+Network Segmentation

Network Segmentation

Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network.[1],[2]

References

  1. IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25
  2. IEC 2013, August Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels Retrieved. 2020/09/25

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

Изисквания

3. Свързани регулации

Регулации

Свързани задачи

Връзки
is related to Mitigations
blocks Standard Application Layer Protocol
blocks Module Firmware
blocks Modify Alarm Settings
blocks Modify Firmware
blocks External Remote Services
blocks Internet Accessible Device
blocks Network Sniffing
blocks Reporting Message
blocks Adversary-in-the-Middle
blocks Multicast Discovery
blocks Wi-Fi
blocks Device Restart/Shutdown
blocks Port Scan
blocks Serial COM
blocks Remote Services
blocks Online Edit
blocks Brute Force I/O
blocks Rogue Master
blocks Exploitation of Remote Services
blocks Program Upload
blocks Transient Cyber Asset
blocks Broadcast Discovery
blocks Program Download
blocks Download All
blocks Service Stop
blocks Automated Collection
blocks Ethernet
blocks System Firmware
blocks Block Communications
blocks Alarm Suppression
blocks Commonly Used Port
blocks Point & Tag Identification
blocks Program Append
blocks Unauthorized Message
blocks Change Operating Mode
blocks Detect Operating Mode
blocks Activate Firmware Update Mode
blocks Exploit Public-Facing Application
blocks Command Message
  • MITREATTACK -

    EN: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. License: The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. See the Terms of Use for the disclaimers. ATT&CK® is a registered trademark of The MITRE Corporation. Converted into the GRCA format.

    DE: MITRE ATT&CK®, https://attack.mitre.org/. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE erlaubt die Nutzung für Forschung, Entwicklung und kommerzielle Zwecke, wenn jede Kopie den Urheberrechtsvermerk und die Lizenz enthält; maßgeblich ist der englische Wortlaut der Lizenz oben und die Terms of Use mit den Haftungsausschlüssen. ATT&CK® ist eine eingetragene Marke der MITRE Corporation. In das GRCA-Format umgewandelt.