Recommended Free Tools
Water utilities should separate operational technology (OT) from enterprise IT, route necessary traffic through a monitored and logged boundary, and deny IT-to-OT connections by default unless a specific, approved connection is needed. Then, where process dependencies allow, divide OT into smaller operational zones, such as individual pumping stations. The exact design must fit the utility’s equipment, communications, and safety requirements; there is no single firewall layout that suits every system.
What OT network segmentation does
Segmentation divides a network into zones and controls which information can pass between them. For a water utility, it helps limit direct paths between business systems and the equipment and control systems used to operate processes such as treatment, pumping, storage, and distribution. If a utility needs data or administrative access to cross the IT/OT boundary, that traffic should pass through a managed intermediary rather than an unrestricted connection.
As an Amazon Associate I earn from qualifying purchases.
The U.S. Environmental Protection Agency (EPA) recommends that connections between OT and IT pass through an intermediary—such as a firewall, bastion host, jump box, or demilitarized zone (DMZ)—that is monitored and logged. Its default policy is to deny IT-to-OT connections unless they are explicitly allowed for a specific system function, with criteria such as IP address and port. See the EPA’s Protect: Network Segmentation, Factsheet 2.F (2024).
How to think about zones and the DMZ
The Purdue Model can help teams describe network layers during planning. EPA identifies Purdue Levels 0–3 as OT and Levels 4–5 as enterprise IT, with a DMZ commonly placed between Levels 3 and 4 to monitor, log, and filter traffic. Use that model as a way to organize discussion—not as a substitute for documenting the utility’s actual assets, connections, and process dependencies.
#1 Best Overall
- 【◆Powerful Celeron N2840 Processor: N2840 Processor, 2 Cores 2 Threads, 1M Cache, Max Turbo Frequency 2.58 GHz, TDP 7.5 W. Compatible with OPNsense, Linux, Windows,ESXI, OpenWrt and other systems. Press "Delete" key to enter BIOS setup, supports Auto Power On, Wake On Lake, GPIO, PXE
- 【◆1GbE LAN: Mini Router PC with 2*Realtek RTL8111H network card chip full UDE 1000M with filter connector.Soft Router can monitor network data, improve network security, powerful and widely used.
- ◆DDR3L Memory & Large Storage Capacity: Firewall box computer with 1 x DDR3L SO-DIMM memory 1333/1600MHz, 1xMSATA3.0 SSD+1x2.5''SATA3.0 SSD/HDD.
- ◆UHD Graphics & Dual Display: N2840 processor integrated UHD Graphics, HD and VGA dual display interfaces support 4K@60Hz.
- ◆Rich interfaces: 2 x1000M Realtek RTL8111H-LAN,2 xUSB3.0, 4 xUSB2.0, HDMI,VGA,AUDIO supports data storage and system boot.
| Illustrative zone or layer | Example role | Segmentation purpose |
|---|---|---|
| Enterprise IT (Purdue Levels 4–5) | Business systems and authorized users | Keep routine enterprise traffic from reaching control systems directly. |
| DMZ or managed intermediary | Controlled exchange or administration path between IT and OT | Filter, monitor, and log approved traffic at the boundary. |
| OT (Purdue Levels 0–3) | Control and operational systems | Restrict access to the flows needed for system functionality. |
| Operational-area zones within OT | For example, a treatment area or individual pumping station | Limit unnecessary connectivity between sites or processes, according to their dependencies. |
This is an illustrative planning view, not a prescribed topology. A utility’s actual zones, conduits, and permitted flows should follow its equipment, site links, operational dependencies, and safe-change requirements. EPA specifically recommends considering segmentation by operational area, including individual pumping stations, to limit incident spread.
Plan and implement segmentation
- Inventory assets and connections. Record OT and IT assets, owners, locations, functions, and communications. Include remote sites, third-party connections, legacy equipment, and systems supporting intake, treatment, distribution, storage, pumping, or monitoring. EPA’s Cybersecurity Planning page links to OT asset-inventory guidance and other water-sector planning resources.
- Map required flows before choosing rules or equipment. Work with operators and system integrators to identify each connection’s source, destination, protocol or service, direction, and purpose. Confirm process and safety implications before changing connectivity. This map provides the basis for deciding what the boundary must permit.
- Route necessary cross-boundary traffic through a managed intermediary. A firewall is the common tool EPA identifies for the OT/IT boundary; a bastion host or jump box and a DMZ can support controlled administration or data exchange. Select an arrangement that can filter, monitor, and log the flows the utility actually needs.
- Set default-deny rules and document exceptions. Block unneeded IT-to-OT traffic, then allow only specific approved connections. EPA gives IP address and port as examples of explicit criteria. Record each rule’s purpose, owner, and review date so exceptions can be checked as systems change.
- Consider additional OT zones. Assess boundaries between sites and operational areas, such as individual pumping stations, in light of process dependencies and the consequences of a disruption. A boundary should constrain unnecessary traffic without blocking communications the process requires.
- Validate changes with operations staff. Test the rules with operators and integrators, confirm essential functions remain available, and review monitoring and logging. Use safe change procedures suited to the equipment and process rather than assuming a rule that looks correct on paper is safe to deploy.
Control remote and administrative access
Make remote access follow an approved path through the utility’s managed boundary, and limit it to the assets and privileges needed for the task. EPA advises that only approved assets connect from IT to OT and describes IT-to-OT access as read-only. It identifies remote desktop service (RDS) access as an exception that requires re-authentication. These controls should be reflected in access rules and reviewed alongside the permitted-flow map.
Rank #2
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
Monitor, review, and maintain the design
Segmentation is an operating control, not a one-time firewall installation. Review boundary logs and permitted connections, and revisit zones when assets, suppliers, communications, or operating needs change. Before approving a change, check that its purpose is documented, the owner is known, and the effect on process communications has been considered.
EPA rates network segmentation as high complexity and gives it a qualitative cost rating of $$$$ and impact rating of HIGH; these are agency ratings, not dollar estimates or measured outcomes. The agency also lists a cybersecurity procurement evaluation checklist. For broader OT security context, NIST’s SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, was published in September 2023 and emphasizes OT’s distinct performance, reliability, and safety requirements. The NIST publication page notes a Revision 4 initial public draft, with comments due November 30, 2026; Rev. 3 is the final edition identified there.
Quick Recap
Rank #4
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Rank #3
- 2 X 10/100/1000 + 2 X GIGABIT SFP
- CHASIS 64 GB MSATA
- DC POWER
- DIN RAIL MOUNTABLE
- INDUSTRIAL SECURITY APPLIANCE
Resources for water utilities
- EPA Protect: Network Segmentation, Factsheet 2.F — guidance on OT/IT boundaries, default-deny access, Purdue levels, and operational-area segmentation.
- EPA Cybersecurity Planning — links to asset inventory guidance, water-sector case studies, incident response resources, and a procurement evaluation checklist. The page states that community water systems serving more than 3,300 people have Emergency Response Plan obligations under the Safe Drinking Water Act as amended by America’s Water Infrastructure Act; consult the relevant official guidance for legal requirements.
- NIST SP 800-82 Rev. 3 — broader guidance for securing OT systems while accounting for operational constraints.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
