Common control-network-segregation architectures
This section outlines the most common security practices that are currently used in industrial-control environments in terms of the architecture, design, deployment, and management of firewalls to separate a PCN from a corporate network.
The solutions presented are related to two main scenarios:
- Designs that utilize two-zone firewall-based designs without a DMZ
- Designs that utilize three-zone firewall-based designs with a DMZ
Dual-homing
There is also another scenario, which is often referred to as dual-homing. In this scenario, dual-network interface cards are installed either in a workstation or a control device that requires access to both the corporate network and PCN. Dual-homing is an easy way to connect the corporate network to the PCN, but it puts the dual-homed device at a significant security risk, even if a personal firewall is installed on it. For this reason, it is rarely used and will not be examined...
