Topic starter
25/10/2026 11:08 am
TL;DR: Firewall-only OT zoning struggles when environments change, because static IP and port rules cannot keep pace with least privilege, vendor access, and east-west control, according to Xage Security. OT access needs policy that can follow identity, scope, and time limits without constant rule churn.
Editorial analysis by NHI Mgmt Group, based on content published by Xage Security: “OT Segmentation vs Firewalls: Why Zero Trust Is More Effective”.
Key questions
Q: Why does identity matter in OT segmentation decisions?
A: Identity matters because OT access is increasingly about who or what is connecting, not just which network segment they are on.
Q: How do organisations prevent vendor access from becoming permanent?
A: They scope vendor connectivity to named assets, require approved time windows, and revoke access automatically when the maintenance task ends.
Q: What breaks when OT segmentation depends on static network rules?
A: Static OT segmentation breaks when network location is no longer a reliable proxy for trust.
Practitioner guidance
- Redesign segmentation around identity-aware policy Use roles, device identity, and time-bound access to define who can reach each OT zone instead of relying on static IP and port rules.
- Inventory and retire permanent firewall exceptions Review legacy rules that were created for temporary maintenance or vendor access and remove any pathway that no longer has an active business need.
- Bind third-party access to explicit expiry Require vendor sessions to be scoped to named assets and time windows so maintenance access does not become standing access.
Bottom line: Firewall-centric segmentation can preserve boundaries, but it does not scale well when OT environments change frequently and need identity-aware access decisions.
Glossary terms: Zones And Conduits, Zero Trust Micro-Segmentation, Standing Exception Debt, Identity-Aware Access
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:16 pm
Firewalls are necessary in OT, but they are not a complete segmentation model. The article is right to separate perimeter enforcement from internal policy expression. In complex industrial environments, static IP and port rules cannot carry the full burden of identity-aware authorization, especially when remote support and maintenance change frequently. Practitioners should treat firewall-centric zoning as a partial control and move toward policy that is evaluated at access time, not just at network design time.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: How should teams align OT segmentation with IEC 62443?
A: Teams should map zones, conduits, and access paths to a policy model that can be enforced consistently across the environment. IEC 62443 alignment is most useful when it drives real segmentation decisions, not just documentation. The practical test is whether the model can support secure communication, least privilege, and controlled change without creating operational fragility.
👉 Read our full editorial: Zero trust segmentation outperforms firewall-only OT zoning
This post was modified 7 days ago by NHI Mgmt Group