Technical capability
Network Segmentation Engineering
Zones, conduits, architecture drawings, firewall schedules, and migration planning for live industrial networks.
When segmentation needs engineering work
The problem
Flat or poorly segmented OT networks increase the risk that a compromise of one device, workstation, or vendor connection could affect wider operational systems.
Who it is for
- industrial operators with flat, shared, or poorly documented OT networks
- project teams designing a new control system or significant network change
- engineering teams that need a staged brownfield segmentation plan
A zone model is useful only when its conduits and permitted communications are understood. Dividing a network into VLANs without controlling the paths between them is not a complete segmentation design.
Information needed before drawing zones
Inputs
- current network drawings, switch and firewall information, and IP schedules
- asset criticality, process dependency, and required communication information
- operational constraints, outage opportunities, and supplier support requirements
A defined design boundary
- segmentation design for a production site with several control-system cells
- zone and conduit model covering SCADA, engineering, historian, and vendor access
- conceptual and detailed rules sufficient for implementation planning
From required communications to target architecture
Sequence
- establish system boundaries and the communications that operations must retain
- group assets into defensible zones based on function, risk, and operational dependency
- define conduits, permitted flows, management access, and monitoring points
- develop a reviewable target design and a phased migration plan
Design decisions
- define zones from function, risk and operating dependency rather than VLAN convenience
- identify every required inter-zone flow and its owner
- translate approved flows into implementable firewall rule requirements
- show management, monitoring and vendor-access paths on the target architecture
- sequence brownfield changes around testing, rollback and outage constraints
Design package
Deliverables
- segmentation strategy
- zone and conduit model
- network architecture drawings
- firewall rule schedule
- migration plan
- residual risk summary
Worked example: Turning a historian connection into a conduit rule
- Requirement
- Operations need selected process data in the site historian; historian administration must not create a general path back into the control zone.
- Design check
- Confirm source and destination hosts, protocol, direction, initiation point, timing, name resolution and support method. Record any vendor-specific dependency that prevents a narrower rule.
- Design output
- Place the data flow in a named conduit, define the permitted endpoints and services, and show the management path separately on the architecture drawing.
- Verification
- Test the approved flow and expected denial cases, retain the rule extract and results, and record any temporary commissioning rule for removal.
What segmentation does not solve
Not included unless separately agreed
- firewall or switch installation and live configuration unless separately agreed
- assurance that segmentation alone makes the environment secure
- changes to safety or control logic
Standards and guidance referenced
Related support and guidance
Related services
Choose this when your project needs specialist engineering capacity. A defined OT cybersecurity work package for risk, architecture, design review, supplier interfaces and assurance evidence within an active industrial project.
Discuss network segmentation engineering
Use the 30-minute introductory call to outline the system, decision, project stage and evidence currently available. Keep sensitive site details out of the booking form.