Map the process before drawing the firewall.
A segmentation project begins with the system under consideration: its equipment, operators, supporting services, and physical consequences. MSS Works Industrial Security uses the Purdue model to organize that discussion, then defines IEC 62443 zones around common security requirements. The two ideas are related, but they are not interchangeable. A single Purdue level can contain several zones with different owners, criticality, and access requirements.
At Level 0, we identify the process and field devices. Level 1 contains basic control such as PLCs and remote terminal units. Level 2 brings supervisory control and operator interfaces; Level 3 supports site operations, including historians and engineering services. We document required flows between these functions before choosing enforcement points. Safety systems need their own analysis, including independence from ordinary control and monitoring infrastructure.
Give enterprise traffic a deliberate stopping point.
The industrial DMZ, commonly called Level 3.5, mediates exchanges between site operations and enterprise systems. A reporting replica, managed transfer service, and controlled remote access broker can live at this boundary. Avoid a workstation with simultaneous trusted access to both sides. Place each service on an explicit conduit with documented authentication, direction, logging, and recovery behavior.
A ransomware event in corporate IT should not inherit an unrestricted path to a control cabinet. Separate identity dependencies, review shared administration channels, and remove direct enterprise routes to controllers. A VLAN can organize traffic, but a boundary needs enforceable policy and tested routing. Review alternate paths through wireless bridges, maintenance laptops, vendor modems, and dual-connected servers before declaring a zone isolated.
Protect controllers that cannot protect themselves.
Legacy Allen-Bradley and Siemens installations often depend on protocols and engineering practices that predate current identity controls. We record exact controller families, firmware constraints, engineering workstations, and recovery procedures. Compensating measures can include cell-level firewalls, dedicated engineering access, physical port control, and tightly governed change windows. Product-specific testing matters: a rule that works for one controller generation may interrupt another.
Authorized programming remains a controlled activity. Define who may connect, from which workstation, during what window, and with which rollback materials. Keep verified logic backups and recovery instructions available outside the ordinary production administration path. Begin enforcement in a reviewed observation phase, then test representative operating states before narrowing access. Startup, shutdown, maintenance, and failover may use flows absent from steady production.
Use a diode where the business only needs a copy.
A hardware data diode enforces a physical transmission direction. It belongs on a boundary where outward data transfer satisfies the requirement, such as exporting a historian replica from operations into an industrial DMZ. Ordinary interactive TCP sessions cannot simply pass through a one-way link unchanged. Compatible gateways terminate and replicate supported application data, with buffering and loss behavior that must be understood.
An inbound command path cannot share that one-way export promise. Keep operational commands within approved control conduits and review remote support separately. Commissioning must cover stale-data indicators, replication outages, timestamp consistency, and recovery after the receiving side returns. Give operators a clear way to distinguish a reporting failure from a process failure. An export boundary should not become a hidden dependency for local control.
Make the design maintainable.
Our review package records zone ownership, conduit purpose, endpoint groups, enforcement controls, and change authority. Target security levels are established through risk assessment; they are not automatically assigned by Purdue level or equipment type. The final design also needs evidence that its requirements can be met throughout operation. A named owner, a test record, and an understandable exception register are as important as the firewall appliance.