Industrial Demilitarized Zone (IDMZ)

The foundational boundary of an IDMZ is established by a pair of firewalls—one facing the enterprise IT network and one facing the OT network—with the IDMZ services residing in between. No traffic ever traverses directly from the enterprise to the OT domain. Instead, all communication is terminated and re-initiated at the application layer within the DMZ.

• IT Firewall: Permits only specific, authenticated traffic to reach IDMZ servers.
• OT Firewall: Permits only the IDMZ servers to initiate a connection into the OT network, typically to a specific data source like a historian.
• Result: A complete break in the TCP session, preventing any direct socket connection or lateral movement from a compromised corporate laptop to a PLC.

Data is never queried live from the OT network by an enterprise user. Instead, a replication server or mirror historian sits inside the IDMZ. This server pulls a copy of the required operational data from the primary OT historian using a strictly controlled, outbound-initiated connection.

• Outbound-Only Initiation: The IDMZ server reaches into OT to fetch data; OT devices never reach out to the IDMZ.
• Read-Only Access: The replication account used has no write permissions on the OT source.
• Data Staleness Acceptance: Enterprise users access the replicated copy, accepting a slight delay (seconds to minutes) in exchange for absolute source protection.

All communication traversing the IDMZ boundary must be protocol-broken and rebuilt. Application-layer proxies, not simple packet filters, terminate the incoming connection and initiate a new, separate session on the other side. This allows for deep content inspection.

• Protocol Validation: A Modbus proxy ensures every packet conforms strictly to the protocol specification before forwarding.
• Function Code Whitelisting: The proxy can strip out dangerous function codes (e.g., 'Write' commands) even if the user is authenticated.
• TLS Termination: Encrypted IT traffic is decrypted, inspected for threats, and then re-encrypted using separate OT-managed certificates before being forwarded.

For the highest-assurance environments, the IDMZ is enforced not just logically but physically using a unidirectional gateway (data diode). This hardware device contains a fiber optic transmitter on the OT side and a receiver on the IT side, making any reverse communication physically impossible.

• Electromagnetic Isolation: The TX and RX components are physically separated, preventing any electrical signal from traveling back.
• Protocol Break: The diode acts as a full protocol break, requiring a proxy server on the IT side to emulate the OT server's responses.
• Use Case: Protecting nuclear safety systems or transmission substation protection relays where a remote command injection would be catastrophic.

OT endpoints cannot directly access the internet for updates, yet they must be patched. The IDMZ hosts a WSUS server, antivirus repository, and patch management server that act as a local, controlled source of truth.

• Staged Deployment: Patches are downloaded from the vendor to the IDMZ, tested against a digital twin, and then pushed to OT assets during a maintenance window.
• Signature File Distribution: AV definitions are pulled to the IDMZ server and then distributed to OT hosts, which have no other outbound connectivity.
• No Internet Exposure: OT devices remain completely air-gapped from the public internet, reducing their attack surface to only the IDMZ services.

All remote vendor or employee access to the OT environment is brokered through a hardened jump host located in the IDMZ. Direct VPN termination into the OT network is strictly forbidden.

• Multi-Factor Authentication: Access to the jump host requires MFA, often integrated with a Privileged Access Management (PAM) system.
• Session Recording: All keystrokes and screen activity on the jump host are recorded and auditable.
• No Direct RDP/SSH: The user RDPs into the jump host, and from that controlled terminal, initiates a separate session into the OT asset. Clipboard and drive redirection are disabled.

Deep Packet Inspection is an advanced network packet filtering method that examines the data payload and header of a packet as it passes an inspection point. Within an IDMZ, DPI firewalls are essential for validating that only legitimate industrial protocol commands traverse the buffer zone.

• Decodes protocols like Modbus TCP, DNP3, and EtherNet/IP
• Enforces function code whitelisting at the application layer
• Detects malformed packets and protocol anomalies before they reach the OT network

A jump server, or bastion host, is a hardened, purpose-built server that acts as the single point of entry for administrators needing to access devices within the OT network from the enterprise side. It is a critical control point within the IDMZ architecture.

• All administrative sessions are proxied and recorded
• Enforces multi-factor authentication (MFA) before granting access
• Prevents direct RDP or SSH connections from IT workstations to PLCs or HMIs