What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use both. Network segmentation defines which PLCs, remote-I/O adapters, HMIs, engineering stations, safety systems and servers belong in the same trust zone. An industrial firewall, router, Layer-3 switch or security gateway then controls the conduit between those zones. IEC 62443 risk assessment should establish the zones, conduits and target security levels; the specific enforcement technology follows that design.
A perimeter firewall alone is inadequate when every controller and remote-I/O path remains on one flat network. Conversely, VLANs without inter-zone policy are labels, not security boundaries. A practical design puts controllers and their associated remote I/O in risk-appropriate cell or control zones, separates higher-consequence or differently trusted systems, and brokers enterprise and vendor traffic through tightly controlled conduits.
What the two controls actually do
“Industrial firewall versus network segmentation” is usually a false choice. They solve different parts of the same architecture problem.
Industrial firewall: policy enforcement at a boundary
An industrial firewall is a boundary device that evaluates traffic between zones. Depending on its capabilities and placement, it can enforce source and destination addresses, protocols, ports, direction, connection state and, for supported industrial protocols, application-level commands. It can log decisions, terminate or broker remote sessions, and separate enterprise, demilitarized-zone (DMZ) and control networks.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
The firewall is visible where a conduit needs an explicit gate: between enterprise IT and plant control, between a plant DMZ and the control network, or between a high-value cell and the rest of the control environment. A firewall policy should express the minimum communications a process requires, not simply permit an entire subnet because it is convenient.
Network segmentation: dividing trust and failure domains
Segmentation divides an environment into smaller logical or physical trust domains. VLANs, Layer-3 routing, managed switches, physical separation and security gateways can all contribute. The objective is to keep a compromise in one area from becoming a plant-wide event and to make allowed communication understandable and auditable.
A VLAN by itself does not provide meaningful isolation if inter-VLAN routing permits everything. Segmentation becomes a security control only when the boundary between segments has an enforced policy, a defined owner and a recovery plan. A single IEC 62443 zone may contain several network segments when those segments share comparable security requirements.
Why a combined design is normal
IEC 62443-3-2:2020 requires the system under consideration to be partitioned into zones and conduits, risk-assessed, assigned target security levels and documented with security requirements. IEC 62443-3-3 supplies system security requirements and capability security levels for the resulting control-system design. In this model, segmentation is the architecture and the firewall or Layer-3 enforcement point is one way to control each conduit.
MITRE ATT&CK for ICS mitigation M0930 describes segmentation as a way to isolate infrastructure components that do not need broad network access. Siemens’ network-concepts guidance similarly describes networks being segmented by a “suppressor,” such as a firewall, router or Layer-3 switch. These ideas point to the same engineering decision: define the risk boundary first, then select a device that can enforce it without violating process availability requirements.
How IEC 62443 changes the design question
Start with the system under consideration
Document the physical process, control functions, communications, safety functions, maintenance paths and external dependencies that are in scope. Include assets that are easy to overlook: remote-I/O adapters, drives, wireless gateways, historians, time sources, patch repositories, engineering laptops, jump hosts and vendor-access services.
For each asset, record its process role, owner, firmware or operating-system dependency, required peers, maintenance method, consequence of compromise and consequence of loss of availability. This inventory is not a one-time spreadsheet exercise; it becomes the reference for firewall rules, change approval and incident response.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Define zones by comparable requirements
A zone is a risk-based grouping of assets with comparable security requirements. Devices do not belong together merely because they share a switch or a Purdue level. Controllers that must exchange deterministic control traffic with their remote I/O will often form a cell or area control zone. A safety instrumented system, a high-consequence production cell, a wireless gateway or a vendor-access service may need a separate zone because its consequences, trust assumptions or communication requirements differ.
Define conduits and assess their risk
A conduit is the controlled communication path between zones. For every conduit, document the source and destination zones, required protocols and ports, direction, timing constraints, authentication method, monitoring, fail-safe behavior and owner. Assess the risk of the conduit itself as well as the assets at either end. The result should include a target security level and the controls needed to reach it.
Translate the assessment into enforceable requirements
The target security level should drive requirements such as least-privilege rules, authentication, logging, malware controls, secure remote maintenance, redundancy and recovery testing. A firewall model cannot determine the target level on its own. Conversely, a beautifully drawn zone diagram has little value if no device or operating procedure enforces the conduits it shows.
Where PLCs and remote I/O should sit
Keep tightly coupled control assets together when their requirements match
Place a PLC and the remote-I/O adapters it continuously controls in the same cell, area or control zone when they share the same risk and availability requirements. This avoids forcing every cyclic I/O exchange through a device that could add latency or become a single point of failure. It does not mean that every device connected to the same physical switch belongs in that zone; HMIs, engineering stations and other services should be included only when their trust and communication needs are comparable.
Separate systems with different consequences or trust
Use a distinct zone for a safety system when a compromise could defeat an independent protective function or when its security requirements differ from the basic control system. Consider separate zones for high-consequence cells, legacy controllers with weak security, wireless gateways and services that accept vendor connections. Shared engineering workstations deserve special attention because they can become a bridge between otherwise separate controller groups.
Do not treat Purdue levels as automatic security zones
A reference architecture may show enterprise, DMZ, control, controller, process-I/O and safety levels. Those levels help explain data flows, but they do not require a one-to-one mapping to security zones. Siemens’ reference architecture cautions that device levels need not map directly to security zones. Use risk, required communication and consequence of compromise to decide whether two levels should be combined or split.
Place data exchange through an industrial DMZ
Enterprise-to-control exchange should pass through an industrial DMZ or an equivalent controlled conduit. Typical approved flows include historian replication, patch or update distribution, time synchronization and specifically authorized engineering access. The DMZ should not become a general-purpose shortcut into controller subnets. Services exposed to enterprise users or the internet belong outside the control zone, with only the data and sessions that the process requires allowed inward.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
When to emphasize a firewall, segmentation or both
| Plant condition | Primary emphasis | Reason | Typical boundary |
|---|---|---|---|
| Clear enterprise-to-control boundary, a required DMZ or brokered vendor access | Perimeter firewall and DMZ controls | Stops direct paths from business or external networks and creates an auditable entry point | Enterprise network to industrial DMZ; DMZ to control network |
| Several production cells with different processes or consequences | Fine-grained segmentation | Limits lateral movement and keeps one cell’s compromise from reaching others | Cell or area boundaries enforced by firewall, router or Layer-3 switch |
| Safety systems, high-consequence assets or legacy PLCs inside the control network | Separate risk-based zones plus strict conduits | Trust and consequence differ even when devices share a plant | Dedicated safety, legacy or high-consequence zone |
| Shared engineering workstations or wireless gateways | Segmentation with controlled management paths | These systems can provide a bridge into multiple controller groups | Engineering or wireless zone to approved cell zones |
| Multi-cell plant with external maintenance | Both controls | IEC 62443-aligned design needs risk-based zones and enforced conduits | Perimeter, DMZ, cell and special-purpose boundaries |
The Australian Cyber Security Centre recommends network segmentation, jump boxes and secure firewall settings to block direct remote access to control systems. That pattern is especially important when a vendor must reach several cells but should not receive unrestricted Layer-3 access to their controller subnets.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Design the architecture step by step
- Inventory every asset and path. List PLCs, remote-I/O adapters, HMIs, engineering stations, drives, safety systems, historians, wireless gateways, domain or directory dependencies, time sources, update services and all vendor-access routes. Record which devices initiate connections and which only respond.
- Map required communications. For each process function, document source, destination, protocol, port, direction, frequency, latency sensitivity and operational owner. Include maintenance and recovery traffic, not just normal production traffic.
- Group assets into provisional zones. Group by comparable security requirements and consequence of compromise. Keep a controller and its associated remote I/O together when they require continuous deterministic exchange; split safety, high-consequence, legacy or differently trusted systems.
- Draw every conduit. Show the exact boundary between each pair of zones. Identify whether the conduit is enforced by an industrial firewall, routed interface, Layer-3 switch, security gateway or a combination.
- Assess risk and set target security levels. Apply IEC 62443-3-2:2020 to each zone and conduit. Document threats, consequences, existing controls, target security level and residual risk. Use IEC 62443-3-3 requirements to specify the system capabilities needed to meet the target.
- Choose enforcement technology. Select a device that supports the required protocols, throughput, latency, environmental conditions, management model, logging, redundancy and fail-safe behavior. A general-purpose firewall may be unsuitable if it cannot meet industrial availability or protocol requirements.
- Write least-privilege rules. Permit only documented source-destination pairs and services. Prefer explicit allow rules with a deny-and-log default where the process and device behavior permit it. Separate production, engineering, monitoring and remote-maintenance policies instead of using one broad rule.
- Build the industrial DMZ. Place historian brokers, patch staging, remote-access brokers and other exchange services in the DMZ. Keep direct enterprise and internet routes out of controller and remote-I/O subnets.
- Validate deterministic behavior. Test normal cycle traffic, startup, failover, link loss, firewall reboot, rule reload and overload. Confirm that a blocked or failed security device does not create an unsafe process state and that any bypass is controlled, visible and temporary.
- Monitor and document. Send firewall, switch, remote-session and authentication logs to a protected monitoring system. Keep a current zone-and-conduit diagram, rule register, asset inventory, approvals and rollback procedure.
- Test recovery. Back up configurations, verify replacement hardware and licenses, rehearse restoring rules and routing, and record the time required to return a cell to an approved state. Recovery plans should cover both a cyber incident and an accidental policy change.
- Review after every change. A new HMI, firmware update, vendor contract, wireless link or process modification can alter the risk assessment. Revalidate the affected zone and conduit rather than adding a broad temporary rule.
Secure remote vendor access without exposing the control network
Use a brokered jump-host pattern
Terminate the external session in an access broker or jump host located in the industrial DMZ. Authenticate the individual, require approval for the maintenance window, restrict the destination and protocol, record the session where practical, and remove or disable access when the work ends. The vendor should reach only the approved engineering service or controller path, not an entire PLC subnet.
Keep direct VPN routes out of PLC subnets
A VPN that drops a vendor device directly into a controller VLAN bypasses the intended conduit and makes the remote endpoint part of the control trust zone. It also complicates attribution and incident containment. Route remote sessions through the broker, enforce per-device and per-user permissions, and prevent split tunneling or uncontrolled onward movement.
Define the maintenance workflow
- Verify the vendor identity, contract, ticket and affected asset before enabling access.
- Use named accounts and multifactor authentication where the equipment and access platform support them.
- Limit the session to a time window and the minimum destination, ports and commands required.
- Require an operator or control-room owner to approve the connection for high-consequence systems.
- Capture connection, authentication and configuration-change logs and retain them according to the plant’s incident and regulatory requirements.
- Disable the route after maintenance and review any changed PLC logic, firmware or firewall rule.
Firewall and segmentation design details that affect operations
Protocol filtering is useful but not universal
Some industrial firewalls can inspect or restrict commands within supported protocols; others can enforce only addresses, ports and connection state. Do not assume that a product understands every PLC or remote-I/O protocol. If application inspection is unavailable, compensate with tighter zones, dedicated conduits, endpoint controls and monitoring.
Latency and determinism come before feature count
Remote I/O and controller traffic may have strict timing or jitter limits. Evaluate inspection overhead, routing convergence, broadcast handling and failover behavior under the actual process load. A security device that intermittently delays cyclic traffic can create a production or safety problem even when its rule set is technically correct.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAvailability and bypass need an explicit strategy
Inline devices can become a process outage if they fail or are misconfigured. Determine whether the process needs redundant firewalls, redundant power, dual links, high-availability state synchronization or a controlled bypass. A bypass should not silently turn a conduit into an unrestricted bridge; it should be physically or logically constrained, alarmed, authorized and tested.
Redundancy is not the same as recovery
High availability can preserve traffic during a device failure, but it does not restore an accidentally deleted rule or a corrupted configuration. Keep offline backups, tested replacement procedures and a known-good baseline. Document how to return from a bypass or emergency rule to the approved architecture.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Logging must support decisions
Collect denied and allowed events where volume is manageable, administrative changes, remote-session activity, authentication failures, device-health alarms and failover events. Synchronize clocks across the relevant zones so an analyst can reconstruct a sequence. Protect logs from alteration and define who reviews them and how quickly unusual traffic is escalated.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failure modes and their fixes
One perimeter firewall with a flat PLC network
Problem: The perimeter blocks unsolicited enterprise traffic, but a compromised HMI, engineering laptop or vendor endpoint can move laterally among every PLC and remote-I/O path inside the control network.
Recommended Free Tools
Fix: Create cell, area and special-purpose zones based on risk and communication requirements. Enforce conduits between them and monitor east-west traffic.
VLAN labels without inter-VLAN policy
Problem: Devices appear separated in switch configuration, yet routing permits unrestricted traffic.
Fix: Place an explicit policy enforcement point at the routed boundary, document permitted flows and test that disallowed paths are actually blocked.
Overly broad allow rules
Problem: “Any source to any destination” or whole-subnet rules turn a conduit into an unrestricted bridge and make incident investigation difficult.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix: Replace broad rules with named source and destination assets, required services, direction, schedule and owner. Review temporary exceptions at a defined expiration date.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Inline security equipment that is not engineered for availability
Problem: A device reboot, software fault or link negotiation issue interrupts control traffic.
Fix: Test the device under production load, select industrially appropriate hardware, design redundancy or a controlled bypass, and verify startup and failover behavior before deployment.
Direct vendor VPN access
Problem: The vendor endpoint receives network reachability to PLC subnets and can move beyond the intended asset.
Fix: Use a DMZ jump host or access broker, named accounts, approval, time limits, least-privilege destinations and session logging.
Forcing every Purdue level to become a zone
Problem: One-to-one mapping creates unnecessary gateways, exceptions and operational complexity without reducing a meaningful risk.
Fix: Keep the Purdue model as a communication reference, then group or split assets according to IEC 62443 risk, consequence and required communications.
Comparison framework for an architecture review
Use the following questions when evaluating a proposed design or security gateway. They expose trade-offs that a simple “firewall versus VLAN” decision misses.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Blast-radius reduction: If one engineering workstation is compromised, which PLCs and remote-I/O adapters remain unreachable?
- Protocol and application filtering: Can the boundary enforce the actual industrial protocol and command restrictions required, or only IP addresses and ports?
- Latency and deterministic behavior: What are the measured effects on cyclic traffic, failover and broadcast or multicast handling under process load?
- Availability: What happens during power loss, software restart, link failure, state desynchronization or a malformed packet?
- Redundancy and bypass: Is there a tested high-availability design, and is any bypass constrained, alarmed and reversible?
- Remote-access control: Can access be brokered through a jump host with identity, approval, time limits and session records?
- Logging and incident response: Are policy decisions, administrative changes, authentication and failover events available with synchronized timestamps?
- Engineering effort: Can the plant maintain an accurate asset inventory, rule register and change process?
- Lifecycle and patchability: Can firmware, signatures and management software be updated without violating process or safety constraints?
- IEC 62443 alignment: Does the design demonstrate the target security level for every relevant zone and conduit?
Implementation checklist
- System-under-consideration boundary approved by operations, engineering, safety and security owners.
- Current inventory includes PLCs, remote I/O, HMIs, engineering stations, drives, safety systems, historians and external access paths.
- Zones are justified by comparable requirements and consequence, not merely by device level or switch port.
- Every conduit has an owner, documented flows, target security level and enforcement point.
- Enterprise and vendor exchanges terminate in an industrial DMZ or equivalent controlled path.
- Remote access uses a brokered jump host, named identities, approval, time limits and logging.
- Rules use least privilege and have change, review and rollback procedures.
- Latency, failover, startup, link loss, overload and blocked-traffic behavior are tested with representative process traffic.
- Redundancy, bypass and recovery have been rehearsed, not just documented.
- Logs are time-synchronized, protected and reviewed by an assigned team.
- Configuration backups and replacement procedures can restore an approved state.
- Changes trigger a review of affected risks, zones, conduits and target security levels.
Bottom line
For PLCs and remote I/O, segmentation is the risk-based structure and the industrial firewall or Layer-3 enforcement point is the gate that makes that structure real. Use a perimeter firewall and DMZ to control enterprise and external paths, then add cell, safety, legacy and other special-purpose boundaries where consequences or trust differ. Keep tightly coupled controller and remote-I/O traffic together when their requirements match, but never let that convenience create a flat plant-wide network. The defensible architecture is the one that documents each zone and conduit, permits only necessary flows, preserves deterministic and fail-safe operation, and brokers every remote session through an accountable, least-privilege path.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
