Network segmentation: are your OT boundaries actually holding?

TL;DR: Network segmentation is the control that determines whether OT exposure stays contained or becomes an operational crisis, according to Dragos, especially when remote access, wireless links, and flat crossings remain uncontrolled. The boundary, not the inventory, is the real exposure decision point.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Who’s Allowed on the Bridge: MTSA’s Network Segmentation Requirement”.

Key questions

Q: What breaks when OT segmentation is missing or too flat?

A: Flat segmentation collapses the distinction between business systems and operational control, so a compromise can move from a low-risk entry point into environments that affect safety, availability, or control logic.

Q: Why do remote access and vendor pathways increase risk in IT-OT environments?

A: Because they create authenticated bridges between business networks and operational systems that adversaries can reuse after initial access.

Q: How do teams know whether IT/OT segmentation is actually working?

A: Teams know segmentation is working when an incident on corporate IT does not alter production traffic, control-system availability, or the ability to maintain safe operations.

Practitioner guidance

• Map every OT crossing point Document enterprise-to-OT and OT-to-OT crossings, including vendor remote access, jump hosts, wireless uplinks, and undocumented flat connections.
• Broker all remote access through controlled ingress Require every external OT access path to use a dedicated jump host or broker with logging, time limits, and purpose-specific access.
• Separate wireless and radio paths from control networks Treat Wi-Fi, cellular, satellite, radio, and telemetry links as distinct ingress channels and keep them out of control-plane trust zones.

Bottom line: Segmentation is the control that determines whether OT exposure stays containable or becomes an operational crisis.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →