Design Methods

2.1 Executable Design Principles and Basis

Effective OT–IT isolation design is grounded in a set of executable principles that translate security intent into engineering decisions. These principles are not abstract guidelines — each one specifies when it applies, what the technical basis is, and how compliance is verified. The following twelve principles form the design foundation for every OT–IT boundary implementation covered by this guide.

2.2 Failure Causes and Recommendations

Many OT security incidents can be traced to a small set of recurring design or operational failures. Understanding these failure patterns and their mechanisms enables designers to build preventive controls into the architecture from the outset, rather than discovering vulnerabilities during incidents. The table below documents eight high-frequency failure groups with their mechanisms, recommended avoidance strategies, and operational checks.

2.3 Core Design / Selection Logic

The isolation level selection process follows a structured decision tree that maps the functional requirements of each OT–IT interconnect to the appropriate security mechanism. The key driver is the directionality of the required data flow: one-way export requirements favor unidirectional gateways (data diodes), while bidirectional requirements must be carefully evaluated to determine whether they can be safely brokered through a DMZ. Any requirement that cannot be safely brokered in a DMZ should trigger an application re-architecture review rather than a direct OT–IT connection.

Figure 2.1: Decision Tree for Isolation Level Selection — from root question "Need OT-IT Communication?" through directionality and DMZ feasibility checks to the four outcome paths: Physical Isolation, One-Way Gateway, DMZ Controlled Interconnect, or Re-architect/Reject.

Step-by-Step Design Sequence

The following nine-step sequence provides a structured methodology for designing an OT–IT isolation solution from initial assessment through operational readiness. Each step builds on the outputs of the previous step, creating a traceable design record that supports both acceptance testing and ongoing operations.

1. Build asset inventory and classify by criticality (Safety, Production, Quality, Visibility).
2. Build communication flow matrix — who talks to whom, protocol, ports, direction, frequency, latency.
3. Decide zoning — Field/Control/Core/DMZ/O&M/Data Uplink zones with VLAN/subnet assignments.
4. For each OT–IT flow, choose isolation level using directionality, integrity needs, and operational need.
5. Select devices — industrial firewall vs. diode vs. isolation gateway; determine HA requirements.
6. Design whitelist rules and inspection points; define logging and alerting requirements.
7. Define O&M model — bastion, MFA, JIT approvals, recording, file transfer controls.
8. Define update model — offline staging, scanning, release ring, rollback procedures.
9. Define acceptance tests and O&M runbooks; establish change control procedures.

2.4 Key Design Dimensions

A complete OT–IT isolation design must address eight key dimensions that span technical performance, operational sustainability, regulatory compliance, and lifecycle economics. Neglecting any dimension creates gaps that may not surface until acceptance testing or, worse, during an incident. The table below provides a structured overview of each dimension with its key considerations and typical metrics.