Network segmentation (IT/OT separation) in SCADA systems - Deep Dive

Overview - Network segmentation (IT/OT separation)

What is it?

Network segmentation is the practice of dividing a computer network into smaller parts to improve security and performance. In IT/OT separation, it means keeping the Information Technology (IT) systems separate from Operational Technology (OT) systems like SCADA. This helps protect critical industrial control systems from cyber threats that might come from regular business networks. It creates clear boundaries so problems in one area don’t spread to the other.

Why it matters

Without network segmentation, a cyberattack or malfunction in the IT network could easily reach and disrupt OT systems that control physical processes like power plants or factories. This could cause dangerous failures or shutdowns. Segmentation reduces risk by limiting access and exposure, making it much harder for attackers to move inside the network. It also helps organizations meet safety and compliance rules, protecting people and infrastructure.

Where it fits

Before learning network segmentation, you should understand basic networking concepts like IP addresses, firewalls, and VLANs. After mastering segmentation, you can explore advanced cybersecurity topics like intrusion detection, zero trust architecture, and industrial network monitoring. Network segmentation is a foundational step in securing complex environments that combine IT and OT.

Mental Model

Core Idea

Network segmentation creates safe zones by separating IT and OT networks to stop threats from spreading and protect critical systems.

Think of it like...

Imagine a large office building with separate locked rooms for sensitive equipment and general workspaces. Only authorized people can enter each room, so if a fire starts in one room, it doesn’t spread easily to others.

┌───────────────┐      ┌───────────────┐
│    IT Network │──────│    OT Network │
│ (Business PCs)│      │ (SCADA, PLCs) │
└──────┬────────┘      └──────┬────────┘
       │                       │
       │   Firewall / Gateway  │
       └───────────────────────┘

Build-Up - 7 Steps

1

Foundation

Basics of IT and OT Networks

Concept: Understand what IT and OT networks are and their different roles.

IT networks handle business tasks like email, databases, and internet access. OT networks control physical devices like machines, sensors, and industrial controllers. They have different priorities: IT focuses on data and users, OT focuses on safety and continuous operation.

Result

You can clearly identify which devices belong to IT and which belong to OT in a network.

Knowing the distinct purposes of IT and OT helps you see why mixing them without control is risky.

2

Foundation

What is Network Segmentation?

Concept: Learn the idea of splitting a network into parts to control traffic and access.

Network segmentation divides a large network into smaller segments using tools like VLANs, firewalls, or physical separation. Each segment can have its own rules about who can talk to whom. This limits the spread of problems and improves security.

Result

You understand how segmentation creates boundaries inside a network.

Segmentation is like building walls inside a house to stop a fire from spreading from one room to another.

3

Intermediate

Implementing IT/OT Separation

🤔Before reading on: do you think IT and OT networks should be completely isolated or partially connected? Commit to your answer.

Concept: Learn how to separate IT and OT networks while allowing controlled communication.

Complete isolation is often impractical because some data must flow between IT and OT. Instead, use firewalls and gateways to tightly control and monitor this traffic. Use VLANs or separate physical switches to keep networks apart. Only allow necessary protocols and devices to communicate.

Result

You can design a network where IT and OT are separated but still share essential information safely.

Understanding controlled connectivity prevents both total isolation problems and dangerous mixing.

4

Intermediate

Role of Firewalls and Gateways

🤔Before reading on: do you think a firewall just blocks all traffic or can it allow some traffic selectively? Commit to your answer.

Concept: Firewalls and gateways enforce rules between IT and OT segments to allow or block traffic.

Firewalls inspect network traffic and decide if it should pass based on rules like IP addresses, ports, and protocols. Gateways can translate protocols between IT and OT systems. Together, they act as gatekeepers to protect OT from unauthorized access.

Result

You know how to use firewalls and gateways to protect OT while enabling needed communication.

Knowing firewalls are flexible tools helps you design precise security controls instead of blunt blocks.

5

Advanced

Using VLANs for Logical Segmentation

🤔Before reading on: do you think VLANs require separate physical cables or can they share the same cable? Commit to your answer.

Concept: VLANs create separate network segments logically on the same physical hardware.

A VLAN tags network traffic to separate it logically, so devices on the same switch can be grouped into different segments. This reduces hardware costs and improves flexibility. VLANs help separate IT and OT traffic without needing separate cables or switches.

Result

You can configure VLANs to segment IT and OT networks efficiently.

Understanding VLANs lets you create secure zones without extra physical infrastructure.

6

Advanced

Monitoring and Managing Segmented Networks

🤔Before reading on: do you think segmentation alone stops all attacks or is monitoring still needed? Commit to your answer.

Concept: Segmentation must be combined with monitoring to detect and respond to threats.

Use network monitoring tools to watch traffic between IT and OT segments. Look for unusual patterns or unauthorized access attempts. Regularly update firewall rules and audit segmentation effectiveness. This keeps the network secure over time.

Result

You understand that segmentation is part of a bigger security strategy including monitoring.

Knowing segmentation is not a set-and-forget solution helps maintain long-term security.

7

Expert

Challenges and Pitfalls in IT/OT Segmentation

🤔Before reading on: do you think segmentation can cause operational delays or complexity? Commit to your answer.

Concept: Explore real-world difficulties like latency, complexity, and legacy systems in segmentation.

Segmentation can introduce delays in communication critical for OT timing. Legacy OT devices may not support modern security protocols, making segmentation tricky. Overly strict rules can block needed traffic, causing downtime. Balancing security and availability requires deep understanding and testing.

Result

You appreciate the trade-offs and complexities in deploying segmentation in production.

Recognizing these challenges prepares you to design practical, resilient segmentation strategies.

Under the Hood

Network segmentation works by tagging, filtering, and routing network packets to control which devices can communicate. VLANs add tags to packets to separate traffic logically. Firewalls inspect packet headers and payloads to enforce rules. Gateways translate protocols and mediate communication. Together, these mechanisms create isolated zones that limit broadcast domains and reduce attack surfaces.

Why designed this way?

Segmentation was designed to reduce risk by limiting network exposure and controlling access. Early networks were flat and vulnerable to attacks spreading everywhere. Segmentation evolved to provide defense in depth, allowing organizations to protect critical OT systems while still enabling necessary IT functions. Alternatives like complete physical separation were costly and inflexible, so logical segmentation became the practical choice.

┌───────────────┐      ┌───────────────┐
│ IT Devices    │      │ OT Devices    │
│ (PCs, Servers)│      │ (PLCs, SCADA) │
└──────┬────────┘      └──────┬────────┘
       │                       │
       │ VLAN Tagging           │
       │                       │
┌──────▼────────┐      ┌──────▼────────┐
│ Switch with   │      │ Switch with   │
│ VLAN Support  │      │ VLAN Support  │
└──────┬────────┘      └──────┬────────┘
       │                       │
       │ Firewall / Gateway    │
       └────────────┬──────────┘
                    │
             Network Backbone

Myth Busters - 4 Common Misconceptions

Quick: Does network segmentation mean IT and OT networks never communicate? Commit to yes or no.

Common Belief: Network segmentation means IT and OT networks are completely isolated with no communication.

Reality: Segmentation allows controlled, monitored communication between IT and OT where necessary.

Why it matters: Believing in total isolation can lead to impractical designs that block essential data flow, causing operational failures.

Quick: Do you think VLANs require separate physical cables? Commit to yes or no.

Common Belief: VLANs need separate physical cables or switches for each segment.

Reality: VLANs logically separate traffic over the same physical cables using tagging.

Why it matters: Misunderstanding VLANs leads to unnecessary hardware costs and complexity.

Quick: Does segmentation alone guarantee network security? Commit to yes or no.

Common Belief: Once segmented, the network is fully secure and needs no further monitoring.

Reality: Segmentation reduces risk but must be combined with monitoring and updates to remain effective.

Why it matters: Ignoring monitoring can let attackers exploit segmentation gaps unnoticed.

Quick: Can legacy OT devices easily support modern segmentation and firewall rules? Commit to yes or no.

Common Belief: All OT devices can be easily segmented and secured with modern tools.

Reality: Many legacy OT devices lack support for modern protocols, complicating segmentation.

Why it matters: Assuming easy segmentation can cause deployment failures and security gaps.

Expert Zone

1

Segmentation rules must balance security with OT system timing and availability requirements to avoid disrupting critical processes.

2

Deep packet inspection in firewalls can introduce latency, so rule complexity must be optimized for OT performance.

3

Segmentation strategies often require custom solutions for legacy OT protocols that do not fit standard IT security models.

When NOT to use

Network segmentation is less effective if OT devices cannot support necessary protocols or if real-time communication latency is unacceptable. In such cases, physical air-gapping or specialized industrial security appliances may be better alternatives.

Production Patterns

In production, IT/OT segmentation often uses layered firewalls with strict whitelist rules, VLANs for logical separation, and dedicated monitoring tools that understand industrial protocols. Segmentation is combined with role-based access control and network anomaly detection to protect critical infrastructure.

Connections

Zero Trust Security

Builds-on

Network segmentation is a foundational step toward zero trust, which assumes no implicit trust inside the network and requires strict access controls everywhere.

Industrial Control Systems (ICS) Security

Same domain, complementary

Understanding segmentation helps protect ICS by isolating control networks from IT threats, a key part of ICS security strategies.

Biological Cell Membranes

Analogous concept from biology

Just like cell membranes control what enters and leaves a cell to protect it, network segmentation controls data flow to protect critical systems.

Common Pitfalls

#1 Allowing unrestricted traffic between IT and OT networks.

Wrong approach:

Firewall rule: allow all traffic from IT subnet to OT subnet.

Correct approach:

Firewall rule: allow only specific protocols and IP addresses from IT to OT as needed.

Root cause:

Misunderstanding that segmentation means total separation rather than controlled access.

#2 Configuring VLANs without proper tagging leading to traffic leaks.

Wrong approach:

Switch ports configured as access ports without VLAN tags for OT devices.

Correct approach:

Switch ports configured as trunk or access ports with correct VLAN tags for OT devices.

Root cause:

Lack of knowledge about VLAN tagging and switch port configuration.

#3 Ignoring monitoring after segmentation deployment.

Wrong approach:

Set segmentation once and never review firewall logs or network traffic.

Correct approach:

Regularly monitor and update firewall rules and analyze network traffic for anomalies.

Root cause:

Belief that segmentation alone is sufficient for security.

Key Takeaways

Network segmentation divides IT and OT networks to protect critical industrial systems from cyber threats.

Segmentation uses tools like VLANs, firewalls, and gateways to create controlled boundaries and limit access.

Effective IT/OT separation balances security with operational needs, allowing necessary communication while blocking risks.

Segmentation is not a one-time fix; continuous monitoring and updates are essential to maintain security.

Understanding the challenges of legacy devices and performance impacts is key to designing practical segmentation.