OT zero trust: why segmentation still leaves the front door open

TL;DR: OT zero trust fails when programs stop at east-west segmentation and leave north-south access paths, such as VPNs, shared vendor accounts and exposed remote tools, insufficiently governed, according to Forescout. Identity-aware access and session-level control are the missing half because the deciding risk is who gets in and what they can reach, not only what can talk laterally.

Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “Segmentation and Identity: The Two Halves of Zero Trust in OT”.

Key questions

Q: What breaks when zero trust segmentation is applied without device context?

A: Security teams often block legitimate communications because they cannot see the dependencies behind a device’s normal operation.

Q: Why do remote access paths create more risk than network zones in OT?

A: Remote access paths define who enters, what they can reach and how much accountability exists once the session starts.

Q: What are the signs that remote access to OT controllers is being misapplied?

A: Look for management interfaces that are internet-facing, contractor connections that are not documented, sessions from sources outside the approved allowlist, bulk setpoint or defrost changes across many devices, and controllers still running plain HTTP management access.

Practitioner guidance

• Map every remote access path Inventory VPNs, remote desktop tools, vendor portals, jump hosts, modem links and embedded vendor accounts before trying to tighten policy.
• Bind OT access to named identities Require per-user authentication, role-based authorization and session-scoped connectivity for any person or third party reaching critical assets.
• Separate entry control from movement control Use identity-aware access to manage who enters and segmentation to constrain what they can reach after entry.

Bottom line: OT segmentation reduces lateral movement, but it does not solve the identity and access problem at the plant boundary.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →