Industrial Control Systems (ICS) Security & Network Segmentation
Intrix secures industrial control systems by designing and implementing segmented network architectures that isolate operational technology from corporate IT. Our ICS security services cover Purdue Model implementation, DMZ architecture, IT/OT isolation, and vendor access controls, aligned with ISA/IEC 62443 for manufacturers and critical infrastructure operators across Australia.
The Threat from Within: IT-to-OT Contamination
Your Industrial Control Systems (ICS) and PLCs are now connected to your corporate IT network to provide business data and remote monitoring. But this connection is a two-way street that attackers are exploiting
Flat Network Architecture
Many manufacturers run flat networks, letting attackers move freely between IT and OT once they get in
No Internal Defences
Perimeter security trusts the inside—but modern attacks start inside, making that trust dangerous
Intrix IT/OT Network Segmentation & Architecture Design
Network segmentation is a core control for OT security. We design and implement segmented architectures that isolate your critical production zones from the rest of your network
Secure Architecture Design
We design a secure, defensible architecture based on the Purdue Model, creating clear boundaries between your industrial security zones
Purdue Model zone definition and implementation
Security zone and conduit design per ISA/IEC 62443-3-2
Critical asset identification and zone assignment
Defence-in-depth strategy with multiple security layers
Network topology design and VLAN architecture
Redundancy and high availability considerations
IT/OT Isolation
We deploy firewalls and controls to isolate your OT systems from IT, creating secure boundaries with tightly controlled access points
Industrial firewall deployment and configuration
DMZ (Industrial Demilitarised Zone) architecture design
Data diode implementation for one-way data flows
Unidirectional gateways for secure data extraction
Access control lists (ACLs) and firewall rule development
Secure remote access solutions for vendors and support
The Purdue Model: Industrial Network Architecture Standard
The Purdue Model (ISA-95) is the industry-standard framework for organising industrial networks into hierarchical security zones. Each level has distinct functions, security requirements, and boundaries
Physical Process
Phase 1
The actual physical equipment, production machinery, and industrial processes being controlled
Basic Control
Phase 2
Intelligent devices, drives, sensors, and actuators performing real-time control functions
Enterprise Network
Phase 3
Corporate IT network including ERP systems, email, office applications, and business intelligence platforms
Supervisory Control
Phase 4
Local control systems—PLCs and DCS—that directly supervise and control production processes
Manufacturing Operations Management
Phase 5
SCADA, Historians, and HMI servers that run and monitor your production
Business Planning & Logistics
Phase 6
MES, EAM, and other plant-level business systems that bridge IT and OT
Comprehensive Implementation Services
According to the Australian Cyber Security Centre, ransomware attacks on OT environments can halt production for weeks and cause lasting damage to physical equipment.
Segmentation Roadmap
Phased implementation plan that minimises disruption to production while progressively improving security
Network Architecture Assessment
Comprehensive review of your existing network topology to identify segmentation gaps and lateral movement risks
Monitoring & Validation
Continuous monitoring and regular validation to ensure segmentation controls remain effective
Firewall & DMZ Implementation
Design and deployment of industrial firewalls and DMZ architectures to enforce segmentation boundaries
Our ICS security work sits within a broader OT security programme covering vulnerability assessments and compliance. For operators of critical assets, see our critical infrastructure security services.
Frequently Asked Questions
Won't network segmentation disrupt our production operations?
We design segmentation implementations to be phased and aligned with your maintenance windows. Our approach includes extensive traffic analysis to understand all legitimate data flows before implementing controls. We also provide parallel testing and rollback procedures to ensure zero production impact. The goal is invisible security that protects without disrupting operations
What is a DMZ and why do we need one for IT/OT convergence?
A DMZ, or demilitarised zone, is an isolated network segment that sits between your corporate IT network and your operational technology environment, controlling what data can pass between the two. Without a DMZ, a compromise in your corporate network, such as a phishing attack or ransomware infection, can move directly into your industrial control systems and disrupt physical operations. For IT/OT convergence, a DMZ allows data to flow to business systems for reporting and analysis while ensuring no direct connection exists between the internet-facing IT environment and safety-critical OT assets.
How does segmentation prevent lateral movement?
Lateral movement occurs when an attacker who has compromised one system uses that access to reach other systems across a flat network. Segmentation divides the network into isolated zones with strict controls over what traffic can pass between them, so a compromised workstation in one zone cannot communicate with a PLC or historian in another. This means a breach is contained to the point of entry rather than cascading across the entire environment.
Can we implement the Purdue Model in an existing facility, or only in new builds?
The Purdue Model can be implemented in existing facilities and does not require a greenfield environment. Intrix begins with passive network monitoring to map all existing traffic flows and asset communications before introducing any controls, ensuring that segmentation boundaries are drawn around how the environment actually operates rather than how it was designed on paper. Controls are introduced in phases aligned with maintenance windows to avoid disrupting production.
How do we allow vendor remote access without breaking our segmentation?
Vendor remote access is managed through a dedicated, isolated access pathway that connects to only the specific assets the vendor needs to reach, rather than granting broad network access. This is typically implemented using a jump server or secure remote access gateway within the DMZ, with multi-factor authentication, time-limited sessions, and full session recording. Intrix designs vendor access architectures that meet IEC 62443 requirements while maintaining the integrity of your segmentation boundaries.
What's the typical ROI on network segmentation?
ROI on network segmentation comes from two primary sources: the cost of a contained incident compared to an uncontained one, and the reduction in compliance scope that reduces audit and remediation costs. A ransomware attack on a flat OT network can halt production for days or weeks, while effective segmentation typically limits the impact to a single zone. For organisations subject to the SOCI Act or IEC 62443, segmentation also reduces the number of assets in scope for compliance assessment, lowering ongoing program costs.
Create a Digital "Air-Gap" for the 21st Century
Don’t let a compromised office workstation shut down your entire production line. Contact Intrix to design a secure network architecture for your plant