledge check

Answer every question correctly to complete this module. If an answer is incorrect, review the explanation and try again. This is not a formal examination.

1. A vendor proposes a VPN account that connects its laptop directly to any PLC. What is the principal design weakness?

VPN encryption adds unacceptable latency to every industrial protocol used by the PLCs.A VPN should terminate on the same controller so that encryption remains end to end.The route lacks brokered access, device assurance, least privilege, time limits and session evidence.

2. Which service is the strongest candidate for an industrial DMZ?

A broker that mediates approved data exchange so enterprise hosts do not communicate directly with the control zone.The primary PLC engineering service, because engineers need access from both enterprise and OT networks.A domain controller shared by enterprise users and control-system devices to avoid duplicate identity services.

3. How should a team begin discovering assets on a fragile legacy OT network?

Run a full authenticated vulnerability scan during normal production to capture every active device.Start with records and passive observation; assess active methods in a safe environment and approved window.Send a low-rate ping sweep because ICMP cannot affect industrial device application processing.

0 of 3 questions answered correctly.

Key takeaways

Remember these points

Architecture and controlled trust boundaries come before individual security appliances.
Remote access requires identity, device, authorisation, destination, time, monitoring and change controls.
Active testing must be assessed because unexpected traffic can disrupt fragile OT devices.

Relevant standards and guidance

This module uses original explanatory language. Consult the applicable editions and project requirements rather than treating this lesson as normative text.

ISA/IEC 62443-3-3
NCSC secure connectivity principles for OT

Last reviewed

15 July 2026.