OT network segmentation is the practice of dividing an industrial network into smaller, controlled groups so that traffic between them must pass through a policy point. The goal is simple to state and hard to do well: an event in one part of the plant should not become an event everywhere. Segmentation limits how far an attacker, a misconfigured device or a piece of malware can move once it is inside.
Microsegmentation takes the same idea further down. Instead of stopping at broad network zones, it controls traffic between individual assets or small functional groups, including east-west traffic that never leaves a zone. This article is about the practical work: how VLANs, firewalls, zone-and-conduit enforcement and deny-by-default policy fit together, where they fall short, and where one-way transfer reduces exposure that segmentation alone cannot.
01Key takeaways
- 01
Segmentation divides an OT network into controlled groups so that traffic between them is forced through an enforcement point you can inspect, log and deny.
- 02
Microsegmentation extends control to east-west traffic between assets inside a zone, which is exactly where lateral movement happens after an initial foothold.
- 03
A VLAN is a segmentation building block, not a security boundary on its own; without a policy point between VLANs, separation is logical only.
- 04
Deny-by-default is the operating principle that makes segmentation real: define the few flows production needs, permit those, and block the rest.
- 05
For publication-only boundaries, such as exporting telemetry or backups, one-way transfer removes the return path that segmentation policy can only restrict.
02What OT network segmentation actually means
OT network segmentation is the practice of splitting an industrial network into separate groups and forcing the traffic between those groups through a control point. That control point is usually a firewall, a layer-3 switch with access control, or a gateway. The point is enforcement: if two groups can only reach each other through a device that applies policy, you can decide what is allowed and prove what crossed.
Without segmentation, a control network behaves like one large broadcast domain where any device can talk to any other device. That is convenient for engineering and disastrous for containment. A single compromised workstation, a vulnerable HMI or a worm that scans for open ports can reach the entire estate because nothing stands between assets.
Short version: segmentation is about where traffic is forced to stop and be checked. If two systems can reach each other without passing a policy point, they are not segmented from each other, regardless of how the network diagram is drawn.
03Macrosegmentation vs microsegmentation
Most OT programs start with macrosegmentation: large zones such as the enterprise network, an industrial DMZ, the supervisory level and the control level. These coarse boundaries map naturally onto reference architectures and are the first thing an assessor looks for. They are necessary, but they leave large flat spaces inside each zone.
Microsegmentation controls traffic inside those zones. It restricts which PLCs can talk to which HMIs, which engineering workstations can reach which controllers, and which assets may speak which protocols. This is the traffic that moves east-west, peer to peer, and it is the traffic attackers rely on after they gain an initial foothold. Coarse zones do nothing to stop a compromised HMI from reaching a controller that sits beside it on the same subnet.
- Macrosegmentation
- Separation between large zones such as IT, the industrial DMZ, supervisory systems and control systems. Stops north-south crossing between trust levels.
- Microsegmentation
- Separation between individual assets or small functional cells inside a zone. Stops east-west lateral movement that never crosses a zone boundary.
- East-west traffic
- Communication between peers at the same level, such as HMI to PLC or PLC to PLC, rather than up and down between trust levels.
04Why segmentation matters: lateral movement and blast radius
Most damaging OT incidents involve movement after the first compromise. An attacker rarely lands directly on a safety controller. They land on an exposed jump host, a phished engineering laptop or an internet-facing service, and then move sideways toward systems that matter. Segmentation is the control that decides how far that movement can go.
MITRE ATT&CK for ICS catalogues this behavior directly. Techniques such as Lateral Tool Transfer, exploitation of remote services and the use of valid accounts depend on reachable paths between assets. If a compromised HMI cannot open a session to a controller because a policy point denies it, several of those techniques simply fail at the network layer.
The other reason is blast radius. Ransomware that hit IT networks has repeatedly spilled into OT because the two were flat to each other. The 2021 Colonial Pipeline shutdown was a business-side decision to halt operations partly because operators could not be confident the malware had not crossed. Strong segmentation turns a plant-wide event into a contained one and makes that confidence defensible.
05How segmentation is enforced: VLANs, firewalls and gateways
Segmentation is enforced by a stack of mechanisms, and confusing them is a common mistake. A VLAN separates broadcast domains at layer 2. It is a useful building block, but two VLANs on the same switch provide no security boundary until traffic between them is routed through a device that applies policy. VLANs organize the network; they do not, by themselves, enforce who may talk to whom.
The enforcement happens at layer 3 and above. An OT-aware firewall between zones can permit specific source and destination pairs, inspect industrial protocols such as Modbus/TCP, EtherNet/IP, OPC UA and DNP3, and log every session. Inside a zone, microsegmentation can be enforced by host-based policy, switch access control lists, private VLANs, or identity-aware gateways that gate traffic per asset rather than per subnet.
- Layer 2 (VLANs, private VLANs): separate broadcast domains and isolate ports, but require a policy point between them to be meaningful.
- Layer 3 (routed ACLs, OT firewalls): permit or deny by address, port and direction between zones and conduits.
- Application layer (protocol-aware firewalls, deep packet inspection): allow only valid industrial protocol functions, such as read-only Modbus where writes are not needed.
- Host and identity layer (microsegmentation agents, NAC): gate east-west traffic per asset or per workload, independent of physical topology.
06Deny-by-default: the principle that makes it real
Segmentation only delivers value if the default answer is no. A deny-by-default posture means the firewall or gateway blocks everything that is not explicitly permitted. You then enumerate the small set of flows production genuinely needs, write rules for exactly those, and leave the rest denied. This is the opposite of the permissive default that flat OT networks grew up with.
The practical advantage of deny-by-default in OT is that legitimate flows are surprisingly few and stable. A controller talks to a known HMI on a known protocol; a historian polls known sources; an engineering station reaches its assigned PLCs during maintenance. Once those are baselined, anything else, such as a workstation suddenly scanning the control subnet, is both denied and visible as an anomaly.
A useful test of any segmentation design: if you cannot list the exact flows a zone is allowed to send and receive, the zone is not segmented, it is merely labeled. Enforcement is the allow-list you can produce on demand, not the diagram on the wall.
07Mapping to zones, conduits and the standards
Segmentation is the engineering practice; the standards give it structure and language. ISA/IEC 62443 frames an industrial network as zones (groups of assets with shared security requirements) connected by conduits (the controlled communication paths between them). Microsegmentation is, in effect, defining smaller zones and tighter conduits. The standard expects each conduit to have a defined purpose and a target security level.
NIST SP 800-82 Rev. 3 recommends network segmentation and isolation as a core OT control and points to defense in depth rather than a single perimeter. CISA's cross-sector guidance and ICS defense-in-depth material make the same case: segment by function and consequence, then control the conduits. None of these documents treat a VLAN tag as a boundary; they treat the enforced conduit as the boundary.
- Zone
- A grouping of assets that share security requirements and a trust level. Segmentation creates zones; microsegmentation creates smaller ones.
- Conduit
- The controlled path between zones. Every permitted flow rides a conduit with a defined purpose, direction and protection level.
- Security level
- The 62443 target capability for a zone or conduit, used to decide how strong the enforcing control must be.
08A practical sequence for segmenting an OT network
Segmentation projects fail when they start with hardware purchases instead of knowledge. You cannot write deny-by-default rules for traffic you have not observed. The reliable sequence is to learn the network first, then enforce in stages, validating production behavior at each step before tightening further.
- Build an asset inventory and map actual communications passively, so you know what talks to what before changing anything.
- Group assets into zones by function and consequence, not by physical location or by what happens to share a switch today.
- Define conduits: for each pair of zones that must communicate, list the exact protocols, ports and direction required.
- Enforce macrosegmentation first with OT-aware firewalls between zones, in monitor mode before deny mode.
- Introduce microsegmentation inside the highest-consequence zones, restricting east-west traffic between cells and individual assets.
- Move to deny-by-default once flows are baselined, and keep an exception process with expiry dates so temporary rules do not become permanent.
Throughout, treat monitor mode as a gift, not a delay. Running new rules in alert-only mode surfaces the undocumented flows every brownfield plant has, and lets you fix them before they cause an outage. Cutting straight to enforcement is the fastest way to lose operations' trust in the whole program.
09Common pitfalls and how segmentation quietly erodes
Most segmentation does not fail at design time. It erodes over years of operational pressure, where each individual exception seems reasonable and the cumulative effect is a flat network wearing a segmented diagram. Knowing the failure patterns helps you design against them.
- Treating VLANs as a boundary, with no policy device actually routing and filtering between them.
- Any-any or overly broad rules added during commissioning that are never tightened once production stabilizes.
- Permanent vendor or remote-access exceptions that were opened for one maintenance window and never closed.
- Dual-homed engineering workstations or jump hosts that bridge two zones and quietly defeat the boundary.
- Forgotten management, syslog or backup connections that reintroduce reachability the segmentation was meant to remove.
- Microsegmentation rules that are never reviewed, so a decommissioned asset's permissions live on as an attack path.
The defense is governance, not just technology: every rule has an owner and a purpose, exceptions carry expiry dates, and the rule base is reviewed against the asset inventory on a schedule. A segmentation design without a maintenance discipline reverts to flat within a few years.
10Where one-way transfer and exposure reduction fit
Firewalls and microsegmentation restrict reachability by policy, and that is the right tool for boundaries that need controlled two-way exchange. But some conduits only ever need to carry data outward: telemetry to a historian replica, logs to a SOC, backups to a recovery site, production figures to enterprise reporting. For those, policy can restrict the return path, but the path still physically exists and depends on configuration staying correct.
A data diode changes that. It enforces one-way data flow in hardware, so the destination has no route back into the protected zone through that conduit. In segmentation terms, it is the strongest possible conduit for a publication-only flow: there is nothing to misconfigure into bidirectionality, and rule creep cannot reopen the return path. It is one control among many, not a replacement for segmentation, but it removes a class of risk that firewalls can only manage. Teams comparing options often evaluate a controlled one-way connectivity pattern alongside firewall conduits and microsegmentation.
Decision rule for a conduit: if the flow needs a conversation, use a firewall conduit and microsegment around it. If the flow only needs to publish, evaluate one-way transfer so the return path does not exist to be exploited.
11A roadmap, not a project
Segmentation is rarely finished. The asset base changes, new conduits are requested, and last year's deny-by-default rule base drifts under operational pressure. The organizations that keep their networks segmented treat it as an ongoing capability with owners, reviews and metrics, not a one-time installation that gets signed off and forgotten.
Start where consequence is highest and reachability is widest, usually the boundary between IT and OT and the most critical control cells. Get macrosegmentation enforced and deny-by-default running there first, then push microsegmentation inward and one-way transfer onto the publication-only conduits. Measure progress by how short and explainable your allow-lists are, and how quickly you can answer the question every regulator and incident responder eventually asks: what, exactly, can talk to this asset?
FAQFrequently asked questions
What is OT network segmentation?
OT network segmentation is the practice of dividing an industrial network into separate groups and forcing the traffic between them through an enforcement point such as a firewall or gateway. This lets you control which systems can communicate, contain incidents to one area, and prove what crossed each boundary.
What is the difference between segmentation and microsegmentation in OT?
Macrosegmentation separates large zones, such as IT, the industrial DMZ and the control level, and stops north-south crossing between trust levels. Microsegmentation controls east-west traffic between individual assets inside a zone, such as which HMI may talk to which PLC, which is where lateral movement happens after an initial compromise.
Is a VLAN enough to segment an OT network?
No. A VLAN separates broadcast domains at layer 2 but is not a security boundary on its own. Two VLANs on the same switch provide no enforcement until traffic between them is routed through a device that applies policy. VLANs are a building block; the firewall, ACL or gateway between them does the actual segmentation.
What does deny-by-default mean in OT segmentation?
Deny-by-default means the enforcement point blocks all traffic that is not explicitly permitted. You enumerate the small set of flows production genuinely needs, write rules for exactly those, and leave everything else denied. In OT this is practical because legitimate flows are few and stable, so anything unexpected is both blocked and visible as an anomaly.
Where do data diodes fit in a segmentation design?
Data diodes fit on publication-only conduits, where a zone only needs to send data outward, such as telemetry, logs or backups. A firewall can restrict the return path by policy, but a data diode removes it in hardware so it cannot be misconfigured open. It is the strongest conduit for one-way flows and complements, rather than replaces, firewalls and microsegmentation.
SRCSources of record
From zones on a diagram to enforced conduits
Segment the network, then close the paths that should never return.
Once your zones and conduits are mapped, decide which boundaries need a controlled conversation and which only need to publish. For publication-only conduits, one-way transfer removes the return path that firewall policy can only restrict.