What is Network Segmentation?
Network Segmentation is an architecture method dividing a network into smaller isolated segments – VLANs, subnets or DMZs – to limit the spread of faults and attacks, with IT/OT separation being the most critical boundary in facility environments.
Technical Definition: An architecture method dividing a network into smaller isolated segments – VLANs, subnets or DMZs – to limit the spread of faults and attacks. In OT environments, the most critical segmentation is between IT (office) and OT (control) networks, with a DMZ as the secure data exchange zone.
Why it matters: Network segmentation is the most effective single defence in OT environments. When ransomware attacks the IT network, correct segmentation prevents it from spreading to the control systems that keep the building running.
Micro-segmentation: Dividing the OT network into smaller zones limits the blast radius of any breach – an attack reaching one zone cannot automatically spread across all control systems.
Application-based segmentation: Using software-defined segmentation to create logical boundaries around applications in all network segments that have contact with external networks.
HubMind’s view: We design OT network architectures based on IEC 62443 with clear segmentation between IT, OT and field device layers, protecting your facility from virus spreading from office networks to control systems.
Want to know more about Network Segmentation?
HubMind helps you understand and apply Network Segmentation in your facility.