Industrial Control System Network Segmentation

Why segmentation matters in OT networks

Industrial control system segmentation reduces the size of each trust zone so that a fault, misconfiguration or intrusion does not automatically spread across engineering workstations, supervisory systems and controllers. In OT, that containment function is especially important because availability, safety and deterministic communication often matter more than broad connectivity.

Segmentation is not just a perimeter control. It is an architecture decision about which devices may talk, which protocols may cross a boundary and what kind of inspection or brokering is required. NIST’s OT guidance on NIST SP 800-82 Rev 3, OT Security Guide treats segmentation as a core part of industrial security design rather than an optional hardening step.

In practice, the goal is to turn a flat or loosely connected control environment into smaller zones with defined conduits. That can be done with VLANs, industrial firewalls, unidirectional gateways, or other controls, but the important point is the enforced boundary, not the brand or product.

Zones, conduits and traffic control

The classic OT segmentation model separates enterprise IT, supervisory layers, control zones and safety or cell areas so that each zone has a narrower communication surface. This is why segmentation is often discussed alongside the Purdue model and IEC 62443 zones and conduits, which provide a vocabulary for describing trust boundaries, allowed flows and enforcement points.

Well-designed segmentation also distinguishes between what must be reachable for operations and what merely happens to work today. A maintenance path, historian feed or vendor connection may be legitimate, but it should be explicit, constrained and monitored rather than left open by default.

The practical design challenge is that industrial systems often use legacy protocols, proprietary devices and fragile dependencies. A segmentation project therefore has to preserve control traffic, timing and safety requirements while removing unnecessary adjacency. That is why segmentation should be mapped from process requirements and asset relationships, not from office-network habits.

A useful reference point for this model is NHIMG’s OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide, which focuses on how to structure conduits, choose enforcement points and migrate away from flat OT layouts.

What segmentation protects against

Segmentation mainly protects against lateral movement, uncontrolled broadcast reach and cross-zone failure propagation. If an attacker lands in a less critical zone, segmentation can prevent immediate movement into controllers, safety logic or remote administration paths. It can also limit the blast radius of a misrouted packet, noisy device or malfunctioning engineering tool.

That protective value is strongest when paired with inventory and flow knowledge. If teams do not know which assets exist or which communications are actually needed, boundaries are either too permissive to matter or so strict that operators bypass them. Visibility into OT assets and traffic is therefore part of making segmentation effective, not a separate nice-to-have.

Segmentation also reduces exposure created by vendor access and management pathways. Remote support, engineering downloads and jump hosts are frequent sources of unintended trust expansion, so the architecture must constrain those paths as carefully as production control traffic.

For a broader defensive framing, NHIMG’s Network Security Guide and Defence in Depth Guide both reinforce the idea that segmentation is one layer in a larger containment strategy, not a substitute for authentication, monitoring or recovery planning.

Validation, monitoring and change control

Segmentation only works if it stays true to the intended design. Changes to firewall rules, switch trunks, VPN paths or remote-access exceptions can silently flatten the environment again. For that reason, OT segmentation requires continuous validation of allowed flows, periodic review of exceptions and careful change control around new equipment or integrations.

Monitoring should focus on unexpected east-west traffic, management-plane access, repeated denies, newly exposed conduits and protocol use that does not match the approved model. In an OT setting, those signals often matter more than volume-based thresholds because a single unauthorized path can be enough to undermine containment.

Because segmentation is an architectural control, testing should be done with OT-safe methods and scoped carefully to avoid disrupting process operations. The right question is not whether a device can technically reach another host, but whether that communication is justified, documented and enforced in production.

When organisations need implementation detail, NHIMG’s Network Segmentation Guide and OT Asset Visibility Guide are useful companions because they connect segmentation design to inventory, east-west control and traffic baselining.

Risk and Threat Considerations

Weak OT segmentation creates a broad trust surface, so one compromised workstation, VPN path or engineering account can become a route into controllers, historians or safety-relevant systems. The risk is not only unauthorized access, but also process disruption, containment failure and longer recovery after an intrusion.

Failure mechanism: Flat or poorly enforced zones let adversaries reuse a foothold, move laterally and reach higher-value OT assets through management, vendor or supervision paths that were never meant to be broadly reachable.

Impact: The resulting exposure can include loss of control integrity, wider outage impact, unsafe process behaviour and greater difficulty isolating or eradicating the compromise.

Practitioner Guidance

Governance implication: Treat segmentation as a design and ownership issue, not just a firewall task. Each zone and conduit should have a clear business owner, an approved communication purpose and a review process for exceptions, because undocumented exceptions are how OT segmentation degrades over time.

What to watch for: Repeated “temporary” routes, unmanaged vendor tunnels, dual-homed hosts, any-any firewall rules and unexplained east-west traffic usually indicate that the intended boundary is drifting. If those patterns persist, the segmentation model should be reassessed before it is assumed to be effective.

Related resources from NHI Mgmt Group

• Guide: OT and ICS Identity and Access Guide
• Network Segmentation
• What is the difference between network segmentation and identity-driven access control in industrial environments?
• Industrial Control System (ICS) Network Monitoring
• Industrial Control System (ICS) Network Visibility