How should organisations segment IT and OT networks to reduce lateral movement without disrupting operations?

Design segmentation around trust boundaries, not just IP ranges

Effective IT and OT segmentation starts by separating zones with different risk, safety, and uptime requirements, then limiting each boundary to the minimum traffic the business and operations actually need. In practice, this means defining where operators, historians, engineering workstations, remote vendors, and corporate services may cross into OT, rather than leaving broad routable access in place.

Good segmentation is more than a firewall in front of the plant. It should express the operational reality of the environment, including legacy protocols, deterministic traffic, and systems that cannot tolerate frequent reconfiguration. NIST SP 800-82 Rev 3 remains the clearest reference for structuring OT zones and conduits so security controls fit industrial operations instead of disrupting them.

When done well, segmentation reduces the chance that a compromise in email, endpoints, or enterprise services can move laterally into OT controllers or supervisory systems. It also makes it easier to apply different control strength to different assets, so highly sensitive OT functions are not exposed to the same network paths as routine IT services.

Keep the paths you do allow narrow, explicit, and observable

Most organisations do not need full IT-to-OT connectivity. They need a small number of tightly governed pathways for monitoring, maintenance, patch staging, file transfer, and approved business integration. Each allowed path should have a clear owner, a documented purpose, and a defined source, destination, protocol, and timing window.

That narrow design matters because lateral movement usually succeeds when defenders create convenience paths that outlive their original purpose. A remote support tunnel, a shared admin segment, or a flat supervisory network can become a bridge across zones if it is not scoped, logged, and reviewed. MITRE ATT&CK Enterprise Matrix is useful here because it helps teams think in terms of how an attacker would chain access, credential use, and lateral movement once one boundary is crossed.

Monitoring should be designed into the allowed pathways from the start. If traffic between IT and OT is necessary, the organisation should be able to see who used it, when, from where, and for what purpose. Otherwise segmentation becomes theoretical, because the first alert may arrive only after an attacker has already pivoted into a higher-consequence environment.

In many environments, the safest design is a layered one: user networks stay separate from server networks, which stay separate from remote administration channels, which stay separate from core control zones. That structure gives defenders room to inspect and limit traffic without forcing every operational workflow through the same bridge.

Balance containment with availability, change control, and recovery

OT segmentation must be judged by whether it lowers blast radius without breaking safe operation. Overly aggressive isolation can interrupt plant visibility, alarm handling, vendor support, or time-sensitive engineering tasks, while overly permissive segmentation leaves the organisation with the appearance of control but little real containment.

The practical test is whether the control still works during maintenance, outage recovery, and emergency operations. If segmentation depends on manual exceptions, temporary rule changes, or undocumented jump paths, those exceptions become part of the attack surface. A strong design uses approved break-glass routes, short-lived access, and change control that is strict enough to protect the environment but not so rigid that operators bypass it under pressure.

CISA Industrial Control Systems guidance is a useful companion when organisations need to align segmentation with operational technology realities, especially where availability and safety constraints change how quickly controls can be introduced. The goal is to reduce exposure in ways that the plant can sustain, not to impose an IT-only model on a live industrial process.

Recovery planning also matters. If segmentation is part of the containment strategy, teams should be able to restore safe connectivity in a controlled way after an incident, rather than reopening everything to get systems running. That requires pre-approved routing, tested recovery procedures, and clear criteria for when emergency connectivity is allowed and when it is not.

Risk and Threat Considerations

Weak segmentation turns a single IT foothold into a pathway toward OT supervision, engineering access, or sensitive monitoring systems. The exposure is not just data theft, it is the possibility that an attacker can move laterally into environments where availability and process integrity matter more than conventional endpoint containment.

Failure mechanism: Flat routing, shared administrative access, or poorly governed remote support paths let an initial compromise cross boundaries that were meant to contain it. Once an attacker reaches a trusted OT-adjacent zone, they can often reuse legitimate protocols and management channels to blend in with operational traffic.

Impact: The result can be loss of visibility, unsafe command execution, interrupted operations, or a larger incident scope than the initial compromise would otherwise justify. In OT, that can mean business disruption as well as physical process risk.

Practitioner Guidance

What to prioritise: Start with the highest-value and highest-trust boundaries, such as corporate to OT remote access, engineering workstations to controllers, and vendor support paths. Those are the links most likely to be reused for lateral movement if they are broad or poorly monitored.

What to verify: Confirm that every permitted IT-to-OT connection has a named business purpose, an owner, logging, and a review cycle. If a route exists only because it was needed once, treat it as a candidate for removal or replacement with a narrower control.

Decision rule: If a connection is needed for operations, allow the smallest possible function that satisfies the use case, then monitor it closely; if it is not needed for a current process, do not keep it open “just in case.”

Practitioner takeaway: The right segmentation model is the one that constrains attacker movement while preserving the few operational paths the plant genuinely needs, and that balance has to be proven in day-to-day operations, not assumed from the network diagram.

Related resources from NHI Mgmt Group

• Guide: Lateral Movement Guide
• How can organisations reduce lateral movement without breaking normal operations?
• How should security teams segment OT networks without disrupting production?
• How should security teams reduce attack paths into legacy and OT systems without disrupting operations?
• How should security teams use active defense to protect OT networks in buildings without disrupting operations?