Notifications
Clear all
Topic starter
24/06/2026 11:25 pm
TL;DR: Flat industrial networks, shared VPNs, and lingering credentials let one maintenance session expose multiple PLCs, control servers, and downstream systems, according to Corsha. Identity-based microsegmentation shifts segmentation from network redesign to session-level access control, which is the practical path when uptime constraints make rip-and-replace unrealistic.
NHIMG editorial — based on content published by Corsha: a practical guide for securing identity and access control to reduce lateral risk in industrial environments
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
A: Start with identity and session control, not a wholesale network redesign.
Q: Why do shared VPNs and jump boxes increase lateral movement risk in OT networks?
A: They concentrate trust into a small number of reusable paths, so one approved login can reach far more assets than intended.
Q: What breaks when industrial access still depends on standing credentials?
A: Standing credentials erase the boundary between a legitimate maintenance window and a later unauthorized use.
Practitioner guidance
- Map actual lateral reach per access path Trace what a vendor, technician, or controller session can reach after authentication, including adjacent PLCs, supervisory systems, and downstream zones.
- Replace standing shared logins with session-bound access Issue access for a specific maintenance task and revoke it automatically when the session ends.
- Enforce policy at connection time Apply authorization when the session starts, based on user, device, zone, and purpose, rather than relying on static network location.
What's in the full article
Corsha's full blog post covers the operational detail this post intentionally leaves for the source:
- The step-by-step identity-first segmentation model for industrial networks
- The vendor access and maintenance workflow examples used to show session-level control
- The native integration points for OT and ICS systems and protocols
- The access expiration and policy enforcement mechanics that support production continuity
👉 Read Corsha's guide to identity-first microsegmentation for industrial networks →
Industrial microsegmentation: what identity-first controls change?
Explore further
25/06/2026 8:16 am
Identity-first segmentation is really access governance disguised as network design. The article is right to move the control point from VLAN rebuilds to session policy, because industrial environments rarely tolerate large-scale network rework. The real issue is not the packet path alone, but who can open a path in the first place. Practitioners should treat segmentation as an identity decision, not just an infrastructure layout choice.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when a vendor session exposes more of the plant than intended?
A: Accountability sits with the team that defined the access model and approved the shared path. In industrial environments, that usually means IAM, OT security, and operations leadership must jointly own the blast radius of each session, because segmentation failures are governance failures as much as technical ones.
👉 Read our full editorial: Identity-first microsegmentation for industrial network lateral risk
