OT Cybersecurity Basics and ICS Network Segmentation Guide
OT Cybersecurity Basics and ICS Network Segmentation
Most industrial networks grew over twenty years without a master plan. Engineers added devices when production needed them. A PLC here, with new HMI, Remote access for one vendor that never got removed. The result is the flat network where one infected laptop can reach the controllers that run the entire plant.
That laptop problem has shut down production lines, delayed power generation, and cost companies real money. The fix is not complicated. Separate the network into controlled sections. Block traffic that does not need to exist. Monitor what crosses the boundaries.
This is called network segmentation. It works because attackers cannot move through sections they cannot reach.
What OT cybersecurity means in practice
OT stands for operational technology and these systems controls actual physical equipment. Motors, pumps, valves, conveyors and breakers all depend on control signals from the PLC, RTU and DCS units.
The industrial site Controlling the equipement:
- PLCs that execute control logic
- SCADA systems that monitor multiple processes
- HMIs that give operators a view of the system
- Engineering workstations used for programming
- Historians that store process data
- Industrial Ethernet switches
- Field devices such as sensors and drives
If your site relies on SCADA for remote monitoring across multiple locations, our SCADA cybersecurity guide covers the specific attack surfaces and lockdown steps for that architecture.
OT cybersecurity protects these systems without creating new risks to safety or uptime. A patch that works fine on an office computer might require weeks of testing before it touches a production controller. A network scan that runs safely in IT can crash an older PLC.
The goal is protection that respects how these systems actually operate.
How OT security differs from IT security
Both environments need access controls, backups, monitoring and response plans, but the operating priorities can different.
IT teams often focus on data confidentiality. A data breach can expose customer information and Leads to the legal problems. IT systems can often be taken offline for planned patching.
OT teams focus on availability and safety. A process shutdown can mean lost production, contract penalties, or safety events. Many controllers run the same firmware for ten or fifteen years. Changing that firmware requires planning, testing, and a process shutdown.
Standard endpoint security tools may not run on older PLCs. Internet access is typically restricted or blocked. Devices stay in service much longer than office computers.
This does not mean confidentiality is ignored in OT. Engineering files, process recipes, credentials, and network diagrams all need protection. The difference is in how protection gets applied.
Why flat networks create Bigger Security Problems
Imagine a plant network where office computers, engineering laptops, HMIs, SCADA servers and PLC controller are all connected to the same network. This means one device may be able to communicate directly with many others.
An accountant opens a phishing email on her computer. Malware installs and begins scanning the network. Within hours it finds the engineering workstation. From there it reaches the HMI. Then the controllers.
The problem is not only the first compromised computer. The problem is how many other systems become reachable after that first compromise.
Segmentation limits that spread. It creates boundaries that require specific rules before traffic can cross.
What ICS network segmentation actually does
ICS network segmentation splits an industrial network into smaller sections and controls which devices are allowed to communicate with each other.
A basic design might look like this:
▼
▼
▼
▼
▼
▼
▼
The exact structure depends on the plant. The concept stays the same. A PLC does not need a direct path to the accounting server. An office computer does not need to program controllers.
Each boundary gets enforced by a firewall, access control list, or other traffic control method. Only required communication is allowed.
VLANs, subnets, and firewalls are not the same thing
These terms get mixed together often.
A VLAN separates traffic at Layer 2 of the network. Devices in different VLANs cannot talk directly to each other without a router. VLANs help organize traffic but do not enforce security policy by themselves.
A subnet defines an IP address range. Subnets organize routing but do not block specific applications or protocols.
An ACL filters traffic based on rules. ACLs can block certain IP addresses or ports. They work at the router or switch level.
A firewall enforces policy at the boundary between networks. Industrial firewalls can inspect protocols such as Modbus, DNP3, or EtherNet/IP and block specific commands.
Segmentation is the overall design. The tools listed above help enforce it.
The Purdue Model as a reference
The Purdue Model organizes industrial networks into levels.
- Level 0 holds field devices such as sensors and actuators
- Level 1 holds basic controllers and PLCs
- Level 2 holds supervisory control and local HMIs
- Level 3 holds site operations and SCADA servers
- Level 3.5 is the industrial DMZ
- Levels 4 and 5 hold business systems and external networks
Traffic should flow through controlled paths. For example, a SCADA server at Level 3 may need to read data from PLCs at Level 1. That communication should pass through defined conduits with firewall inspection.
A corporate database at Level 4 should not have a direct path to a PLC at Level 1. If process data needs to reach the business network, it should pass through the DMZ where traffic can be logged and controlled.
The Purdue Model is a useful reference. Modern plants may include cloud connections, IIoT devices, or virtualized systems that do not fit neatly into the traditional levels. The model still helps engineers think about communication flows and boundaries.
Zones and conduits from IEC 62443
IEC 62443 uses two main concepts for organizing security.
A zone groups devices that have similar security requirements. For example, all PLCs controlling one production line might sit in one zone. Safety systems might sit in a separate zone.
A conduit is the controlled path between zones. A firewall or controlled switch port can enforce what traffic is allowed in that conduit.
This approach helps answer a basic question. What communication actually needs to happen between these two groups of devices?
If the communication is not required, it can be blocked or restricted.
A practical traffic control example
Consider a power plant with corporate computers, an industrial DMZ, SCADA systems, engineering workstations, and PLC-based control systems.
The firewall rules might be reviewed like this:
| Source | Destination | Traffic type | Decision |
|---|---|---|---|
| Corporate PC | PLC | Direct programming | Block |
| SCADA server | PLC | Control commands | Allow |
| Engineering workstation | PLC | Programming | Restrict and log |
| Vendor remote session | Engineering workstation | Maintenance | Controlled access only |
| Historian | Corporate database | Process data | Allow through DMZ |
| PLC | Internet | General browsing | Block |
These are examples, not universal rules. Each plant has different requirements.
Before blocking traffic, the engineer should know what application needs it, what protocol it uses, where it goes, and what happens if it stops.
Remote access needs careful control
Vendors often need access to controllers for troubleshooting or updates. Leaving that access open creates risk.
Useful controls include:
- Named user accounts instead of shared credentials
- Time-limited access that expires after the maintenance window
- Approval before access is granted
- Session recording
- Logging of all commands sent
- Removal of access when work is complete
A PLC should never be exposed directly to the internet for remote programming.
Start with an asset inventory
Segmentation becomes difficult when nobody knows what devices are connected.
For each important asset, record:
- Device name and type
- Manufacturer and model
- IP address
- Firmware or software version
- Physical location
- What it controls or monitors
- How critical it is to the process
- What protocols it uses
- Which network zone it belongs in
- Who owns or manages it
- Whether it needs remote access
Passive discovery tools can help. These tools listen to network traffic without sending scans that might affect sensitive devices.
An accurate inventory also helps during incident response and recovery.
What to do with old controllers that cannot be patched
Many plants run PLCs that cannot be easily updated or replaced. The PLC might be out of production. The vendor might not support it. The cost of replacement might be too high.
That does not mean the controller must remain exposed.
Possible controls include:
- Segmenting the controller into a restricted zone
- Using a firewall to limit what can reach it
- Restricting who can program it
- Using passive monitoring to watch its traffic
- Keeping verified backups
- Controlling removable media such as USB drives
- Using jump servers for access
- Enforcing strong account controls
- Applying application allow-listing where possible
The first step is reducing exposure. Replacement can be a future project.
Monitor traffic, not just devices
OT monitoring should answer questions such as:
- Did a new device appear on the network?
- Did a PLC start talking to an unexpected system?
- Did someone program a controller outside normal hours?
- Did a vendor account connect outside its approved window?
- Did traffic patterns between zones change?
- Did a device start using a new protocol?
Industrial protocols carry useful information. Modbus TCP, EtherNet/IP, PROFINET, OPC UA, and DNP3 all have commands and function codes that can be logged.
Monitoring tools should learn what normal plant communication looks like. Too many false alerts make the system useless.
Defense in depth for OT
Segmentation is one layer. A practical program combines multiple controls:
- Physical security for control rooms and equipment
- Network segmentation with defined zones
- Firewall rules at the boundaries
- Account and access controls
- Endpoint protection where devices support it
- Network monitoring and logging
- Backup and recovery procedures
- Incident response plans
No single firewall or product eliminates all risk.
How NIST CSF applies to OT
The NIST Cybersecurity Framework provides a structure that works for OT environments. Version 2.0 has six functions:
| Function | OT example |
|---|---|
| Govern | Define who makes security decisions and manages risk |
| Identify | Inventory all PLCs, HMIs, networks, and threats |
| Protect | Segment networks and control access |
| Detect | Monitor OT traffic for unusual activity |
| Respond | Handle an ICS security incident |
| Recover | Restore systems and return the process to normal operation |
For sector-specific frameworks including IEC 62443 and NERC CIP as they apply to SCADA environments, see our SCADA & IEC 62443 OT security guide.
NIST CSF is a high-level framework. NIST SP 800-82 provides specific guidance for OT and ICS security. IEC 62443 adds industrial automation and control system details, including zones and conduits.
These resources work together rather than competing.
Common segmentation mistakes
Avoid these mistakes when working on industrial networks:
- Placing IT systems and PLCs on one flat network
- Treating a VLAN as complete security
- Allowing unrestricted engineering access from office networks
- Giving vendors permanent remote access
- Allowing OT devices to browse the internet
- Creating firewall rules without understanding what traffic they affect
- Scanning sensitive PLCs without testing the impact
- Ignoring old controllers because they cannot be patched
- Skipping backup and recovery testing
- Designing segmentation without documenting communication flows
Good segmentation starts with understanding what communication the process actually needs. Security controls get applied around those requirements.
Network segmentation checklist
Use this list for a first review:
Frequently asked questions
What is OT cybersecurity?
OT cybersecurity protects industrial control systems and the physical processes they operate. This includes PLCs, SCADA, HMI, DCS, industrial networks, access controls, monitoring, segmentation, response, and recovery.
What is ICS network segmentation?
It separates industrial systems into controlled network areas and limits communication between them according to process and security requirements.
Why is network segmentation important in OT?
Segmentation reduces unnecessary communication and limits how far an attacker can move after gaining access to one system.
What is an industrial DMZ?
An industrial DMZ is a controlled network boundary between enterprise IT and OT. It provides a controlled location for services that need communication across the boundary.
Is a VLAN enough for OT segmentation?
No. A VLAN provides logical network separation, but proper security segmentation also requires traffic controls, architecture design, and monitoring.
How does the Purdue Model help OT cybersecurity?
It gives engineers a way to visualize industrial network levels and communication paths. It should be treated as a reference rather than a fixed design for every plant.
What should be secured first in a legacy PLC network?
Start by identifying critical assets and communication paths. Then reduce unnecessary access through segmentation, firewall rules, controlled engineering access, monitoring, and reliable backups.
Final Point
A useful OT security review does not start with a list of products.
Start with the process. Identify the controllers, systems, communication paths, and users that the process actually needs. Separate those systems into logical security zones. Control the paths between them.
That approach gives engineers something they can test, document, monitor, and improve without treating the control network like an ordinary office network.
