Network segmentation is the most effective way to protect operational technology (OT) from cyberattacks that start in the business network. When office PCs, production equipment, cameras, and guest Wi-Fi all share one flat network, a single phishing email can lead to a production shutdown. Segmentation creates boundaries that contain attacks and give you control over what can talk to your industrial systems.
This guide walks through a practical approach to segmenting OT networks in manufacturing and industrial environments.
Why Segmentation Matters For OT
OT systems often run older operating systems, use protocols with no built-in security, and cannot be patched on a normal schedule. You cannot always fix the vulnerabilities, so you limit who can reach them. Segmentation reduces the attack surface, slows down attackers, and makes unusual traffic easier to detect.
Step 1: Map Your Assets And Data Flows
Before drawing new boundaries, understand what you have and how it communicates. Identify PLCs, HMIs, SCADA servers, historians, engineering workstations, and any connections to ERP, MES, or vendor support systems. Document which systems need to communicate and why. Passive monitoring tools can help discover traffic without disrupting production.
Step 2: Define Zones And Conduits
Many organizations use a model based on the Purdue reference architecture and the ISA/IEC 62443 concept of zones and conduits. A zone is a group of assets with similar security needs. A conduit is the controlled path between zones. A typical layout includes:
- Enterprise zone: business systems, email, office PCs
- Industrial DMZ: historians, patch servers, remote access gateways that share data between IT and OT
- Operations zone: SCADA servers, MES, engineering workstations
- Control zones: PLCs, HMIs, and field devices, often separated by production line or area
The key rule is that no traffic should pass directly from the enterprise network to control systems. Everything flows through the DMZ.
Step 3: Enforce Boundaries With Firewalls
Use industrial-capable firewalls between zones and configure them to deny all traffic by default. Then allow only specific, documented connections. For example, the historian in the DMZ may read data from the SCADA server, but office PCs cannot connect to the SCADA server at all.
Step 4: Secure Remote Access
Vendor and engineer access should terminate in the DMZ through a secure gateway with multi-factor authentication, session logging, and time-limited access. Remove direct modems, unmanaged remote desktop tools, and VPNs that land inside control networks.
Step 5: Use VLANs And Access Controls Inside Zones
Within the operations and control zones, VLANs and switch access controls can separate production lines or cells so an issue on one line does not spread to others. Disable unused switch ports and restrict which devices can connect.
Step 6: Monitor Traffic Between Zones
Segmentation creates natural checkpoints for monitoring. Network monitoring at zone boundaries can alert you to new connections, unexpected protocols, or commands sent from unusual sources. This visibility helps catch attackers early.
Step 7: Roll Out In Phases
Changing OT networks can affect production. Plan changes during scheduled downtime, start with the highest-risk connections such as remote access and IT-to-OT pathways, test thoroughly, and keep rollback plans ready. Involve operations and maintenance staff in every step.
Step 8: Document And Maintain
Keep network diagrams, firewall rules, and data flow documentation current. Review rules at least annually and whenever new equipment or vendors are added. Segmentation degrades over time if exceptions are added without review.
Common Mistakes
- Allowing broad “any to any” rules to avoid breaking things
- Leaving vendor remote access tools inside control zones
- Dual-homed computers that bridge IT and OT networks
- Not monitoring traffic once segmentation is in place
Start With The Highest Impact
If you can only do one thing this year, separate business and production networks with a firewall and a DMZ, and route all remote access through it. That single change dramatically reduces the risk of an office incident becoming a plant shutdown.
CTS Companies helps Michigan manufacturers design and implement segmentation that protects production without disrupting it. Learn more about our cybersecurity services for manufacturing and network security services, or talk to an expert.