One firewall is not segmentation

Suppose one computer on your plant floor picks something up tonight. It came in on a pen drive, or on a service engineer's laptop, or from an email somebody opened on the wrong machine. By morning, how many controllers could it reach?

In most plants the honest answer is all of them. That is not because nobody thought about security. It is because the work that was done built one wall, and everything behind that wall is still one open room.

Why one wall is no longer the answer#

In April, five US agencies, among them the national cyber agency, the FBI and the Department of Energy, published joint guidance on applying zero trust to operational technology. It is blunt about the wall: "Air gaps can be bridged, VLANs can be misconfigured, and overly permissive access rules can undermine intended isolation." It goes as far as telling buyers to avoid systems that "assume security through air-gapping or segmented architecture alone."

That is not an argument against walls. It is an argument against having only one. IEC 62443 has said the same thing for years in its own vocabulary: divide the system into zones by what is at stake, and control what passes between every pair of them, not only between the office and the plant.

What segmentation actually is#

A ship is divided into watertight compartments, so a breach floods one compartment and not the hull. Segmentation is the same idea for a plant network: dividing it so that a problem in one part cannot freely reach the others.

The confusion usually starts with the layered picture everyone learned from: sensors and drives at the bottom, then controllers, screens and SCADA, site operations, a buffer network, and business systems on top. That picture describes what each machine does. It says nothing about what happens if a group of machines is lost.

LAYERS RUN ACROSS. ZONES RUN DOWN.

A zone groups machines by consequence. The boiler house zone holds the boiler's screens, controllers and field devices together, because losing any of them stops the same thing. IEC 62443 uses the layered picture to describe how data moves, but it does not require you to build your network in its shape. (What the standard means by a zone, and the four most plants are missing, is its own piece: a conduit is not a cable.)

The wall most plants build#

When a plant says it has segmented, it usually means a firewall between the office and the plant. That wall is worth having, and nothing in this piece argues for taking it down. The trouble is what it does not cover.

THE WALL MOST PLANTS BUILD

A pen drive does not come through the firewall. Neither does the vendor's laptop, or the engineering PC that went home for the weekend. They arrive already inside, and NIST's guidance for industrial systems is direct about what happens next: isolating a network "does not mitigate risks associated with lateral movement within a network segment."

Micro-segmentation: rules inside the room#

If segmentation is where the walls go, micro-segmentation is deciding which machine may talk to which inside each room.

On a flat network every machine can reach every other. Eight machines give you 28 possible conversations, and a plant section that size usually needs far fewer: the HMI to its controllers, the engineering PC to the same controllers, the historian to the SCADA server, one controller reading the safety system's status. Every other conversation is a path nobody uses and anybody could.

THE SAME EIGHT MACHINES, TWICE

You cannot install security software on a controller, so in a plant this lives in the network: access lists on managed switches, an industrial firewall in front of a cell, and the built-in firewall on the Windows machines that run your screens and engineering tools.

The better industrial firewalls go a step further. They understand the plant's protocols, so they can tell a request to read a value from a request to load a new program. That lets the HMI read and write the setpoints it needs and nothing else.

SAME CONTROLLER, DIFFERENT PERMISSIONS

This is mainstream now. The same April guidance lists "enforcing specific read/write permissions for individual data points within PLCs" as a standard example. Program downloads are the case to care about, because they are what a recent US advisory described attackers using, with the vendor's own software: they didn't turn anything off.

Air-gapped plants: the threat is already inside#

Some plants are genuinely isolated, by policy or by law. It is tempting to think segmentation matters less there. It matters more, because with no front door every threat arrives already inside, on media or on a person. The work has three parts.

The kiosk. One controlled place where removable media is checked before it goes anywhere near a control system, with a record of what went in, when, and on whose authority.

One way out. If production data must leave, it leaves through a device that is physically unable to carry anything back. NIST describes these one-way gateways as hardware that "cannot be programmed to allow data to flow in both directions."

The rooms. Everything in the previous section, unchanged. A plant with no front door and no internal walls has handed the site to whoever carries in the next pen drive. (How isolation quietly dissolves over the years is a separate story: your air gap has a vendor login.)

Connected plants: never one hop#

A connected plant has a front door, so the rule is that nothing crosses it in one step. Office systems talk to a buffer network in the middle, the buffer talks to the plant, and nothing in the office reaches a controller directly. NIST says communication between the enterprise and plant operations is "required to go through services within the DMZ."

The stricter version goes further. Data leaving the plant goes out through a one-way gateway, and remote access is allowed only for troubleshooting and emergencies, with a named person approving each session. That last rule is the one most plants find hardest to live with, and it is where the list of who can reach what matters more than the tunnel (the tunnel was never the hard part).

TWO PERIMETERS, THE SAME ROOMS

What IEC 62443 adds#

The standard gathers all of this under one requirement, restricted data flow, and asks for more of it as the target security level rises: from separation in software, to a physically separate network that blocks by default, to one that keeps running with the office network gone and fails closed.

IEC 62443-3-3 · RESTRICTED DATA FLOW, BY TARGET LEVEL

What matters in practice is that the target is set per zone, not per plant. The safety system and the canteen printer should not be on the same step. Decide what each part of the plant is worth, and separate it accordingly.

The honest cost#

Every rule inside a room is something that can stop production if it is wrong. Machine builders often ship a skid with its own controller, its own switch and its own remote support, and do not expect anyone to put a firewall in front of it. Switching on the firewall of a twelve-year-old HMI can break things somebody depends on.

So the first step is watching, not blocking. Record what actually talks to what for long enough to catch the nightly jobs, then write rules from that. When I did it on my own estate, the textbook diagram had one direction backwards (why nobody actually segments the plant network).

A test for Monday#

Pick one engineering PC. Ask whoever runs your network to list every machine that PC can reach today, then write down the machines it actually needs. The difference between the two lists is your micro-segmentation work. Do the same for one controller that matters and you have the start of a zone.

It is also the list you will want in the first hour after something goes wrong, when the first question anybody asks is what else that machine could reach.