Internet DMZ VPN Perimeter Internal Network IT Infrastructure Zone Finance Zone Development Zone Restricted Data Zone OT SCADA Zone ExternalToRouter Protocol: TCP ExternalToMail Protocol: SMTP RemoteToVPN Protocol: IPSEC 🔒 Encrypted RouterToWAF Protocol: HTTP WAFToProxy Protocol: HTTP ProxyToInternalFW Protocol: HTTP MailToWorkstation Protocol: SMTP VPNToInternalFW Protocol: IPSEC 🔒 Encrypted EmployeeToWorkstation Protocol: RDP InternalFWToWorkstation Protocol: TCP InternalDNSToAD Protocol: DNS WorkstationToFile Protocol: SMB WorkstationToAD Protocol: LDAP WorkstationToSIEM Protocol: SYSLOG ITAdminToJump Protocol: RDP 🔒 Encrypted ADToBackupAD Protocol: RPC ADToPKI Protocol: RPC 🔒 Encrypted SIEMToAD Protocol: LDAP JumpToAD Protocol: WinRM 🔒 Encrypted JumpToERP Protocol: SAP JumpToSCADA Protocol: RDP FinanceEmpToERP Protocol: TCP ERPToCoreDB Protocol: SQL DevToGitLab Protocol: SSH 🔒 Encrypted DevToCICD Protocol: HTTPS 🔒 Encrypted GitLabToCICD Protocol: HTTPS 🔒 Encrypted CICDToCoreDB Protocol: SQL CoreDBToBackup Protocol: TCP SCADAOpToHMI Protocol: RDP HMIToPLC Protocol: Modbus External Attacker Remote Employee Edge Router Web Application Firewall Reverse Proxy Mail Gateway Corporate VPN Gateway Corporate Employee Internal Firewall Internal DNS Server Employee Workstation File Server IT Administrator Primary Domain Controller Backup Domain Controller PKI Certificate Authority SIEM Server Jump Server Finance Employee Financial ERP System Finance Workstation Developer Source Code Repository CI CD Pipeline Core Database Cluster Backup Server SCADA Operator SCADA HMI PLC Controller