Network segmentation breaks apart a flat network into different logical sections. The benefit is that these sections harden the network and prevent breaches from spreading beyond that segment. Network segmentation is accomplished using VLANs, firewalls, subnets, and other tools available in a managed switch network. Network segmentation is almost always recommended after a cyber security audit. If you’re interested in learning more about network segmentation solutions, check out Cisco, Hirschmann, and most traditional switch vendors.
Deployment Effort | Risk Reduction | Deployment Cost | Business Value | Best For |
High | Moderate | $$$ | Moderate | Everyone |
Benefits
- Hardened Attack Surface: By creating virtual or physical walls within the network an initial breach becomes more difficult.
- Threat Containment: If a breach occurs, it is much more difficult for that intruder to spread beyond the edge of the segment into other parts of the network.
- Network Performance: By walling off segments of the network, organizations can prevent extraneous communications or poorly designed and configured end points from creating network congestion in unrelated parts of the network.
- Access Control: Segmenting the OT network can simplify management of internal and external access to the network.
- Improved Monitoring and Threat Detection: Segmentation allows for more points of network monitoring and therefore quicker threat detection.
Challenges
- Cost: Network reconfiguration will be necessary which will require planning, rewiring, and sometimes significant effort to implement.
- Continuing Engineering: As the network evolves or downtime events occur in production, sometimes those events are solved with short cuts which will cause the network segmentation to degrade. Periodic audits and updates will be required to maintain the integrity.
Want to learn more? Check out our OT Defense in Depth Cyber Security Buyer’s Guide.
