Skip to main content
Orion Five Engineering

10 Jalan Kilang #04-05, Singapore 159410
+65 6100 5505

Resources · Tool

OT/IT Segmentation Planner

Tick the things that happen on your site — a vendor dialling in, a laptop that goes between the office and the floor, a USB stick on an HMI — and the planner maps them onto the Purdue model and ranks every crossing by how far it reaches. It names the control for each one, in the order they are worth fixing.

A column of heavy machined steel plates held apart by polished standoff pillars so that clean parallel air gaps separate every layer, one gap near the middle marked by a red band on the plate edges above and below it.
Takes
5 minutes
You get
A zone map, the crossings that need a boundary, and the control for each
Cost
Free, no sign-up

Everything below runs in your browser. Nothing you enter is sent to us, stored, or logged, and closing the tab discards it. Answering honestly costs you nothing here — none of it leaves the browser, and an incomplete list is the only way to get a wrong answer.

The Purdue enterprise reference architectureSeven horizontal bands stacked from Level 5, external and internet, at the top down to Level 0, field devices, at the bottom. Level 3.5, the industrial demilitarised zone, sits in the middle and is marked as the only intended crossing point between the business side above it and the plant side below it. An arrow on the left shows traffic passing correctly through the DMZ; an arrow on the right shows a direct crossing from Level 4 to Level 1 bypassing it, marked as the common finding.Level 5External / internetLevel 4Enterprise — ERP, email, identityLevel 3.5Industrial DMZ — the only crossing pointLevel 3Site operations — MES, historianLevel 2Supervisory — SCADA, HMILevel 1Control — PLC, RTU, safetyLevel 0Field — sensors, actuators, drivesSkips theboundary —the finding
The Purdue levels, and the one place traffic is supposed to change hands. A crossing that skips the DMZ is not a shortcut — it is the finding.

What actually happens on site

UNIT 01

These are the twelve crossings we find on real sites. Tick every one that is true, including the ones that are true only occasionally — an occasional crossing is a permanent path.

Which of these happen at your plant or terminal?

How the networks are separated today

UNIT 02

This decides how much of the risk above is already mitigated — and how much of it is not mitigated by anything, because some crossings walk past a firewall in a rucksack.

What sits between the plant network and the business network right now?

Zone map and crossings

UNIT 03
SELECT YOUR CURRENT SEPARATION TO SEE THE ZONE MAP

About the model

UNIT 04

The zones come from the Purdue Enterprise Reference Architecture as it is used in industrial security work: field devices at Level 0, control at Level 1, supervisory at Level 2, site operations at Level 3, an industrial demilitarised zone at Level 3.5, and the enterprise and the outside world at Levels 4 and 5.

A crossing's risk here is how many levels it spans, plus what it inherently is, less what your current separation already mitigates. A DMZ mitigates the flows that ought to terminate in one. It does nothing at all for an engineering laptop that reads email in the morning and programs a controller in the afternoon, which is why that row stays high however good the firewall is.

This is a planning aid, not an assessment. It cannot see your firewall rules, your patch levels or the access point somebody installed for convenience last year. What it can do is name the crossings that have to be deliberate, which is where most of the argument in an OT security conversation actually sits — and give you the list in a form you can hand to whoever owns the network.

Technical references

UNIT 05

What the reasoning on this page is drawn from. Where a standard costs money to read it is marked, and where a free document covers the same ground better it is listed first.

Links open in a new tab so anything you have entered above survives. Every one was checked at build time; if one has rotted since, tell us and it comes out rather than getting patched from memory.

Every one of these tools is a compressed version of a conversation. If yours turned up something you would rather talk through than read about, that is what the scoping call is for — bring your result with you.

Have the boundary reviewed before you connect anything

Also on the shelf