Learn Automation with MINATA #77: OT Network Segmentation — Limit the Blast Radius, Keep It Maintainable

OT Network Segmentation: Limit the Blast Radius, Keep It Maintainable

Segmenting an OT network is not drawing a few extra VLANs to make the diagram look better. The purpose is to remove unnecessary paths, limit the impact when something goes wrong, and still leave the plant maintainable. A flat network where every device can see every other is a place where a small incident spreads across the whole factory.

Start from an inventory

You cannot segment what you do not know. Build an inventory: PLCs, HMIs, drives, switches, gateways, remote access points and servers, together with their protocols, ports, owners and the data flows between them. Only from that real picture of the traffic can sensible zones and conduits be defined.

Zones, conduits and "allow what is needed"

Divide the network into zones — groups of devices with the same role and trust level — and connect them through controlled conduits. Firewall rules should follow "allow what is needed" rather than opening widely and narrowing later. This zone-and-conduit approach is the spirit of industrial security guidance such as IEC 62443.

Separating IT and OT is not forbidding all data

Separating IT from OT does not mean no data may cross. SCADA, historians, MES, OPC UA and MQTT all need deliberate paths, through an intermediate point, with logging. What must be avoided is everything talking freely — or a vendor connecting remotely straight into the PLC subnet because it was convenient during commissioning.

A worked engineering situation

A plant separates machine cells, the control network and the monitoring network into distinct zones; data to the historian passes through an intermediate point with explicit rules. When a device inside one cell has a network problem, the effect stays inside that cell rather than spreading across the site. Vendor remote support arrives through a managed access point, not directly into the PLC subnet.

The zone and conduit architecture and the rules all follow the security risk assessment and the organisation's policy.

Common mistakes

Segmenting before there is an inventory and a traffic map.
A flat network where every device can see every other.
Firewall rules opened widely and narrowed later, instead of allowing what is needed.
Forbidding all IT and OT traffic instead of opening deliberate paths.
Letting a vendor connect remotely straight into the PLC subnet.

Segmentation checklist

[ ] An inventory of devices, protocols, ports, owners and data flows exists.
[ ] The network is divided into zones by role and trust, joined by conduits.
[ ] Firewall rules allow what is needed, and are logged.
[ ] IT and OT connections pass through a deliberate intermediate point.
[ ] Remote access never lands directly in the PLC subnet.

Deliberate segmentation both limits an incident and makes the plant easier to run. #78 goes into remote access for maintenance: supporting from a distance while keeping control and evidence.

Read more automation knowledge at MINATA: https://minatavn.com/en/blog/industrial-automation

Previous — #76: MQTT for industrial IIoT: https://minatavn.com/en/blog/automation-76-mqtt-industrial-iiot

Next — #78: Remote access for maintenance: https://minatavn.com/en/blog/automation-78-remote-access-maintenance

View all MINATA technical articles