Dividing a network into smaller parts (segments or zones) to control traffic flow and enhance security. In an ICS, segmentation is key: for example, isolating the control network from the business network, and further segmenting within control (keeping the safety system on a separate subnet, or each production line in its own VLAN). By doing this, even if one segment is compromised, the others are not immediately affected. Segmentation can be done physically or logically (via VLANs, firewalls, routers). It limits broadcast domains and limits an attacker’s ability to move laterally. A common guideline is to segment according to levels of the Purdue Model and by function (safety, control, DMZ, etc.). Good segmentation is like having watertight compartments in a ship: a breach in one doesn’t sink the whole ship.
