implementing-network-segmentation-for-ot

name	implementing-network-segmentation-for-ot
description	Implements OT network segmentation using VLANs, OT-aware firewalls, data diodes, and IEC 62443 zone/conduit architecture, with a traffic-baseline-driven design tool for migrating flat Purdue-model networks without disrupting operations. Use when segmenting a flat OT network into Purdue levels, deploying an IT/OT DMZ, or isolating safety instrumented systems from basic process control systems.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","scada","industrial-control","iec62443","network-segmentation","vlan"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]
mitre_attack	["T1078","T1190","T1059","T0816","T0836"]

Implementing Network Segmentation for OT

When to Use

• When an OT security assessment reveals a flat network with no segmentation between Purdue levels
• When implementing IEC 62443 zone/conduit architecture after completing risk assessment (IEC 62443-3-2)
• When separating IT and OT networks as part of an IT/OT convergence security initiative
• When deploying a DMZ between corporate IT and OT to protect industrial systems from IT-originating threats
• When segmenting safety instrumented systems (SIS) from basic process control systems (BPCS)

Do not use for IT-only microsegmentation without OT components (see implementing-zero-trust-in-cloud), or for initial zone design without prior traffic analysis (see performing-ot-network-security-assessment first).

Prerequisites

• Complete traffic baseline from passive monitoring (minimum 2-4 weeks of capture data)
• Asset inventory with Purdue level classifications for all OT devices
• Industrial-grade network switches with VLAN support and port security
• OT-aware firewalls (Cisco ISA-3000, Fortinet FortiGate Rugged, Palo Alto with OT Security)
• Maintenance window schedule for network changes
• Rollback plan approved by operations management

Workflow

Step 1: Design Segmentation Architecture Based on Traffic Baseline

Use the traffic baseline to design VLAN and firewall architecture that preserves all legitimate communication paths while isolating zones.

#!/usr/bin/env python3
"""OT Network Segmentation Design Tool.

Analyzes traffic baseline data and generates a segmentation design
with VLAN assignments, firewall rules, and migration plan.
"""

import json
import sys
from collections import defaultdict
from dataclasses import dataclass, field, asdict
from ipaddress import ip_address, ip_network


@dataclass
class VLANDesign:
    vlan_id: int
    name: str
    purdue_level: str
    subnet: str
    gateway: str
    description: 
    devices:  = field(default_factory=)



 :
    rule_id: 
    source_zone: 
    source_ip: 
    dest_zone: 
    dest_ip: 
    protocol: 
    port: 
    action: 
    dpi_profile:  = 
    comment:  = 


 :
    

     ():
         (baseline_file)  f:
            .baseline = json.load(f)
        .vlans = []
        .rules = []
        .rule_counter = 

     ():
        
        .vlans = [
            VLANDesign(, , ,
                       , ,
                       ),
            VLANDesign(, , ,
                       , ,
                       ),
            VLANDesign(, , ,
                       , ,
                       ),
            VLANDesign(, , ,
                       , ,
                       ),
            VLANDesign(, , ,
                       , ,
                       ),
            VLANDesign(, , ,
                       , ,
                       ),
            VLANDesign(, , ,
                       , ,
                       ),
        ]
         .vlans

     ():
        
        .rules = []

        
        zone_pairs = [
            (, ),
            (, ),
            (, ),
            (, ),
        ]

        
         flow  .baseline.get(, []):
            .rules.append(FirewallRule(
                rule_id=.rule_counter,
                source_zone=flow[],
                source_ip=flow[],
                dest_zone=flow[],
                dest_ip=flow[],
                protocol=flow.get(, ),
                port=flow.get(, ),
                action=,
                dpi_profile=._get_dpi_profile(flow.get(, )),
                comment=,
            ))
            .rule_counter += 

        
         src_zone, dst_zone  zone_pairs:
            .rules.append(FirewallRule(
                rule_id=.rule_counter,
                source_zone=src_zone,
                source_ip=,
                dest_zone=dst_zone,
                dest_ip=,
                protocol=,
                port=,
                action=,
                comment=,
            ))
            .rule_counter += 

         .rules

     ():
        
        dpi_profiles = {
            : ,
            : ,
            : ,
            : ,
            : ,
        }
         dpi_profiles.get(port, )

     ():
        
        plan = {
            : {
                : ,
                : ,
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : ,
            },
            : {
                : ,
                : ,
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : ,
            },
            : {
                : ,
                : ,
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : ,
            },
            : {
                : ,
                : ,
                : [
                    ,
                    ,
                    ,
                    ,
                    ,
                ],
                : ,
            },
        }
         plan

     ():
        
        design = {
            : [asdict(v)  v  .vlans],
            : [asdict(r)  r  .rules],
            : .generate_migration_plan(),
        }

         (output_file, )  f:
            json.dump(design, f, indent=)

        ()
        ()
        ()

         design


 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()

    designer = SegmentationDesigner(sys.argv[])
    designer.design_vlans()
    designer.generate_firewall_rules_from_baseline()

    output = sys.argv[]  (sys.argv) >   
    designer.export_design(output)