Connecting plant equipment to business systems unlocks real value, but it also removes the old protection of isolation. Many industrial controllers were designed for reliability on closed networks, not for exposure to the wider internet. Network segmentation is the foundation that lets you gain connectivity without handing every office laptop a route to the production floor.

This article is general guidance. Requirements vary by industry, region and site, so involve qualified security and safety professionals and consult current standards and vendor documentation for your environment.

Why Segmentation Matters

Flat networks are convenient and dangerous. If office computers, cameras, contractor laptops and programmable controllers share one network, then a compromise anywhere can reach everything. Segmentation limits that blast radius, makes traffic easier to understand and gives you places to enforce rules and watch for anomalies.

Industrial security thinking often uses the idea of zones (groups of assets with similar security needs) and conduits (the controlled paths between zones). You do not need to master formal standards to benefit from the concept. Start by asking which assets must talk to which, and block the rest.

Step One: Know What You Have

You cannot segment what you cannot see. Build an inventory of devices on the plant network: controllers, drives, HMIs, engineering workstations, historians, gateways, cameras and anything wireless. For each, record its function, owner, location and the communications it genuinely needs. Passive network monitoring is often safer than active scanning on fragile industrial equipment, since some older devices react badly to probing. Check with the equipment vendor before scanning anything critical.

Step Two: Define Zones

A simple model might include:

• Enterprise zone: office systems and business applications.
• Demilitarised zone (DMZ): a buffer where data is exchanged between enterprise and plant.
• Supervisory zone: SCADA servers, historians and engineering workstations.
• Control zone: controllers and field devices for each line or cell.
• Safety systems: kept distinct and handled according to your safety specialists’ guidance.

IoT devices such as wireless sensors and gateways deserve their own zone, since they are often the newest, least-hardened additions.

Step Three: Control the Conduits

Traffic between zones should pass through a firewall or similar enforcement point, with rules that allow only what is needed. Prefer these principles:

• Default deny, then permit specific sources, destinations, ports and protocols.
• Keep data flowing outward where possible, such as pushing historian data to the DMZ, rather than allowing inbound connections to controllers.
• Avoid direct connections from the internet or office network into the control zone.
• Document every rule with an owner and a reason, and review them periodically.

The Checklist

Area	Check	Status
Inventory	All plant devices listed with owners	Open / Done
Zones	Assets grouped by function and risk	Open / Done
Boundaries	Firewall between each zone pair	Open / Done
Rules	Default deny with documented exceptions	Open / Done
Remote access	Single controlled, authenticated path	Open / Done
Accounts	Unique logins; no shared defaults	Open / Done
Updates	Patch process agreed with OT	Open / Done
Monitoring	Logs and alerts reviewed regularly	Open / Done
Backups	Controller configurations stored offline	Open / Done
Response	Incident plan includes plant operations	Open / Done

Handle Remote Access Carefully

Vendors and integrators often need remote access for support. Uncontrolled remote tools installed ad hoc are a frequent weak point. Provide one approved path, such as a managed gateway or jump host, require strong authentication including a second factor where feasible, log sessions, and grant access only for the time and systems needed. Disable accounts when contracts end.

Patching and Change Without Breaking Production

Unlike office IT, you cannot always patch immediately. Updates may require vendor validation, scheduled downtime or testing. Where patching is delayed, compensating controls, such as stricter segmentation and monitoring, matter more. Agree a joint process between IT and OT for assessing vulnerabilities, scheduling maintenance windows and recording exceptions. Treat that process as shared work rather than an IT directive.

Watch the Wireless and Removable Media

Wireless sensors, cellular gateways and temporary hotspots can quietly bypass your segmentation. Include them in your inventory and in review routines. Similarly, USB drives and service laptops moved between networks are classic ways for problems to cross boundaries. Define rules for scanning and controlling them.

A Hypothetical Example

Imagine a mid-sized plant that connected a historian to the corporate network by placing it on the office network and opening a path straight to the controllers. During a review, the team sketches the flows and realises the office needs only summarised production data. They create a DMZ, move the data collector there, let the controllers’ network push data outward to the collector, and block direct office-to-controller traffic. They also route vendor support through a single monitored access point. Nothing about the dashboards changes for managers, but the number of paths into the control zone shrinks dramatically.

Common Mistakes

• Segmenting on paper but leaving “temporary” rules open for years.
• Relying on a single perimeter and assuming everything inside is trusted.
• Ignoring IoT gateways and cameras that join the plant network.
• Forgetting to test failover and recovery, so a security change causes downtime.
• Making changes without OT involvement, risking production.

Frequently Asked Questions

Is air-gapping still a realistic goal? Complete isolation is rare once data must reach business systems. Controlled, minimal connectivity with strong monitoring is usually more practical.

Do I need separate physical networks for IT and OT? Not necessarily. Logical separation using VLANs and firewalls can work well, provided the design and configuration are sound. Higher-risk areas may justify physical separation.

Who should own the segmentation project? A joint team with IT security, OT engineering and operations. Either group alone tends to miss important constraints.

Can I scan the plant network for vulnerabilities? Carefully. Some industrial devices are sensitive to active scanning, so prefer passive monitoring and consult vendors before scanning critical equipment.

How often should rules be reviewed? Regularly, and after any significant change. Tie reviews to maintenance windows or a fixed schedule agreed by your team.

Next Step

Draw a one-page map of how data currently flows between your office network, plant servers and controllers. Mark every path that crosses a zone, then ask for each one whether it is needed, controlled and logged. That single exercise usually reveals your first three priorities.