The OT network controls the physical equipment of the plant, such as PLCs, sensors, and production lines, while the IT network handles email and office navigation. Combining these networks means that an office issue, like a ransomware attack, could disrupt production. Segmentation should define specific areas and controlled communications. VLANs can be part of the design, but they do not, on their own, guarantee compliance with IEC 62443 or replace access controls.
“Everything is on the same network” is the phrase we hear most often before a diagnosis. It sounds harmless until a ransomware email reaches an administrative computer, and twenty minutes later, the production line stops because the controller managing it was on the same flat network as that computer.
What are OT and IT?
Information Technology (IT) is the network everyone recognizes – email, files, browsing, printers. Operational Technology (OT) is the network that controls physical processes: PLCs, sensors, variable frequency drives, SCADA systems, and process cameras. These are two distinct worlds, operating under different rules. An IT team can restart without a problem if a patch needs to be applied, but a PLC controlling a running production line cannot be restarted mid-production without being carefully planned in coordination with the operations team.
| Red IT | Red OT | |
|---|---|---|
| What’s driving it? | Email, files, navigation | PLC control, sensors, and variable frequency drives. |
| Tolerance for falls | It’s annoying, but it’s recovering. | You can stop the production. |
| Update rate | Regular updates | Planned changes, with defined windows. |
| Risk if it’s mixed with the other network. | Under. | Height: a single IT incident can bring an entire plant to a halt. |
The rule that supports separating them.
The distinction between OT (operational technology) and IT networks is not one we favor – it’s the approach outlined in the international IEC 62443 standard, which serves as the benchmark for cybersecurity in industrial automation and control systems. Its central recommendation is straightforward to explain, though not necessarily easy to implement: to define zones and pathways, ensuring that traffic between the office network and the control network passes through a controlled point, rather than a flat switch where everything can see everything.
How do you disconnect without duplicating the entire network?
The good news is that separating OT (other) from IT networks almost never requires running new cables from scratch. The typical approach:
- Inventory. Which equipment is used for control (PLCs, variable frequency drives, process cameras) and which is for office use, including the Wi-Fi for visitors.
- VLAN Separate virtual networks are configured on existing switching infrastructure, ensuring that traffic from each virtual environment remains isolated, even when using the same physical cable.
- Switching industrial in the areas where it’s needed. When the existing switch doesn’t support VLANs or is being used in an environment of dust and vibration for which it wasn’t intended, it should be replaced with an industrial-grade switch.
- A control point between the two networks. A firewall or a layer 3 switch that determines which traffic, if any, is allowed to pass between networks.
In a medium-sized facility, this work is completed in days, not weeks, and it almost always reuses a significant portion of the existing cabling and switching equipment.
The sign that it’s already too late to wait.
If today a visitor connects to the same Wi-Fi network as the control system, or if an administrative computer can ping a PLC without going through any firewall, the plant is already exposed. A sophisticated attack isn’t necessary; a well-crafted phishing email sent to the right computer is enough.
A typical case, without naming anyone.
The pattern repeats with variations across different plants: an administrator receives an email with an attached file, opens it because it looks like an invoice from a familiar vendor, and the team becomes compromised. If that team is on the same flat network as the control system, the malicious software can scan that network looking for additional devices to spread to, including those managing the production line. When the network is segmented, the same email remains an IT problem to resolve, but it doesn’t affect the plant itself. The difference between a disruptive incident and one that halts production often comes down to whether or not a barrier existed.
What to ask if you don’t know the condition of your plant.
Before assuming that the network is already properly segmented, it’s advisable to ask a couple of simple questions: Can a computer in the office connect directly, without going through anything, to a PLC or a SCADA system? Is the Wi-Fi for visitors on the same network as the control or camera equipment? Is there a firewall between the administration network and the plant network, or is the same switch used for everything? If the answer to any of these is “we don’t know” or “everything is together,” a site-based diagnostic is the most reasonable first step, before any network expansion project.
We reviewed the inventory and segmentation plan as part of the service… Ground-level networkswith the network diagram delivered at the end, so that it’s documented what differentiates what.
Technical precision and reference.
VLANs isolate network domains, but an OT design also needs to control authorized traffic between zones and plan changes based on operational needs. Not all switching needs to be industrial – the selection depends on the environment and site requirements. Please consult… NIST SP 800-82 Rev. 3 guide.
The original article is retained. Prices and commercial terms are valid as of the date of publication and require confirmation before entering into any agreement.
Frequently Asked Questions
What exactly is the OT network?
The network that connects the equipment controlling physical processes: PLCs, sensors, variable frequency drives, and control systems within a production line.
Does it really require rewiring everything to separate them?
Almost never. In most cases, it’s sufficient to simply configure VLANs on the existing switching equipment, or to replace only the switching with industrial-grade equipment, without needing to remove the existing cabling.
How does ransomware get from the office to the floor?
A compromised office team, if using the same flat network as a PLC or control server, can spread an attack without any barrier between the two environments.
Does this only apply to large plants?
No. This applies to any plant or task with at least one control unit connected to the same network as the office or guest WiFi.
