OT Network Segmentation: A Practical Guide for Singapore

OT network segmentation means dividing your operational technology environment into zones of assets that share security requirements, then controlling every path between those zones. Done well, a breach in one place stays in that place. Done badly, it is a set of VLANs that look tidy on a diagram and give an intruder a clear route to your controllers.

This guide is for security managers, facility owners, integrators and site operators in Singapore and the wider region. It covers the architecture, the controls that matter, the local guidance, and a phased way to roll it out without stopping production.

TL;DR

• Segmentation groups assets into zones and forces all traffic between zones through documented conduits, with the aim of containing a breach and blocking lateral movement.
• The Purdue model and IEC 62443 are the working reference for deciding where the boundaries go. The IT/OT boundary belongs in an industrial DMZ.
• VLANs alone are not enough. Pair them with industrial firewalls, deny-by-default rules and, where one-way flow is acceptable, unidirectional gateways.
• Singapore's CSA and IMDA both treat missing IT/OT separation as a core weakness, so segmentation also supports your compliance position.
• Start with visibility, then protect legacy and unpatchable systems first, and roll out in phases.

Table of Contents

• What OT network segmentation actually is
• Why OT can no longer rely on isolation
• The Purdue model as your map
• The controls that make segmentation real
• Why VLANs alone fall short
• Singapore: what the guidance expects
• A phased rollout that keeps production running
• Where physical security and sensing fit
• Our perspective
• How BeyondSensor can help
• FAQ
• Sources

What OT network segmentation actually is

A flat network is one in which any device can talk to almost any other. That was tolerable when plant networks were isolated. It is not tolerable now. Segmentation replaces the flat design with a structure:

• Zones are groups of assets with common security requirements, for example a set of PLCs on one production line, or the HMIs that supervise them.
• Conduits are the logical communication paths between zones. Each one must enforce documented security controls.

This zone and conduit vocabulary comes from IEC 62443, and the joint advisory from CISA and the US Coast Guard on insufficient IT and OT segmentation shows what happens when that boundary is poorly configured in a real critical infrastructure environment.

People also search for "industrial network segmentation". It is the same discipline. The word "industrial" simply points at the plant floor, while "OT" also covers building systems, utilities, access control hardware and the sensors that feed them.

Segmentation, segregation and VLANs

The terms get blurred, so here is a plain split:

Term	What it does	Typical tool
VLAN	Logical separation at Layer 2	Managed switches
Network segmentation	Splits the network into zones with controlled routing between them	Routers, firewalls, ACLs
Micro-segmentation	Restricts traffic between individual assets or applications	Application-aware firewalls, policy engines
Unidirectional gateway	Physically enforces one-way data flow	Data diode

So, is segmentation the same as a VLAN? No. A VLAN is one way to build a segment. Segmentation is the design goal, and it also needs enforcement and inspection at the boundaries.

Why OT can no longer rely on isolation

For years the safety story for plants was that they were air-gapped or at least obscure. That story has aged badly. In his 2024 keynote at the OT Cybersecurity Expert Panel Forum, Singapore's Minister Josephine Teo pointed to ICS-specific malware such as FrostyGoop as evidence that threats now target operational systems directly.

The practical consequences are familiar to anyone who runs a site:

• Remote vendor access, cloud analytics and sensor data feeds have connected networks that were never designed to be connected.
• Legacy controllers and end-of-life operating systems cannot be patched on a normal cycle.
• A compromised corporate laptop or a single IoT device can become the first step toward a control system.

CSA's advisory on protecting Safety Instrumented Systems lists lack of network segmentation between the corporate network and the ICS network among the factors that make an ICS vulnerable, alongside weak policies, unsecured remote access and legacy components. When the regulator names it first, it is a reasonable place to begin your own review.

The Purdue model as your map

Most segmentation designs still start from the Purdue Reference Architecture, also called PERA. It sorts assets into levels, and each level gets its own controls. Microsoft's network architecture guidance for OT and IoT lays out the layers this way:

Level	Contents	Segmentation stance
0	Physical process, sensors, actuators	Most protected, minimal connectivity
1	Basic control, PLCs	Talks only to Level 2 and peers that need it
2	Supervisory control, HMIs	Restricted to its production area
3	Site operations, historian	Gateway into the DMZ
3.5	Industrial DMZ	Brokered exchange point between IT and OT
4 to 5	Enterprise and business networks	Treated as untrusted from the OT side

The US Department of Energy's topic paper on the Purdue model and segmentation, written by a pipeline operator, is a useful field-level companion if you want to see how an operator applies the levels.

A caution. Purdue is a model, not a floor plan. Modern sites have cloud connections, wireless sensors and edge computing that do not sit neatly on a level. Use it to ask the right question for every asset: what should this device be allowed to talk to, and why?

The controls that make segmentation real

1. An industrial DMZ at the IT/OT boundary

No direct path should exist between enterprise systems and the control network. Data that has to cross, such as historian replication or patch files, lands in the DMZ first and is then pulled by the other side. Remote access terminates in the DMZ, not on a control network host.

2. Firewalls that understand industrial traffic

Singapore's guidance, as reflected in CSA's advisory, points to VLANs, industrial DMZs, application-layer firewalls and unidirectional gateways as the building blocks. Application-layer inspection matters because a rule that only says "allow port 502" does not tell you whether the command being sent is a read or a write to a controller.

3. Deny by default

The cleanest policy is to block everything and then permit only the flows you can name: source, destination, protocol, direction, purpose. CISA's analysis shows why: when the boundary rules are permissive, an intruder who gets into IT can reach OT. A deny-by-default conduit means each exception is a recorded decision rather than an accident.

4. Unidirectional gateways where one-way flow is enough

If a system only needs to send data out, such as telemetry to a reporting platform, a data diode removes the return path entirely. It will not suit every case, since many workflows need two-way exchange, but for monitoring feeds it is the strongest option.

5. Micro-segmentation inside zones

Vendors such as Fortinet describe how plants that used VLANs to split flat networks are now adding micro-segmentation to stop malware moving laterally within a VLAN. The principle holds whichever tools you choose: restrict east-west traffic, not only north-south.

Why VLANs alone fall short

Many organizations stop at VLANs because the switches already support them and the project feels finished. VLANs give logical isolation, but they do not inspect traffic. Once routing is enabled between VLANs without a firewall, or a switch is misconfigured, the separation is thinner than the diagram suggests.

Treat VLANs as the first layer of a stack:

1. VLANs for logical grouping and broadcast control.
2. Firewalls or access control lists at every inter-VLAN path.
3. Application-aware inspection on the conduits that matter most.
4. Monitoring, so you know what normal looks like and can spot what is not.

Singapore: what the guidance expects

Singapore has a well-developed policy frame for OT security, and segmentation shows up in most of it.

• CSA advisories. The Safety Instrumented Systems advisory names missing segmentation between corporate and ICS networks as a vulnerability factor.
• Critical information infrastructure. The Cybersecurity Code of Practice for CII, second edition, has a dedicated Network Segmentation section and a separate chapter of OT security requirements covering OT architecture. It applies to designated CII owners, so check whether your organization falls under it before treating it as binding.
• National strategy. CSA's OT Cybersecurity Masterplan 2024 was co-created with more than 60 organizations from across the OT ecosystem, including system integrators and solution providers, and frames the national direction.
• IoT devices. IMDA's IoT Cyber Security Guide recommends segmenting IoT from enterprise networks, because a single compromised device can be the way into enterprise systems. That matters for sensors, cameras and access devices on smart buildings.
• Design upstream. The Minister's 2024 OTCEP forum speech stresses building security into the design and deployment of OT systems rather than adding it afterwards.

For regional operators in Malaysia and the Philippines, requirements differ by country and sector, so confirm local obligations. Our overview of security compliance frameworks across Southeast Asia is a starting point.

A phased rollout that keeps production running

The most common reason segmentation projects stall is fear of breaking something. A phased plan removes most of that fear.

Phase 1: See what you have

Without visibility you cannot define a baseline of normal traffic. Build an asset inventory: device type, firmware, owner, location, and every communication it makes. Passive network monitoring is the safe way to discover flows in an OT environment because it does not poke fragile devices. Our security risk assessment checklist for facility owners helps frame this step.

Phase 2: Define zones and conduits

Group assets by function, criticality and risk, not by where the cable runs. Typical zones: safety systems, each production cell, supervisory systems, site operations, the DMZ, vendor access, and building and sensor systems. For each conduit, record what is allowed and why.

Phase 3: Protect the weakest first

CISA's guidance advises prioritizing segmentation for legacy OT and end-of-life software that can no longer receive patches. If a Windows host on the plant floor cannot be updated, wrap it in a tight zone with a firewall in front. This delivers more risk reduction per dollar than any other step.

Phase 4: Build the DMZ and move remote access into it

Place the IT/OT boundary in the DMZ, then require multi-factor authentication and session control for vendor and engineer access. Our article on bridging IT and OT with zero trust covers the interoperability side.

Phase 5: Enforce, monitor and test

Run new rules in monitor mode, review what would have been blocked, then enforce. Plan changes with the operations team and use maintenance windows. Our industrial automation checklist walks through the plan, pilot and deliver approach that works well here.

Common mistakes to avoid

• Drawing zones on paper and never verifying them with traffic data.
• Leaving a forgotten dual-homed workstation bridging IT and OT.
• Allowing "temporary" any-to-any rules that become permanent.
• Treating segmentation as the only control. It should work with MFA for remote access, intrusion detection and routine security assessments, in line with CISA's defense-in-depth advice.
• Ignoring physical security devices. Cameras, readers and sensors sit on the same networks and need their own zone.

Where physical security and sensing fit

Segmentation conversations often focus on controllers and forget the devices that guard the site. Video analytics servers, access control panels, visitor kiosks and patrol systems all generate traffic and many reach into corporate networks and cloud services. Every one of them is an entry point if left on a shared network.

Give them a dedicated zone, limit what they can reach, and monitor what they send. For a list of what to look for in sensing hardware from a security angle, see our guide to essential sensing technology features for industrial security.

Our perspective

We work at the point where sensors, AI software and security operations meet, and we see the same pattern across facilities. The segmentation design is rarely the problem. The problem is that security tools get added one at a time, from different vendors, each wanting its own connection into the network. Within a few years nobody can say which device talks to what.

Our view is that segmentation should be planned together with the security technology that will live inside it. Decide the zones for your cameras, analytics, patrol and visitor systems before you buy, so each product arrives with a defined place and a defined set of permitted flows. Multi-vendor environments are normal in Southeast Asia, and the integration layer is where discipline matters most.

We also think validation should be local. Regional requirements, site conditions and legacy equipment differ between Singapore, Malaysia and the Philippines, and a design that works in one place needs testing before it is trusted in another. That is why we pair engineering with regional technical validation rather than shipping a generic reference design.

Finally, segmentation is a means, not the end. The aim is exception-based operations: a network where normal is well understood, so that people spend their attention on the events that are not normal.

— Eumir

How BeyondSensor can help

If you are planning a segmentation project that involves security technology, our Solution Integration service supports integrators and solution providers who need to fit multi-vendor systems into a controlled architecture. If you are still working out which technologies belong in your ecosystem, Ecosystem Matchmaking is where to begin. You can also explore our BeyondSecure product line, or talk to us about your site.

FAQ

What are the different types of network segmentation?

The main types are physical segmentation using separate hardware, logical segmentation using VLANs and subnets, firewall-based segmentation between zones, and micro-segmentation at the asset or application level. Unidirectional gateways add a one-way variant. Most OT networks combine several of these.

What is OT network architecture?

It is the layout of the systems that monitor and control physical processes, usually described with the Purdue model: field devices at Level 0, controllers at Level 1, supervisory systems at Level 2, site operations at Level 3, an industrial DMZ at Level 3.5, and enterprise networks above. The architecture defines which levels may communicate and through what controls.

Is network segmentation the same as a VLAN?

No. A VLAN is a Layer 2 mechanism for separating traffic logically, while segmentation is the wider design of zones and controlled paths between them. VLANs do not inspect traffic, so they should be paired with firewalls or access control lists at every crossing point.

Do we have to segment if our site is not designated critical infrastructure?

The CII Code of Practice binds designated owners only, but CSA's advisories and IMDA's IoT guidance treat segmentation as a general good practice. A flat network exposes any site to the same lateral movement risk. Confirm your specific obligations with your regulator or legal adviser.

Sources

• CISA and USCG joint advisory on cyber hygiene improvement
• CSA advisory: Protect your ICS Safety Instrumented Systems
• Keynote address by Minister Josephine Teo, OT Cybersecurity Expert Panel Forum
• Speech by Minister Josephine Teo at the OTCEP Forum (MDDI)
• Microsoft Defender for IoT and your network architecture
• Purdue Model Framework for ICS and Cybersecurity Segmentation (US Department of Energy)
• Securing OT with Network Microsegmentation (Fortinet)
• Cybersecurity Code of Practice for Critical Information Infrastructure
• Singapore's OT Cybersecurity Masterplan 2024 (CSA)
• IMDA IoT Cyber Security Guide

Recommended

• Role-Based Access Control: A Practical Guide for Singapore Security Teams
• Security compliance: Key frameworks for Southeast Asia
• Sensor Network Topology: Design Principles and Trade-Offs
• IP Subnet Calculator