<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-scada-network-segmentation
description: >-
  Audit OT network segmentation against the Purdue Model, validate IT/OT DMZ boundaries,
  test firewall rules between zones, and verify data diode configurations to prevent
  unauthorized cross-zone communication in SCADA environments.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - scada
  - network-segmentation
  - purdue-model
  - ics
  - firewall
  - data-diode
  - dmz
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0884", "T0886"]
  nist-csf: ["PR.AC-5", "DE.CM-1"]
  iec-62443: ["SR 5.1", "SR 5.2", "SR 5.3"]
  uuid: a1b2c3d4-1003-4000-a003-000000000003
---

# Auditing SCADA Network Segmentation

## Overview

Network segmentation is the primary defense preventing IT-originated threats from reaching
safety-critical OT systems. The Purdue Model defines hierarchical zones (Levels 0-5) with
strict communication rules. Auditing validates that firewall rules, VLANs, data diodes,
and DMZ configurations enforce these boundaries. Misconfigurations — flat networks, overly
permissive rules, direct IT-to-Level-1 paths — are the most common ICS security failures.

Mode: `[MODE: ARCHITECT]` for design review; `[MODE: RED]` for boundary testing.

## Prerequisites

| Requirement | Details |
|---|---|
| Network diagrams with Purdue Model level assignments | Required |
| Firewall rule exports from IT/OT boundary firewalls | Required |
| VLAN configuration from OT switches | Required |
| `nmap`, `traceroute`, `tcpdump` for connectivity testing | Required |
| Access to firewall management consoles | Required |

## Key Concepts

### Purdue Model Validation

```bash
# Test connectivity between zones (should be BLOCKED)
# IT (Level 5) → Control (Level 1) — must be denied
nmap -Pn -p 502,102,44818,4840 10.1.1.0/24 --reason

# Test DMZ (Level 3.5) connectivity
# DMZ should reach historian (Level 3) but NOT PLCs (Level 1)
nmap -Pn -p 502 10.2.1.0/24 --reason  # Should show filtered

# Verify jump host is only path from IT to OT
traceroute -T -p 3389 10.2.1.50  # RDP to engineering workstation
# Should route through jump host, not direct

# Scan for unexpected cross-zone services
nmap -sV -p- --open 10.0.0.0/16 -oG zone_scan.gnmap
grep -E "502|102|44818|4840|20000" zone_scan.gnmap
```

### Firewall Rule Audit

```bash
# Export and analyze firewall rules
# Check for overly permissive rules
grep -E "any.*any.*permit|0\.0\.0\.0.*permit" firewall_rules.txt

# Identify rules allowing IT-to-OT direct access
grep -E "10\.0\.(5|4)\..* -> 10\.0\.(1|0)\..*permit" firewall_rules.txt

# Check for rules permitting internet access from OT zones
grep -E "10\.0\.(0|1|2|3)\..*0\.0\.0\.0.*permit" firewall_rules.txt

# Validate expected deny rules exist
grep -c "deny.*ip.*any.*any" firewall_rules.txt  # Should have default deny
```

### VLAN Segmentation Verification

```bash
# Verify VLAN isolation between Purdue levels
# From Level 3 (Historian VLAN), attempt to reach Level 1 (Control VLAN)
ping -c 3 10.2.1.1    # PLC address — should fail
arping -c 3 10.2.1.1  # ARP — should fail (different VLAN)

# Check for VLAN hopping opportunities
yersinia -G  # GUI mode for VLAN attack testing (lab only)

# Verify trunk port configuration (no unnecessary VLANs)
# Switch CLI: show interfaces trunk
```

### Data Diode Verification

```bash
# Test unidirectional enforcement
# From OT side: send data toward IT (should succeed)
nc -w 3 10.5.0.10 514 <<< "test syslog from OT"

# From IT side: attempt to send data toward OT (must fail)
nc -w 3 -z 10.2.0.10 502  # Should timeout/fail
```

## Workflow

### Step 1: Document Current Architecture

```bash
# Map all subnets and their Purdue level assignments
# Enumerate active hosts per zone
for subnet in 10.0.0.0/24 10.1.0.0/24 10.2.0.0/24 10.3.0.0/24; do
  echo "=== Scanning $subnet ==="
  nmap -sn "$subnet" -oG "hosts_${subnet//\//_}.gnmap"
done
```

### Step 2: Test Zone Boundaries

```bash
# From each zone, test reachability to adjacent and non-adjacent zones
# Document which connections succeed/fail
for target_port in 502 102 44818 4840 3389 443 80; do
  nmap -Pn -p "$target_port" 10.2.1.1 --reason -oN "test_port_${target_port}.txt"
done
```

### Step 3: Report Findings

```bash
# Generate segmentation audit report
echo "[FINDING-SEG-001]"
echo "Severity: Critical"
echo "Description: Direct path from IT VLAN to PLC subnet on port 502"
echo "Remediation: Block tcp/502 from 10.0.5.0/24 to 10.0.1.0/24 at zone firewall"
```

## Verification

- [ ] All Purdue level zone boundaries tested for isolation
- [ ] IT-to-OT DMZ (Level 3.5) exists and enforces unidirectional flows
- [ ] Default-deny firewall rules on all zone boundary firewalls
- [ ] No direct internet access from Levels 0-3
- [ ] Jump host required for remote OT access with MFA
- [ ] VLAN trunks carry only necessary VLANs
- [ ] Data diode unidirectionality confirmed

## Detection Opportunities

- New flows crossing zone boundaries not in baseline → firewall misconfiguration or compromise
- ARP traffic from wrong VLAN → VLAN hopping attempt
- Direct IT-to-PLC connections bypassing jump host → policy violation or lateral movement
- Outbound connections from OT to internet → malware C2 or data exfiltration

```yaml
title: Auditing Scada Network Segmentation Detection
id: 67b710da-3a9e-4ca8-85f9-2c7fbe5f4465
status: experimental
description: Detects suspicious activity related to auditing scada network segmentation techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*auditing*scada*"
  condition: selection
level: medium
tags:
  - attack.t0884
  - attack.t0886
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- Purdue Enterprise Reference Architecture (ISA-95)
- IEC 62443-3-3 SR 5.1: Network Segmentation
- NIST SP 800-82 Rev 3 §5.3: Network Architecture
- CISA: ICS Network Segmentation Best Practices
