Segmentation protects process zones
Grouping equipment by the process it serves, and controlling what crosses between groups, limits how far a problem travels through a plant.
It also aligns with how operations already thinks, in areas and lines rather than in subnets, which makes the conversation considerably easier. Zones drawn around the process tend to survive; zones drawn around the network topology tend to be violated within a year.
More on OT and ICS
- A cyber command can have physical consequencesThe keystroke has a lever on the end
- Legacy does not mean unnecessaryOld, and holding the whole line
- Patching OT requires process contextThe patch waits for the plant
- Remote maintenance changes the plant perimeterThe fence now goes round their kitchen table
- Process anomalies can be security signalsThe plant noticed first
- Asset discovery must not disrupt fragile systemsListen to it, do not knock on it