Industrial Network Architecture: Separating OT and IT Networks in Your Factory

Why OT/IT Separation Matters

In 2021, a water treatment plant in Florida was hacked through its SCADA system — an attacker remotely increased sodium hydroxide to dangerous levels. The attack vector: the SCADA PC was on the same network as the office IT. OT (Operational Technology) networks controlling physical equipment must be isolated from IT networks.

The Purdue Model

The industry-standard reference architecture divides industrial networks into five levels: Level 0 (field devices/sensors), Level 1 (PLCs/controllers), Level 2 (SCADA/DCS), Level 3 (plant operations/MES), and Level 4 (enterprise IT/ERP). Communication between levels should be strictly controlled and unidirectional where possible.

Practical Implementation for Indian SMEs

For a typical Indian manufacturing facility, you need at minimum: a separate VLAN or physical network for PLC traffic, a DMZ server (your data gateway) that collects PLC data and pushes it to the cloud one-way, and a firewall with strict rules allowing NO inbound connections from the internet to PLC network.

The Data Diode Approach

For high-security applications (pharma, defence, critical infrastructure), use a hardware data diode — a device that physically can only transmit data in one direction. Data flows from the OT network to the IT/cloud network, but no traffic can flow back. This makes remote hacking of PLCs physically impossible.