Network segmentation is one of the most effective controls in OT cybersecurity—and one of the most frequently misapplied. Industrial environments impose constraints that IT-centric segmentation strategies routinely ignore: legacy protocols, fragile controllers, uninterrupted process requirements, and unclear ownership between IT and OT teams. Getting it right requires a different approach from the ground up.
Why Network Segmentation OT Security Is Different
Segmentation in OT environments differs fundamentally from IT. Legacy systems running Modbus or DNP3 often lack modern security features, while industrial control systems require uninterrupted communication for process stability. Operators frequently struggle with incomplete network diagrams, third-party remote access, and unclear IT/OT ownership boundaries—all of which complicate segmentation efforts and raise the risk that a misconfiguration causes downtime rather than preventing it.
A plant manager at a water treatment facility learned this directly when a newly implemented firewall blocked DNP3 traffic between a SCADA system and a PLC, triggering a 45-minute shutdown of the pumping station. The technical control was sound in isolation; it failed because it was applied without understanding the operational dependency underneath it. That distinction—between a control that is technically correct and one that is operationally safe—is the central challenge of OT network segmentation.
Align Segmentation with Operational Realities
Effective segmentation must balance security with operational continuity. Three practices make that balance achievable.
- Start with asset inventory: Monitoring should maintain an evolving picture of assets, configurations, and communication patterns. Use protocol-aware tools to map Modbus, DNP3, and OPC UA traffic before drawing any zone boundaries—dependencies you do not know about will not survive a firewall rule.
- Segment by function, not just device type: IEC 62443 recommends creating security zones based on process functions—process control, safety systems, historian and IT/OT convergence—rather than physical location or vendor. A Siemens SIMATIC system and a Rockwell Allen-Bradley system may sit on the same floor but serve different process functions and carry different risk profiles.
- Account for legacy systems: Older controllers such as Honeywell TPS or ABB legacy systems may lack native segmentation capabilities. Compensating controls—network firewalls with protocol-specific rules, application-layer filtering, enhanced logging—can reduce exposure without requiring hardware replacement.
A steel mill applied this approach to its blast furnace controls, using VLANs and industrial firewalls to isolate those systems from the broader plant network. A cyber vulnerability risk assessment identified that unsegmented legacy PLCs were exposed to lateral movement from ransomware. The result was a 70% reduction in attack surface with no disruption to production. For a deeper look at how OT vulnerability prioritization differs from standard CVSS scoring, that context matters when deciding which zones to harden first.
Building a Segmentation Strategy Step by Step
A robust segmentation strategy integrates technical controls with procedural discipline. The following sequence reflects how it works in practice.
Define Security Zones and Conduits
Following IEC 62443, security zones should reflect process function. A representative zone model for a process industry site might look like this:
- Zone 1: Process control systems (e.g., Schneider Electric PACs, distributed control systems)
- Zone 2: Safety instrumented systems (e.g., Honeywell Experion Safety Manager)
- Zone 3: IT/OT convergence layer (e.g., OPC UA gateways, historians)
Conduits between zones should be tightly controlled. A firewall sitting between Zone 1 and Zone 3, for example, might permit only OPC UA traffic on port 4840 while blocking everything else—including protocols that have no legitimate business crossing that boundary.
Implement Protocol-Aware Firewalls
Traditional IT firewalls inspect packets at the IP and TCP layer but cannot parse industrial protocol payloads. A firewall that cannot distinguish a legitimate Modbus read request from a malformed one that causes a PLC to fault is not a useful control in OT. Protocol-aware firewalls—capable of deep inspection of Modbus TCP, DNP3, EtherNet/IP, and similar protocols—reduce false positives and ensure legitimate traffic flows uninterrupted.
A chemical plant that deployed protocol-aware segmentation to isolate DNP3 traffic from its SCADA system reported a 90% reduction in false positives during monitoring, because the system could differentiate between normal process variation and genuinely anomalous traffic patterns.
Validate Before Declaring Victory
After segmentation is implemented, validate that controls meet design objectives without compromising operational performance. This means more than a configuration review. Controlled testing—attempting lateral movement between zones, testing firewall rule sets against known attack patterns, verifying that blocked traffic actually fails rather than silently bypasses—confirms the architecture behaves as intended. Pen testing OT firewalls without disrupting operations is a structured way to close that validation gap. A food processing plant used this approach to test PLC zone isolation under simulated exfiltration conditions; the firewall rules held, and the test confirmed the segmentation was effective before any real threat could probe the same boundaries.
Maintaining Segmentation as the Network Evolves
Segmentation is not a one-time project. Networks change—new devices are commissioned, vendors gain remote access, process modifications alter communication patterns—and segmentation rules that were accurate at deployment will drift without active maintenance.
- Use behavioral baselines: Anomaly detection is most useful when it can distinguish normal operational variation from suspicious activity. A sudden spike in Modbus polling frequency may indicate a reconnaissance scan; a gradual shift in DNP3 traffic patterns may signal a compromised device. Neither looks like a traditional IT alert.
- Apply human context to reduce false positives: OT analysts need enough operational knowledge to distinguish a technician commissioning a new valve from an attacker probing the same protocol stack. Without that context, alert fatigue sets in and genuine threats get buried.
- Update rules when assets change: When a new controller is added to the network, its communication requirements must be evaluated against existing zone boundaries before it goes live. Adding a device and updating the firewall rules afterward—or never—is how segmentation erodes.
A power generation facility integrated prioritized vulnerability management with its segmentation maintenance program, using NIST SP 800-82 guidance to structure periodic reviews. By systematically revisiting zone definitions and conduit rules in line with that framework, the team reduced exposure to unpatched vulnerabilities and kept segmentation aligned with how the network actually operated. Understanding how assessments inform that ongoing process is covered in detail in conducting an OT cybersecurity assessment without disrupting production.
Segmentation Supports Defense-in-Depth
No single control eliminates risk in an OT environment. Segmentation reduces blast radius, slows lateral movement, and makes monitoring more effective—but it works best as one layer in a broader defense-in-depth architecture that includes access control, secure remote access, endpoint hardening, and continuous monitoring. Security zones and conduits make each of those other controls easier to enforce and easier to verify.
The goal is not perfect isolation. It is a network architecture where a compromised device in one zone cannot readily reach the control logic in another, where monitoring tools have clear visibility into what crosses zone boundaries, and where an attacker who gains initial access faces meaningful friction at every subsequent step. That architecture is achievable in OT environments—but only when segmentation is designed around operational realities rather than imposed on top of them.
