What Is OT/IT Network Segmentation?

The Founder's Explanation (Teach Exactly This Way)

"In a factory, you do not let visitors walk straight from the front office onto the running shop floor. There are separate rooms, and one guarded door between them. If a problem starts in the office, it does not spread to the machines. Segmentation puts the BACnet controllers in their own room, with one guarded door to the office network."

Teaching the Concept

Front Office and Shop Floor A factory does not let visitors wander from the front office straight onto the running shop floor. The two are separate rooms with one guarded door between them. Segmentation puts the building controllers in their own room, with a single guarded crossing to the office network. One infected office PC then cannot reach a single controller. The Segmented Design ``` OT / BACnet subnet isolated, controllers only | DUAL-HOMED GATEWAY the ONLY crossing (controlled) | IT / office LAN PCs, users, internet ``` What It Buys ``` Contain an infected PC cannot reach controllers Control all OT<->IT traffic passes one guarded gate Audit one crossing to monitor and whitelist ``` Segmentation is a wall and a single guarded door between OT and IT — so an infected PC never reaches a controller.

---

Related Topics

• What is BMS integration? — how a BMS connects VFDs, meters and other systems
• What is a protocol in BMS? — the shared language controllers use to talk
• Browse all Protocols topics — more from this section of the EnSmart BMS Library