SCADA Network Segmentation Map
Segmentation is the single highest-leverage OT control — and it is an architecture problem, not a checklist. This lab is a map. You build one plant design across the Purdue levels — enterprise IT, an IT/OT DMZ, the SCADA/HMI network, and the PLC/field layer with its safety system — by placing controls like a perimeter firewall, a brokered jump host, an OT firewall, a one-way data diode, MFA, and an isolated SIS. Then real, published kill chains run down your map, and the attack path stops exactly where your design defends it. The catch: two controls are over-segmentation traps that stop the attacker but break the flows the plant needs. Block the kill chain and keep the plant running.
The real job. More noise, a tighter clock.
Plant map · run the kill chain
Modelled on the 2015 Ukraine power-grid attack (E-ISAC / SANS public report).
A spear-phishing email lands a foothold on the business network; the actor then works toward the control systems that operate field devices.
Breached: reached Safety system
Segmentation controls
Toggle controls to defend the map. The attack path above updates live. Two of these are over-segmentation traps — they block traffic but break a flow the plant needs.
Design status
0 sound control(s) placed · live design score 11/100.
To clear: contain every scenario above the field layer, with both required flows intact.
How it is scored
Each kill chain scores higher the earlier it is stopped — held at the DMZ beats letting it reach the SCADA network.
Reaching the field or safety layer is a breach. Breaking a required flow costs you too — security that halts the plant gets switched off.
Clearing it means every scenario contained and both required flows intact.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based segmentation game: place controls on a Purdue-aware plant map — enterprise IT, an IT/OT DMZ, the SCADA/HMI network, and the PLC/field layer with the safety system.
- Then real, published OT kill chains run across your map: phished credentials into SCADA (Ukraine 2015), an internet-exposed remote-access path to an HMI (Oldsmar 2021), and enterprise ransomware pressing on OT (Colonial Pipeline 2021).
- The attack path updates live as you toggle controls, stopping at the boundary your design defends — or walking all the way to the field and safety layers if it does not.
- You are scored on blocking every kill chain before it reaches the field, without breaking the flows the plant needs: two of the controls are over-segmentation traps that stop traffic but break historian reporting or vendor support.
- Difficulty tiers add more scenarios to defend with one design, with a speed bonus and an S–D grade.
Why one design, many kill chains
Real intrusions do not announce which door they will use. The 2015 Ukraine attack came in on phished credentials reused over remote access with no MFA; the 2021 Oldsmar event used an internet-exposed remote-access service to land on an HMI; the 2021 Colonial Pipeline ransomware never needed to touch OT at all — the mere uncertainty about IT/OT separation forced a shutdown. One design has to hold against all of them, which is why defence in depth matters: a perimeter firewall, a brokered and monitored DMZ, an OT firewall, a one-way historian feed, no direct enterprise-to-controller path, and an independent safety system. No single boundary is the whole answer.
And the plant still has to run. The fastest way to fail an OT security review is to propose controls that break operations — air-gapping the control network, or cutting the data the business depends on. The lab scores that just as harshly as leaving a path open, because a control that stops the plant gets removed, and then you have neither security nor uptime. The win condition is the real one: contain every kill chain and keep the required flows alive.
Frequently asked questions
What does the SCADA Network Segmentation Map teach?
It teaches OT network segmentation as architecture rather than theory. You build one plant design across the Purdue levels — enterprise IT, an IT/OT DMZ, the SCADA/HMI network, and the field layer with a safety system — by placing controls like a perimeter firewall, an access-broker jump host, an OT firewall, a one-way data diode to a historian replica, MFA on remote access, no direct enterprise-to-PLC path, and an isolated safety system. Then published intrusion kill chains are run against your design and you see exactly where each is stopped.
Which real incidents are modelled?
Three publicly documented OT intrusions: the 2015 Ukraine power-grid attack (spear-phishing to harvested credentials reused over remote access into SCADA, with no MFA), the 2021 Oldsmar water-treatment event (an internet-exposed remote-access/shared-desktop service used to reach an operator HMI), and the 2021 Colonial Pipeline ransomware (an IT compromise whose uncertain separation from OT forced a precautionary operational shutdown). Each is presented at the published, architecture level — the lab is about the segmentation that would contain them, not about how any of them was carried out.
Why are some controls penalised?
Because over-segmentation is a real failure mode. Air-gapping the SCADA network or cutting the historian feed will stop an attacker — and also stop the plant from reporting data and from receiving brokered vendor support. Security that halts operations gets worked around or switched off. Good segmentation brokers and monitors the flows the plant needs (one-way historian data, jump-hosted remote access) instead of severing them, so the lab scores you down for breaking a required flow just as it does for leaving a path open.
Is this based on a real network?
No. It is an educational model of the Purdue reference architecture and ISA/IEC 62443 zone-and-conduit segmentation, with synthetic nodes and flows. The kill chains are generalised from public incident reporting. It contains no exploit detail and no instructions for attacking any system — it is a design exercise in where to put the boundaries.