Segmenting an OT network around electronic security perimeters

Start from the asset list, not the network diagram

Segmentation is only as good as your inventory. Before drawing any boundary, list the BES Cyber Systems identified under CIP-002 and every device that talks to them — relays, RTUs and RTACs, HMIs, historians, engineering workstations, network gear.

For each one, record what it needs to talk to and why. That list of required flows becomes your rule base; anything not on it is denied.

Define the electronic security perimeter (ESP)

• Put every high- and medium-impact BES Cyber System with routable connectivity inside a defined ESP.
• Identify each Electronic Access Point (EAP) — normally the firewall interfaces where routable traffic crosses the boundary.
• Keep the perimeter as small as the operation allows: fewer devices inside means fewer to protect and evidence.
• Document dial-up and non-routable paths too; they are boundaries even when they are not IP.

Build zones inside the plant

A flat ESP still lets one compromised workstation reach every relay. Split it into zones by function — control, protection, engineering, historian/DMZ — and allow only the flows each zone needs.

Put anything that must reach the corporate network (historian replicas, patch staging, remote-access jump hosts) in a separate DMZ between the ESP and IT, never with a direct path through.

Inbound and outbound rules with a reason

• Deny by default, in both directions, at every EAP.
• Give every permit rule an owner and a documented business reason — CIP-005 R1 asks why each inbound and outbound access permission exists.
• Review the rule base on a schedule and remove rules nobody can justify.
• Detect known or suspected malicious communications at the EAP where your platform supports it.

Interactive remote access

• Route all interactive remote access through an intermediate system (jump host) outside the ESP.
• Require multi-factor authentication and encryption that terminates at that intermediate system.
• Be able to see, and stop, active vendor remote-access sessions.

Evidence that the boundary holds

Auditors want to see that the design is real: current firewall configurations, the documented reasons for each rule, review records, and logs showing access through the EAPs. Collect them continuously rather than assembling screenshots before an audit.