M0930: Network Segmentation
Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network. [1] [2]
Security context for executives and security teams
M0930: Network Segmentation describes Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC ...
Executive priority
M0930: Network Segmentation is an official MITRE ATT&CK mitigation. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate M0930: Network Segmentation by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether M0930: Network Segmentation appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Network Segmentation
Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network. [1] [2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| ICS | T0869 | Standard Application Layer Protocol | Ensure proper network segmentation between higher level corporate resources and the control process environment. |
| ICS | T1693.002 | Module FirmwareSub-technique | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T0838 | Modify Alarm Settings | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 CitationN/A |
| ICS | T1693 | Modify Firmware | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T0822 | External Remote Services | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Consider a jump server or host into the DMZ for greater access control. Leverage this DMZ or corporate resources for vendor access. CitationKeith Stouffer May 2015 |
| ICS | T0883 | Internet Accessible Device | Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Steps should be taken to periodically inventory internet accessible devices to determine if it differs from the expected. |
| ICS | T0842 | Network Sniffing | Segment networks and systems appropriately to reduce access to critical system and services communications. |
| ICS | T1692.002 | Reporting MessageSub-technique | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.CitationKaren Scarfone; Paul Hoffman September 2009CitationKeith Stouffer May 2015CitationDepartment of Homeland Security September 2016CitationDwight Anderson 2014 |
| ICS | T0830 | Adversary-in-the-Middle | Network segmentation can be used to isolate infrastructure components that do not require broad network access. This may mitigate, or at least alleviate, the scope of AiTM activity. |
| ICS | T0846.003 | Multicast DiscoverySub-technique | Ensure proper network segmentation is followed to protect critical servers and devices. |
| ICS | T1695.003 | Wi-FiSub-technique | Segment operational networks to isolate critical systems and devices that do not require broad network access. |
| ICS | T0816 | Device Restart/Shutdown | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 |
| ICS | T0846.001 | Port ScanSub-technique | Ensure proper network segmentation is followed to protect critical systems and devices. |
| ICS | T1695.001 | Serial COMSub-technique | Restrict unauthorized devices from accessing serial comm ports. |
| ICS | T0886 | Remote Services | Segment and control software movement between business and OT environments by way of one directional DMZs. Web access should be restricted from the OT environment. Engineering workstations, including transient cyber assets (TCAs) should have minimal connectivity to external networks, including Internet and email, further limit the extent to which these devices are dual-homed to multiple networks. CitationNorth America Transmission Forum December 2019 |
| ICS | T0843.002 | Online EditSub-technique | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T0806 | Brute Force I/O | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. CitationKaren Scarfone; Paul Hoffman September 2009 CitationKeith Stouffer May 2015 CitationDepartment of Homeland Security September 2016 CitationDwight Anderson 2014 |
| ICS | T0848 | Rogue Master | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. CitationKaren Scarfone; Paul Hoffman September 2009 CitationKeith Stouffer May 2015 CitationDepartment of Homeland Security September 2016 CitationDwight Anderson 2014 |
| ICS | T0866 | Exploitation of Remote Services | Segment networks and systems appropriately to reduce access to critical system and services communications. |
| ICS | T0845 | Program Upload | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 |
| ICS | T0864 | Transient Cyber Asset | Segment and control software movement between business and OT environments by way of one directional DMZs. Web access should be restricted from the OT environment. Engineering workstations, including transient cyber assets (TCAs) should have minimal connectivity to external networks, including Internet and email, further limit the extent to which these devices are dual-homed to multiple networks. CitationNorth America Transmission Forum December 2019 |
| ICS | T0846.002 | Broadcast DiscoverySub-technique | Ensure proper network segmentation is followed to protect critical systems and devices. |
| ICS | T0843 | Program Download | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T0843.001 | Download AllSub-technique | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T0881 | Service Stop | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 |
| ICS | T0802 | Automated Collection | Prevent unauthorized systems from accessing control servers or field devices containing industrial information, especially services used for common automation protocols (e.g., DNP3, OPC). |
| ICS | T1695.002 | EthernetSub-technique | Segment operational networks to isolate critical systems and devices that do not require broad network access. |
| ICS | T1693.001 | System FirmwareSub-technique | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T1695 | Block Communications | Segment operational networks to isolate critical systems and devices that do not require broad network access. |
| ICS | T0878 | Alarm Suppression | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. CitationKaren Scarfone; Paul Hoffman September 2009 CitationKeith Stouffer May 2015 CitationDepartment of Homeland Security September 2016 CitationDwight Anderson 2014 |
| ICS | T0885 | Commonly Used Port | Configure internal and external firewalls to block traffic using common ports that associate to network protocols that may be unnecessary for that particular network segment. |
| ICS | T0861 | Point & Tag Identification | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment. CitationKaren Scarfone; Paul Hoffman September 2009 CitationKeith Stouffer May 2015 CitationDepartment of Homeland Security September 2016 CitationDwight Anderson 2014 |
| ICS | T0843.003 | Program AppendSub-technique | Segment operational network and systems to restrict access to critical system functions to predetermined management systems.CitationDepartment of Homeland Security September 2016 |
| ICS | T1692 | Unauthorized Message | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.CitationKaren Scarfone; Paul Hoffman September 2009CitationKeith Stouffer May 2015CitationDepartment of Homeland Security September 2016CitationDwight Anderson 2014 |
| ICS | T0858 | Change Operating Mode | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 |
| ICS | T0868 | Detect Operating Mode | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 |
| ICS | T0800 | Activate Firmware Update Mode | Segment operational network and systems to restrict access to critical system functions to predetermined management systems. CitationDepartment of Homeland Security September 2016 |
| ICS | T0819 | Exploit Public-Facing Application | Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure. |
| ICS | T1692.001 | Command MessageSub-technique | Segment operational assets and their management devices based on their functional role within the process. Enabling more strict isolation to more critical control and operational information within the control environment.CitationKaren Scarfone; Paul Hoffman September 2009CitationKeith Stouffer May 2015CitationDepartment of Homeland Security September 2016CitationDwight Anderson 2014 |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | e85a4895dc49… | ||
| 19.1 | 1.1 | Older bundle | e85a4895dc49… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]IEC February 2019
IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25
Open source URL - [2]IEC August 2013
IEC 2013, August Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels Retrieved. 2020/09/25
Open source URL - [3]mitre-attackM0930Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.