Network segmentation (IT/OT separation) in SCADA systems - Step-by-Step Execution

Process Flow - Network segmentation (IT/OT separation)

Start: Network Traffic

↓

Traffic arrives at Firewall

↓

Check: Source = IT or OT?

↓

Route to IT Zone

↓

Apply IT Policies

↓

Allow or Block Traffic

↓

End

Network traffic is checked by a firewall to see if it comes from IT or OT. Then it is routed and controlled separately to keep systems safe.

Execution Sample

SCADA systems

firewall_rule = {
  'source_zone': 'IT',
  'destination_zone': 'OT',
  'action': 'block'
}
apply_firewall_rule(firewall_rule)

This code blocks traffic from the IT zone to the OT zone using a firewall rule.

Process Table

Step	Traffic Source	Traffic Destination	Firewall Check	Action Taken	Result
1	IT	OT	Source=IT, Dest=OT	Block	Traffic blocked between IT and OT
2	IT	IT	Source=IT, Dest=IT	Allow	Traffic allowed within IT zone
3	OT	OT	Source=OT, Dest=OT	Allow	Traffic allowed within OT zone
4	OT	IT	Source=OT, Dest=IT	Block	Traffic blocked between OT and IT
5	Unknown	IT	Source unknown	Block	Traffic blocked due to unknown source

💡 Traffic is either allowed or blocked based on source and destination zones to keep IT and OT separated.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5
traffic_source	None	IT	IT	OT	OT	Unknown
traffic_destination	None	OT	IT	OT	IT	IT
firewall_action	None	Block	Allow	Allow	Block	Block

Key Moments - 2 Insights

Why is traffic from IT to OT blocked but traffic within IT allowed?

Because the firewall rules separate IT and OT zones to protect OT systems. Execution table rows 1 and 2 show blocking between zones and allowing inside the same zone.

What happens if the source of traffic is unknown?

Traffic is blocked by default to keep the network safe, as shown in execution table row 5.

Visual Quiz - 3 Questions

Look at the execution table, what action is taken when traffic source is OT and destination is IT?

A Allow

B Log only

C Block

D Redirect

💡 Hint

Check row 4 in the execution table where source=OT and destination=IT.

At which step does the firewall allow traffic within the OT zone?

A Step 1

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the execution table row where source and destination are both OT.

If the firewall action for unknown sources changed to 'Allow', how would the result in step 5 change?

A Traffic would be allowed

B Traffic would be blocked

C Traffic would be redirected

D No change

💡 Hint

Refer to variable_tracker and execution_table row 5 for current action and result.

Concept Snapshot

Network segmentation separates IT and OT zones.
Firewall checks source and destination zones.
Traffic between IT and OT is blocked.
Traffic inside the same zone is allowed.
Unknown sources are blocked by default.
This protects critical OT systems from IT threats.

Full Transcript

Network segmentation means dividing a network into parts to keep IT systems separate from OT systems. When network traffic arrives, a firewall checks if it comes from IT or OT. If traffic tries to go from IT to OT or OT to IT, the firewall blocks it. Traffic inside IT or inside OT is allowed. If the source is unknown, the firewall blocks the traffic to keep the network safe. This way, the OT systems that control important machines stay protected from IT network risks.