Why Network Segmentation Matters

Network segmentation is a cornerstone of OT cybersecurity. It involves dividing a network into isolated, secure zones—either physically or virtually—each acting as a self-contained subnetwork. This approach:

• Reduces risk
• Enhances control
• Prevents lateral movement in the event of a breach

The Cybersecurity and Infrastructure Security Agency (CISA) emphasizes the importance of segmentation and provides a clear, actionable framework for its implementation—especially for critical infrastructure environments.

Top 5 Benefits of Network Segmentation

1. Threat Containment: Compromised systems are confined within their segment, preventing wider disruption.
2. Smaller Attack Surface: Limiting inter-zone communication reduces paths for attackers to reach sensitive assets.
3. Protection of Critical Assets: High-value systems like DCSs, PLCs, HMIs, and control servers are isolated from less secure IT zones.
4. Improved Monitoring: Smaller zones allow for more precise anomaly detection and event tracking.
5. Compliance Enablement: Helps meet requirements in frameworks like ISA/IEC 62443, which mandate segmentation as a baseline control.

Key Components of an Effective Segmentation Strategy

1. Define and Group Zones

Organize assets by function and risk level. Typical OT zones include:

• Control Zone: PLCs, DCS, SCADA, most critical layer.
• Historian Zone: Operational data aggregation.
• MES Zone: Operational-to-enterprise handoff.
• Remote Access Zone: For secure third-party or vendor access.
• Enterprise IT Zone: Business apps and office systems.

2. Establish Secure Conduits Between Zones

• Strict Communication Rules: Permit only essential traffic between zones, with defined protocols and endpoints.
• Firewalls with ACLs: Use industrial firewalls and Access Control Lists to strictly manage inter-zone traffic.
• DMZ Deployment: A DMZ acts as a secure proxy zone between IT and OT, preventing direct access while enabling controlled data exchange.

3. Test, Monitor, and Maintain Continuously

• Validate Controls: Post-deployment testing ensures segmentation functions correctly without disrupting operations.
• Continuous Monitoring: Track traffic flows and flag deviations or unauthorized access attempts.
• Ongoing Review: Update policies as new assets or threats arise.

The Champion Advantage

Effective segmentation requires more than IT knowledge, it demands a deep understanding of industrial processes. That’s where Champion Technology Services excels.

We deliver segmentation strategies that:

• Protect operations without disrupting uptime
• Align with CISA guidance and industry specific standards
• Bridge IT security best practices with OT realities

We combine cybersecurity leadership with control system expertise to design and implement resilient, scalable, and compliant network architectures for critical infrastructure environments.

In today's increasingly connected operational environments, network segmentation is a foundational pillar for cybersecurity, performance, and system reliability. For industrial facilities managing legacy assets, segmentation isn't just an IT best practice, it's a business-critical strategy.

What is Network Segmentation?

Network segmentation involves dividing a network into smaller, isolated segments (or subnets), each with its own access controls and security measures. This approach:

• Minimizes the attack surface
• Restricts lateral movement by threat actors
• Prevents malware from spreading across the network

6 Key Strategies for Effective Segmentation

1. IT/OT Alignment

Ensure collaboration between IT and OT teams from the outset. Joint planning, training, and awareness initiatives build shared ownership and improve execution.

2. Identify Critical Assets

Prioritize protection by identifying which systems are most critical to operations. This enables a phased segmentation approach that minimizes disruption.

3. Network Mapping

Visualizing all connected entities reveals data flows, hidden vulnerabilities, and monitoring blind spots—essential for informed segmentation planning.

4. Define Network Zones

Group systems with similar security requirements into zones, and enforce strict rules for how data moves between them. This zoning model forms the backbone of OT segmentation.

5. Implementation

Roll out segmentation in phases to minimize operational risk. Closely monitor performance throughout the rollout to identify and resolve unforeseen issues early.

6. Monitor and Maintain

Ongoing monitoring and regular audits ensure the segmentation strategy adapts to evolving threats. Update protocols and configurations as your network grows or changes.

The Takeaway

As cyber threats grow more sophisticated, network segmentation is no longer optional—it’s foundational. By creating controlled, isolated zones within your OT network, you enhance system protection, simplify compliance, and future-proof your operations for digital transformation.

Anytime a new conduit to an ICS network is created – especially one which transits the internet – there is inevitable trepidation about the potential security risks it might create. So, when we talk about creating a tunnel from your network into the cloud, you’re going to have mental alarms going off. This article will describe how Champion keeps your network secure while providing unprecedented levels of service and support.

The Cloud Zone

A security zone is created in the cloud specifically for you. Here, it serves as an extension of the Demilitarized Zone (DMZ) of your control system. The same security concepts that apply to your DMZ apply here as well.

There are only two paths in and out of your cloud zone:

• The Tunnel, as defined below, to your on-premises DMZ.
• Dedicated secure route to our portal servers to enable the features provided by our managed service offering.

These paths are restricted by routing and firewall rules to pass only the authorized data.

No windows administrative connections (RDP, WMI, RPC, and other evil acronyms) can be made from outside the DMZ and cloud zones. All administrative activity happens within the cloud zone via hosted desktop sessions. These sessions are delivered using virtual desktop presentation technologies so that only the video stream leaves, and only keyboard and mouse commands enter. No proprietary data or external threats can be transferred via either cloud path.

The Tunnel

In order to connect your site to the cloud, a tunnel must be created. This tunnel is built using the best available VPN protocols. Like most tunnels, its job is to keep the good things in and the bad things out.

This includes:

• Ensuring that only your DMZ can connect to the cloud zone and only the cloud zone can connect to your DMZ.
• Encrypting the data so that it cannot be monitored by outside forces.
• Ensuring the data stays intact from one end to the other.

The Eyes

It’s often stated that if you can’t see it, you can’t secure it. To ensure your network stays safe, it’s vital to have eyes on the traffic that’s going through it. Like a building with door sensors, motion detectors, smoke detectors, security cameras, and a remote monitoring service, Champion can be your partner in notifying you in real-time of any abnormal activity.

• Intrusion Detection Systems (IDS) designed with OT networks in mind are deployed for your network. These are strictly passive systems that merely sound the alarm if a potential compromise is detected.
  IDS sensors are installed in strategic locations to passively monitor as much of the traffic on your network as possible.
• Firewalls guard all the border crossings of your network. Anyone without the right credentials cannot get through.
• End devices are protected with antivirus software. This blocks malware which makes it to a computer and sends out alerts.
• A Security Information and Event Management (SIEM) server collects real-time data from all these safeguards and more and presents them to Champion’s monitoring team.
• Should an event occur, we’ll notify you immediately. If you authorize it, we can also take action to mitigate any threat per your Incident Response Plan.

The Result

While opening a tunnel between your network and the cloud might sound scary, using the proper technology and partner allows your network and OT assets to be safer than ever. Not only will you be better protected from security threats, but now we can even alert you to process issues before they become big problems.

Remote support engineers can respond even quicker and without introducing you to unnecessary risks like VPN connections from untrusted computers, unmonitored persistent virtual desktop access, or cellular modems.

While everyone is familiar with the term “IT” (Information Technology), the term “OT” (Operational Technology) is far less familiar to the general public. That is not to say OT is newly emerging; quite the opposite. Over the last two decades, IT and OT have begun to converge. You’ve likely heard terms like “IIoT” (Industrial Internet of Things) or “Industry 4.0.” But there are unique differences that set OT apart from IT.

Production

While IT is extremely important at the corporate (or “Enterprise”) level, OT is the livelihood of any facility. The mission of any OT system is to achieve the greatest production output with the least amount of downtime possible.

Since production is the livelihood of any industrial facility, so too are the operational systems that keep them moving. Loss of production for any reason has a direct impact on a company’s bottom-line. Whether due to an outdated, unreliable platform, poor configuration, unprepared support staff, or insecure technology allowing for system breaches – many factors can affect production. Be sure to utilize an OT specialist with the experience to reach your maximum production output.

Safety

IT and OT must both be vigilant in mitigating security risks. However, IT’s risks generally lend themselves to trade secrets and corporate accountability. OT’s risks can be much more tangible: Unsafe operating conditions or monitoring can result in health and safety issues such as fatalities or environmental catastrophes.

In past years, many have taken the “air gap” approach to securing their OT control systems – keeping any production equipment separated from Internet-connected Enterprise equipment. In theory – and in a time before flash drives and smartphones – this was enough to mitigate operational risks. But, as consumer technologies emerged, so too did many large-scale security breaches affecting Industrial Control Systems.

Air gapped systems that were not physically connected to the Internet would run on outdated security patches because they were seemingly “secure.” With the advent of devices like flash drives and smartphones, however, control systems around the globe became vulnerable. Cyber-attacks could now halt production, disable critical safety systems, or result in catastrophic loss simply by altering production readings.

Having a team of Globally Certified Cybersecurity Experts at your fingertips is now vital for any industrial environment.

Skillset

While the fundamental principles of IT networks are shared with OT networks, Industrial Control Systems require a much more specialized set of skills to implement and maintain. For starters, the very environment of each are vastly different. IT networks are often climate-controlled office environments, whereas OT networks can be exposed to extreme elements and process environments.

More importantly, what sets OT professionals apart is their knowledge of how to implement specific industry processes, using a range of industrial controls across multiple platforms. Lastly, they must use this knowledge to make everything communicate in an efficient, reliable, and intuitive manner.

With vast experience across numerous industries, platforms, and technologies, Champion’s OT professionals deliver on this expertise.

Cost of Ownership

The natural lifecycle of IT versus OT lends itself to completely different budget approaches. While IT environments typically change every 12-18 months, OT environments can last 10-15 years or more – if they are properly designed and maintained. Therefore, planning for Total Cost of Ownership (TCO) takes not just different expertise but also a different approach and methodology to achieve a comprehensive cost.

The key to enabling Industrial Control Systems for extended durations is proper maintenance and support. In addition to cybersecurity risk mitigation, including budgetary funds for preventive maintenance and support is essential in any OT environment. As a system ages, it is key to provide regular security patches, scheduled backups, and a supply of spare parts to achieve the greatest production output.

Champion’s knowledge of these items, paired with our 24UP® Solutions, allow customers to tailor specific needs into one easily-predictable budgetary plan.

Compliance

Whether for the safety of workers, surrounding communities, or environment, compliance standards are often far more stringent on OT systems. Federal and state agencies regularly monitor and regulate industrial processes due to their inherent ability to impact the community at large.

Another unique difference between IT and OT is the types of compliance each must meet. Industrial Control processes are typically subject to far more scrutiny due to their ability to impact more than a corporate entity. If improperly maintained, a process can harm employees, communities, or the environment. For this reason, it is imperative that OT systems function correctly and reliably.

OT networks continuously monitor process stages, operating temperatures and pressures, environmental emissions, leaks, or any other number of factors associated with the facility. Reliable systems improve overall safety. They also allow companies to generate real-time or historical reports for compliance agencies like the EPA, DEQ, FDA, and OSHA.

Champion engineers and professionals hold the experience necessary to implement the reliable OT systems our customers demand.

Is an Air-Gap “Good Enough” to keep your Industrial Control System secure? Short answer: No. Here’s why…

“Security by isolation” or air-gapping previously worked in Operational Technology (OT) environments when OT and IT were completely isolated from one another. Many older systems based on PLC’s and SCADA were built without cybersecurity in mind. OT and IT are now converging as organizations embrace the digital transformation, and security experts are now declaring the air gap dead as security by isolation is not a long-term solution for protecting OT assets.

Air Gapping an OT system has very limited value in today’s constant technological advances. It can no longer be used as a sole security solution in the long term for three reasons:

• It causes organizations to miss out on valuable data.
• It is more costly and difficult for maintenance and repairs.
• It is more prone to security breaches than a “connected” OT system.

Missing out on Data

While air-gapped OT systems can minimize risks, organizations are not able to benefit from the highly valuable data these systems generate. Data analyzed in real time can provide business intelligence to cut costs, reduce downtime, and improve efficiency. These opportunity costs outweigh air-gapping as a viable cyber security measure.

Higher Maintenance Costs

Maintaining air-gapped OT systems are more expensive and difficult because the engineering tools of a connected system cannot be used to perform routine maintenance or troubleshoot problems. It also limits the system from secure remote support by technical experts. Without remote access, facilities experience higher support costs and increased downtime. The reality is that even a properly air-gapped system is not completely protected; Every system is a potential breach target, and even air-gapped systems can be infiltrated. Organizations must engage in active monitoring and security measures to mitigate the risks.

Reduced Security

Air Gaps can be physically breached by a third-party networked laptop, USB drive, removable media, smartphone, or other devices. Allowing OT systems to connect with these devices creates vulnerabilities that air gapping cannot protect against. Air gapping makes it difficult for users to move back and forth between the air-gapped device and network-connected devices. For ease of use, an individual may use an unsecure USB drive to transfer data which could compromise an air-gapped system.

OT infrastructure is only as secure as the user operating the devices. An openly accessible USB port can serve as an entry route for malware. Smartphones provide another convenient route to cross air gaps when switched to Wi-Fi hotspot mode. The Wi-Fi hotspots can also be used as an entry point by hackers or those with ill intentions.

90+% of randomly found USB drives are picked up by the casual person and more than half are plugged into a PC.
Source: Kapersky

Why your OT control systems can’t afford cybersecurity shortcuts:

OT cyber-attacks are more dangerous in nature. An OT attack can pose risks to operational and safety systems, employees, plant, and environment. Because the outcome of an OT cyber-attack is more catastrophic, it is essential that organizations prioritize cybersecurity. While air gapping provides some security, it is not the best option to select in the competitive marketplace.

Air gapped control systems are also more vulnerable because they don’t receive the latest Windows security patches easily, therefore are usually neglected. As new virus threats emerge, the OT system will likely be unprotected, unlike its Enterprise counterpart.

We must accept the fact that air gapping as a security control is no longer a valid option. IT and OT will continue to converge leaving air gapping to be useless. Facilities should take advantage of the opportunities from integrated technologies to reduce costs and downtime while improving efficiency. While doing so, they must prioritize OT security to lessen the risk and still capitalize on the advantages of a connected IT and OT world.