Industrial DMZ (iDMZ) Deployment: The Security Air-Lock
This guide provides the technical implementation steps for deploying an Industrial DMZ as the mandatory security boundary between OT and IT networks, terminating all conduits and enforcing least-privilege traffic rules.
1. The Architecture: Physical vs. Logical
To implement an iDMZ that passes a Class Survey, you must choose an architecture that ensures Zero Direct Routing. In maritime environments, we typically use the Three-Legged Firewall (for smaller vessels) or Back-to-Back Firewalls (for complex offshore units).
2. Technical Service Placement
By placing proxy services in the iDMZ, we ensure that OT assets (PLCs/HMIs) never “talk” to the internet directly. They only talk to these local authorized proxies.
If you have an OTS or COTS computer that currently accesses a monitoring system inside your vendor-certified OT zone without going through a Jump Host or iDMZ boundary, that connection may be in direct violation of E27 §4.1 — the CBS Risk Assessor will identify the exact scope boundary crossing and tell you what conduit controls are required before the iDMZ is in place.
3. Implementation: Traffic Directional Logic
Success is defined by your Firewall Access Control Lists (ACLs). Use the following “Directionality Matrix” to configure your conduits:
1. Detailed Port Mapping Guide (IACS UR E26)
To meet IACS UR E26 requirements, network segmentation must be enforced through strictly defined conduits. Use these specific service definitions when configuring your Firewall rules to ensure a “Least Privilege” security posture across the vessel’s OT/IT boundary.
Asset: iDMZ Firewall Policy Matrix (TAG-NET-XLS-04)
The downloadable template includes the following mandatory audit columns required for technical compliance validation:
- Rule ID: Unique identifier (e.g., FW-IDMZ-001) for log cross-referencing.
- Source Asset: Specific IP/Subnet initiating the connection.
- Dest. Asset: The target iDMZ service IP.
- Service/Port: The exact technical port (No “ANY” allowed).
- Action: Permit / Deny / Inspect (DPI).
- E26 Mapping: Regulatory clause satisfied by this rule.
Compliance Documentation Previews
Standardized templates and technical logs. View watermarked previews below; All fillable forms and SOPs are free with a registered account.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
