Industrial DMZ is a buffer zone positioned between IT and OT networks that controls and inspects all traffic crossing the IT/OT boundary. It prevents direct communication between enterprise systems and industrial control systems by requiring every data exchange to pass through intermediary services hosted inside the DMZ. In the Purdue model it sits at Level 3.5, between the enterprise and the plant floor.
How does an industrial DMZ work?
An industrial DMZ follows the same principle as a traditional IT DMZ but addresses constraints specific to OT. In a standard IT DMZ, web servers and mail relays sit between the internet and the internal network, terminating external connections and starting new internal ones so no single session spans both zones. An industrial DMZ applies that pattern to the IT/OT boundary.
Inside the DMZ, intermediary services broker all communication between the enterprise and the plant floor. A historian mirror replicates process data from the OT historian to a read-only copy that enterprise BI tools can query. A patch management relay stages firmware downloaded from vendor sites on the IT side, then pushes it to OT assets on a controlled schedule. A remote access jump server terminates VPN sessions from corporate users and opens separate, audited sessions into the OT network.
The critical rule is that no single network session should traverse the DMZ end to end. An enterprise user connects to the jump server in the DMZ. The jump server then opens a separate connection to the target OT asset. This session break stops an attacker who compromises an enterprise system from establishing a direct path to OT controllers.
Why does an industrial DMZ matter for OT?
The IT/OT boundary is the path ransomware travels. When Colonial Pipeline was hit in May 2021, the operator shut down OT deliberately because it could not be confident the IT compromise stayed on the IT side. A well-built industrial DMZ is what gives an operator that confidence.
An industrial DMZ also has to respect OT protocol behavior that an IT DMZ never sees. Modbus TCP, EtherNet/IP, and OPC UA have different latency tolerances, session semantics, and security capabilities than HTTP or SMTP. The DMZ must not introduce latency or jitter that could disrupt a real-time control loop.
What are common industrial DMZ patterns?
A food and beverage manufacturer running a Level 3 MES that has to send production counts to a Level 4 ERP deploys an industrial DMZ between them. The MES pushes data to a database relay in the DMZ. The ERP pulls from that relay. Neither system talks directly to the other, so ransomware on the ERP cannot pivot through it to the MES or the PLCs behind it. In water and wastewater, SCADA systems that report telemetry to state regulators often need an internet-facing export path, and a unidirectional gateway lets data leave the OT network without allowing any inbound connection.
Common implementation patterns:
- Data diodes and unidirectional gateways: hardware-enforced one-way flow from OT to IT, physically preventing any return path.
- Proxy-based DMZ: application-layer proxies that parse, validate, and re-create protocol messages at the boundary.
- Jump server DMZ: remote access terminated in the DMZ and re-initiated as a separate session into the OT zone.
How is an industrial DMZ different from an IT DMZ, and which standards require it?
An IT DMZ shields internet-facing services; an industrial DMZ shields safety-critical control systems and must protect availability first, not just confidentiality. The requirement is written into the major frameworks. IEC 62443 calls for a conduit between the enterprise zone and the control zone with defined security requirements. NERC CIP-005 requires Electronic Security Perimeters with Electronic Access Points that act as DMZ enforcement. NIST SP 800-82 recommends an industrial DMZ as a best practice for IT/OT boundary protection. NIS2 segmentation obligations are supported by documented DMZ architectures.
How Access Gate helps
Access Gate enforces IT/OT boundary controls by creating overlay-based DMZ segments where intermediary services broker all cross-boundary traffic, without requiring inline appliances in the production network path. Learn more at Industrial DMZ.
