How do I segment IT and OT with VLANs and access lists?

Use VLANs to separate the networks and a firewall, not only switch access lists, to control what crosses between them. Put production controllers, HMIs and SCADA servers in their own VLANs, place a firewall between them and the office network, and add a small DMZ for the systems both sides need, such as a historian copy or a remote-access gateway. Write the rules as an allow list: which office host may reach which OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. host, on which port, and nothing else; deny and log the rest. Switch access lists are useful for simple separation inside OT, but they keep no connection state and are easy to get wrong at scale. Plan the change with the OT engineer and a maintenance window, because a missed dependency can stop a line. Then watch the boundary: from the Pro plan, NetSenX flags traffic that crosses levels of the plant network, from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port, without probing any OT device.

← All 45 questions on Zero trust, identity and segmentationAll topics