In conversations about industrial cyber security, the word “segmentation” is conjugated through all cases. It is the absolute basis, the foundation and the first step to building any meaningful defense strategy. At the same time, for many engineers and maintenance managers, it is a word that evokes immediate opposition and visions of weeks of downtime. A vision of a complicated project to reconfigure the entire network, which is bound to break something in a production process that has worked perfectly for 15 years.
This fear is fully justified if we think of segmentation in a traditional IT way. However, technology has moved on, and today there are methods that allow granular segmentation to be implemented in a mature, operational OT network in an almost non-invasive manner. The key is to move away from a revolutionary approach that requires changing IP addressing to an evolutionary method that implements security in a way that is transparent to existing devices.
In this article, we will go step-by-step through the practical process of implementing segmentation in a typical “flat” industrial network. We will show how to use modern industrial firewalls to create secure zones without stopping production and without touching the configuration of critical controllers. This is a guide for those who know they must act, but are afraid of the risks.
Shortcuts
- What is a “flat grid” and why does it pose a deadly threat to manufacturing?
- What is segmentation and why is it a digital watertight bulkhead system?
- Why is classic segmentation using VLANs so difficult to implement in an OT network?
- What are the risks to the production process of changing PLC IP addresses?
- What is a transparent industrial firewall and how is it revolutionizing segmentation in OT?
- How can a firewall filter traffic without being visible on the network?
- Step One: How to conduct passive resource discovery and map communication?
- Step Two: How to logically group resources into zones without changing their physical location?
- Step Three: Why is deploying a firewall in monitoring mode crucial to avoiding downtime?
- Step Four: How to create precise and safe rules based on the learned movement?
- Step Five: What is the safe transition from monitoring to active blocking?
- Secure OT network segmentation in 5 steps
- In addition to security, what are the benefits of structuring communications in an OT network?
- Is segmentation without revolution possible and what is the first step to take?
What is a “flat grid” and why does it pose a deadly threat to manufacturing?
“Flat network” (flat network) is a term describing an architecture in which all connected devices are located in a single, large broadcast domain. Simply put, it’s a network in which any device can freely communicate with any other, without any internal barriers or control points. Imagine a huge, open hall with hundreds of machines lined up - anyone can walk up to any one and “talk” to it. This is what a flat OT network looks like.
For many years, this approach was the industry standard. It was simple to implement and manage, and with the assumption that the network was physically isolated (the “air gap” myth), it seemed safe enough. Today, however, in the age of connected factories, flat architecture poses a deadly threat. It acts as a digital highway for malware and attackers.
All it takes is for one, least important computer on that network to become infected, for example by a service technician’s flash drive. In a flat network, the malware can spread unhindered to all other devices, including critical PLCs and SCADA systems, paralyzing the entire factory within minutes. This lack of internal barriers was the main reason why attacks such as NotPetya were able to cripple global manufacturing operations so quickly and so effectively.
📚 Read the complete guide: OT/ICS Security: Bezpieczeństwo systemów OT/ICS - różnice z IT, zagrożenia, praktyki
What is segmentation and why is it a digital watertight bulkhead system?
Segmentation is the process of logically dividing a large, flat network into smaller, isolated subnetworks, or segments or zones. The best analogy for understanding this concept is the construction of a ship. The hull of a ship is not one big empty space. It is divided into a series of watertight compartments (bulkheads). If a hole develops in the hull and one compartment is flooded, the watertight bulkheads will prevent the water from spreading throughout the ship, allowing it to stay afloat.
This is exactly how segmentation works in a computer network. It creates digital watertight bulkheads. Each segment (e.g. a particular production line, a security system, a zone with robots) is separated from others by a firewall. Communication between segments is blocked by default and allowed only in strictly defined and justified cases.
Thanks to segmentation, even if an attacker compromises a device in one segment, his attack is “sunk” in that one compartment. He cannot move freely around the network (lateral movement) and infect systems in other segments. This gives security teams invaluable time to detect, locate and stop an attack before it turns into a factory-wide disaster.
Why is classic segmentation using VLANs so difficult to implement in an OT network?
In the IT world, the most popular method of network segmentation is the use of VLAN (Virtual Local Area Network) technology. VLANs allow one physical network to be logically divided into many smaller virtual subnetworks. It is a flexible and widely used solution. The problem is that each VLAN must be a separate IP subnet. And this means that the IP addresses of the devices to be included in the new segment must be changed.
For an IT administrator, changing the IP address of a server or computer is a simple, routine operation. In the OT world, it is a high-risk operation. Industrial control systems are complex ecosystems in which devices communicate with each other, often using statically entered (“hardcoded”) IP addresses in the application configuration.
Changing the IP address of a PLC or SCADA station can break communication with dozens of other devices that reference its old address. This can require not only reconfiguring the controller itself, but also reconfiguring and testing HMI panels, OPC servers, historical databases and many other systems. This is an extremely complex, time-consuming process with a huge risk of error, which can lead to unpredictable machine behavior and production stops.
What are the risks to the production process of changing PLC IP addresses?
The risks associated with a change of address in an operational OT network are so great that in most cases they are simply unacceptable to management and engineers. First, it requires stopping the production process. It is impossible to change the IP address of a controller “live” while it is controlling machine operations. Any such change requires a scheduled downtime, which in itself generates costs.
Second, there is a huge risk of human error and compatibility problems. OT network documentation is often incomplete or outdated. The engineer making the change may not know about all the systems that communicate with a given controller. Skipping the reconfiguration of one critical connection can lead to a production line not starting or malfunctioning after a restart.
Finally, many older devices and applications do not provide for easy IP address changes at all, or require specialized, often no longer available software or knowledge to do so. From the perspective of an OT engineer, who is responsible for the stability of the process, the risks associated with global address changes in the name of “some cyber security” are simply too high. This is why segmentation projects based on this method are often blocked at the very beginning.
What is a transparent industrial firewall and how is it revolutionizing segmentation in OT?
Fortunately, this problem has been recognized by security equipment manufacturers, who have developed a solution tailored to the needs of OT: a transparent (or bridging) industrial firewall. This is a device that revolutionizes the approach to segmentation, as it allows it to be implemented without any changes to existing IP addressing.
A traditional firewall operates in routed mode - it is “visible” in the network, has its own IP addresses and is the boundary between two different subnets. A transparent firewall operates differently, at Layer 2 of the OSI model, much like a network switch (switch) or bridge (bridge). It is physically plugged into an existing network cable, but is completely “transparent” to the communicating devices. It does not have an IP address on a given subnet and does not require any changes to the default gateway configuration on the end devices.
Thus, we can insert such a firewall, for example, between a group of PLCs and the rest of the network, and the PLCs will not even “notice” its presence. They will continue to operate on the same subnet and communicate as before. The difference is that all traffic passing through the transparent firewall is now deeply inspected and filtered according to preset security rules. This makes it possible to create a digital watertight bulkhead without touching the sensitive configuration of end devices.
How can a firewall filter traffic without being visible on the network?
The magic of a transparent firewall lies in its operation in bridge mode. This device has at least two physical ports. You connect one port to the segment you want to protect (for example, to the switch where the PLCs are plugged in), and the other port to the rest of the network. The firewall acts like a smart bridge that passes Ethernet frames from one port to the other.
However, unlike a simple bridge, it subjects the frame to detailed analysis before passing it on. Modern industrial firewalls can analyze not only IP headers (source address, destination address, port), but also the contents of the packets themselves, recognizing specific industrial protocols and commands (e.g. Modbus, Profinet, S7). Such technology is called Deep Packet Inspection (DPI).
With DPI, the firewall can enforce very precise rules. For example, it can allow an engineering station to send only status-reading-related commands to a PLC, but block an attempt to send a “stop” or “change program” command. And all this is done in a way that is completely transparent to the communicating devices, which still “think” they are in one flat network.
Step One: How to conduct passive resource discovery and map communication?
The first and absolutely fundamental step in any segmentation project is to understand the current state. You can’t effectively segment a network without knowing what’s in it and how it talks to each other. In OT environments, where documentation is often outdated and active network scanning is too risky, the best approach is passive resource discovery.
It involves connecting a specialized tool (probe) to the network, which only “listens” to all network traffic, without sending any packets of its own. By analyzing this traffic, the tool is able to automatically identify all active devices, determine their type (e.g. Siemens PLC, Rockwell HMI), software version, and map all communication sessions occurring between them.
The result of this stage is a detailed inventory and communication map. We learn not only what resources we have, but also who is communicating with whom, when and through what protocols. This knowledge is invaluable. It allows us to identify critical flows that must be preserved, but also to discover unauthorized or unnecessary connections that can be safely blocked.
Step Two: How to logically group resources into zones without changing their physical location?
With an accurate network map in hand, we can proceed with segmentation planning. At this stage, still only on paper, we group the identified resources into logical zones or segments. The basis for grouping should be the function and criticality of the devices, according to the philosophy of the Purdue Model.
For example, we can decide that all the controllers and HMI panels belonging to Production Line 1 will form one zone. Welding robots in another part of the factory will form a second zone. Safety systems (e.g., safety controllers, fire sensors) should be in a separate, highly protected zone. Engineering stations, used for programming controllers, can also form a separate zone.
The important thing is that at this stage it is a purely logical exercise. We are not changing any cables or configurations. We are simply drawing the boundaries of future segments on our map. The goal is to create a target architecture that implements the principle of risk isolation - compromising one zone should not allow another zone to easily take over.
Step Three: Why is deploying a firewall in monitoring mode crucial to avoiding downtime?
Once the zones are planned, the moment comes to physically deploy transparent firewalls at the planned points on the network. However, the key to a non-intrusive deployment is that we don’t initially enable any blocking. Instead, we run the firewall in monitoring mode (learning mode or tap mode).
In this mode, the firewall still analyzes all traffic passing through it, but does not block any packets. Its main task is to “learn” the normal pattern of communication in a given network segment. Over a period of days or weeks, the firewall builds up a detailed knowledge base of which devices are communicating with each other, on which ports and using which protocols.
This step is absolutely critical to the success of the entire project. It allows you to verify and complete the communication map created in step one, capturing infrequent, periodic calls (such as monthly reporting) that may have been missed. Most importantly, this is done with zero risk to production. The network works exactly as before, and we securely collect the data necessary to create precise security rules.
Step Four: How to create precise and safe rules based on the learned movement?
Once the firewall has collected enough data on normal traffic, we can proceed to create a security policy. This process should be based on the principle of default deny, also known as whitelisting. This means that instead of creating rules to block known bad traffic, we create rules to allow only known, necessary and authorized traffic. Everything else is blocked by default.
Based on the data collected in monitoring mode, the administrator creates a precise set of “allow” rules. For example: “Allow SCADA station with address A to communicate with PLC with address B only using Modbus protocol on port 502”. “Allow engineering station C to communicate with the same controller only using the S7 protocol”.
Creating such a precise “whitelist” is much safer than trying to block all possible threats (“blacklist”). It ensures that only those communications that are absolutely necessary for the proper operation of the production process will pass through the segment boundary. At this stage, the rules are still configured “dry”, without activating blocking.
Step Five: What is the safe transition from monitoring to active blocking?
Once we have a set of rules defined and verified, there comes the moment of “switching the reins,” that is, moving from monitoring mode to active blocking mode (enforcement mode). This moment, although potentially the most stressful, can proceed in a controlled and safe manner thanks to advance preparation.
Best practice is to conduct this transition in a phased manner and in close cooperation with the OT team. The switchover should take place during a scheduled short service window or during a period of lower production load. Once blocking is activated, the team must immediately and intensively monitor both the logs from the firewall and the operation of the production process itself to ensure that no critical communications are inadvertently blocked.
If a problem nevertheless arises, the transparent firewall allows you to react very quickly. As a last resort, it can be switched back to monitoring mode within seconds, immediately restoring full communication and giving you time to calmly analyze and correct the erroneous rule. It is this ability to quickly and safely roll back changes that is the biggest advantage of this methodology and distinguishes it from the irreversible consequences of an erroneous IP address change.
Secure OT network segmentation in 5 steps
StepActionTargetRisks to production1. discoveryPassive mapping of network resources and communications.Understanding the current state (“what do I have and how does it talk?”).Zero2. planningLogical grouping of resources into safety zones.Create a target secure architecture.Zero3. implementation and learningInstallation of transparent firewalls in monitoring mode.Collect normal traffic data without blocking.Zero4 Rule makingDefine a “whitelist” policy based on learned patterns.Creating precise rules to allow only necessary movement.Zero5. activationGradual transition to active blocking mode under controlled conditions.Enforce policies and protect segments with minimal risk.Low and controlled
In addition to security, what are the benefits of structuring communications in an OT network?
The main purpose of segmentation is, of course, to improve cyber security. However, bringing order to the communication chaos in a flat network brings a number of additional, often unexpected operational benefits. First and foremost, network stability and reliability are significantly improved. Reducing unnecessary traffic, especially broadcasts, reduces the load on network devices and controllers, which can prevent their hang-ups and unforeseen performance problems.
The detailed communication map created for segmentation is an invaluable tool for diagnostics and troubleshooting. When there is a communication problem between two devices, engineers know exactly what traffic should be between them and can quickly check on the firewall whether it is being blocked or whether the problem lies elsewhere. This drastically reduces the time it takes to diagnose and fix the failure.
Finally, a well-segmented network is much easier to manage and expand. Introducing a new machine or production line becomes simpler because it can be placed in a new, isolated segment and then its interactions with the rest of the system can be precisely defined without risking destabilizing the existing infrastructure. Segmentation brings order, which translates not only into security, but also into overall operational maturity.
Is segmentation without revolution possible and what is the first step to take?
Yes, segmentation without revolution is not only possible, but is even a recommended approach in mature production environments. The method, based on the implementation of transparent firewalls, makes it possible to achieve huge security benefits with minimal, controlled risks to operations. It is an evolutionary approach that allows the network to be sealed gradually and securely, segment by segment, without the need for a single, large and risky “big bang” project.
The key to success is a shift in thinking. Instead of viewing segmentation as a dreaded reconfiguration project, it should be viewed as a process of bringing order and visibility. It is the lack of visibility that is the biggest enemy of security and stability in OT networks. We don’t know what we have, we don’t know how it talks to each other, and we are afraid to touch anything lest we break something.
Therefore, the absolute first and most important step any organization can and should take is to passively map its network. Even before we buy any firewall, we need to gain knowledge. Implementing passive monitoring tools and creating a thorough inventory of your resources and data flows is a completely non-invasive action that brings tremendous value on its own. It’s a foundation on which you can safely build the rest of your segmentation strategy, turning fear of the unknown into informed and controlled risk management.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Wireless Networks — Wireless networks are communication systems that enable data transmission…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
Learn More
Explore related articles in our knowledge base:
- Tabletop Exercise at the Factory: How to test your plan in case of a cyber attack without stopping the production line?
- 5G network security: What new risks and opportunities does it bring to business?
- IDS/IPS systems: Why is a firewall alone not enough to protect your network?
- OT Network Security: Analysis, Differences from IT, Threats and Best Practices
- SD-WAN security: How to protect the wide area network in the era of cloud and remote working?
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
