Network Segmentation for ICS Security: A Guide

Updated 4 November 2026 · Standard formula, shown below

Network segmentation limits the blast radius of a cyberattack on industrial control systems (ICS) by dividing the network into isolated zones, so a breach in one area doesn’t automatically spread to critical processes. This guide walks you through planning, implementing, and verifying segmentation, using firewalls, VLANs, and rules to protect your OT environment. You’ll need administrative access to your network infrastructure and a clear map of your current devices and data flows.

What You’ll Need

Network diagram or asset inventory (IP addresses, device types, protocols)
Administrative access to managed switches, routers, or firewalls
Understanding of your ICS protocols (e.g., Modbus, OPC UA, EtherNet/IP)
Change management approval (even for a pilot)
Optional: a spare switch or VLAN-capable test environment

Step-by-Step

Map your current network. Document every device: PLCs, HMIs, engineering workstations, historians, servers, and any IT equipment. Note which devices talk to which, and over what protocols. Use a spreadsheet or diagram tool.
Define security zones. Group devices by function and risk. Common zones: safety systems, control systems (PLCs/RTUs), HMI/engineering, historian/OT servers, and IT network. Also define a DMZ for any data exchange between IT and OT.
Identify necessary communication paths. For each pair of zones, list what traffic is required. For example, an HMI needs to read from PLCs, but a PLC should never initiate a connection to the IT network. Be specific: source, destination, port, protocol.
Design the segmentation architecture. Decide where to place firewalls or use VLANs with access control lists (ACLs). For small sites, a single firewall between IT and OT with internal VLANs may suffice. For larger sites, use multiple firewalls to separate zones.
Implement VLANs on switches. Assign each zone its own VLAN ID. Configure switch ports to assign devices to the correct VLAN. Ensure trunk ports carry only the needed VLANs between switches.
Deploy firewall rules. On your firewall(s), create rules that allow only the required traffic from step 3. Deny all other traffic by default. Use specific IP addresses and ports, not broad ranges.
Test in a pilot. Start with a non-critical zone or a test environment. Verify that devices can still perform their functions. Check that alarms and control actions work as expected.
Roll out incrementally. Move one zone at a time into the segmented architecture. After each move, monitor for communication failures or performance issues.
Document and maintain. Update your network diagram and firewall rule base. Establish a change review process for any new device or communication path.

Common Mistakes

Overly broad rules. Allowing any-to-any within a zone or using large subnets defeats the purpose. Be as specific as possible.
Forgetting management traffic. If your engineering workstation can’t reach a PLC, you might be tempted to open all ports. Instead, allow only the required management protocol (e.g., SSH, RDP) to specific IPs.
Ignoring broadcast traffic. Some ICS protocols rely on broadcasts. Segmentation can break device discovery. Plan for this by allowing broadcast within a zone, but not across zones.
Skipping the pilot. Implementing segmentation across a live plant without testing can cause production downtime.

Tips

Use a “default deny” philosophy: whitelist only what’s needed, not blacklist what’s known bad.
Consider using a separate VLAN for device management (e.g., PLC programming ports) to reduce exposure.
For legacy devices that can’t be updated, segmentation is your best defenseâ€”isolate them completely.
Monitor firewall logs regularly to spot anomalies and refine rules.
Coordinate with OT engineers; they know the operational requirements better than anyone.

Troubleshooting

Devices can’t communicate after segmentation. Check firewall rules for typos in IP addresses or ports. Verify VLAN assignments on switch ports. Use a packet capture (e.g., Wireshark) to see if traffic is being blocked.
HMIs lose connection to PLCs. Confirm that the HMI’s VLAN can route to the PLC’s VLAN. If using a firewall, ensure the rule allows the HMI’s IP to the PLC’s IP on the required protocol (e.g., Modbus TCP port 502).
Broadcast discovery stops working. Some protocols (like Ethernet/IP) use multicast. You may need to enable multicast filtering or configure IGMP snooping on your switches.
Performance degrades. Check if your firewall is inspecting traffic that should be allowed. Consider using a stateful firewall with high throughput, or move to a dedicated OT firewall.
Rollback plan. If a critical issue arises, have a documented rollback procedure to revert to the previous configuration quickly.

Frequently Asked Questions

What is the difference between a VLAN and a firewall?

A VLAN logically separates traffic at Layer 2, but devices in different VLANs can still communicate if there’s a router. A firewall filters traffic between VLANs or networks based on rules. Segmentation often uses both: VLANs to isolate, firewalls to control inter-VLAN traffic.

Can I segment my ICS without buying new hardware?

Yes, if your existing switches support VLANs and your router/firewall can enforce ACLs. Many enterprise switches do. For small sites, a single firewall with multiple interfaces can create zones without new switches.

How do I handle remote access for vendors?

Put vendor access in a separate VLAN with strict firewall rules. Use a VPN with two-factor authentication, and limit access to only the necessary devices and ports. Log all sessions.

Will segmentation affect my safety systems?

Potentially, if not done carefully. Safety systems (like Safety PLCs) often have specific timing and redundancy requirements. Test thoroughly and ensure safety communications are not delayed or blocked. Consider keeping safety systems in their own isolated zone.

How often should I review my segmentation rules?

At least annually, and whenever you add new devices or change processes. Regular reviews help remove stale rules and reduce attack surface.

What if my ICS devices are on the same flat network?

Start by creating VLANs and moving devices gradually. Even a basic separation between IT and OT is a huge improvement. Then refine zones as you go.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.