Zero Trust Segmentation for OT Solution Brief

Simple and NonDisruptive Segmentation
for Zero Trust in OT
Safely Secure OT Networks with
Advanced Risk Management andDynamic Segmentation“IoT and networkenabled device
technologies haveintroduced potential
compromise ofnetworks andenterprises... Security
teams must isolate,secure and control
every device on thenetwork, continuously.”— Mitigating Ransomware With
Zero Trust, Forrester Research,
June 8, 2020

Traditional approaches for securing operational technology (OT)
assets have long depended on maintaining the strict separation ofindustrial applications from IT business networks and external services.
However, the digital transformation of industrial control systems(ICSs) has introduced remote access, cloud-based services, smart
working and hybrid environments where IT, IoT and OT technologies
work together to improve efficiency and increase profitability. Add
the rise of sophisticated, targeted attacks on industrial infrastructure
and converged networks and it’s clear: traditional zoning strategies
are no longer sufficient to keep OT/ICS environments secure.

Challenges in OT/ICS environments include:▶ Increasing interdependency and interconnectivity between IT, IoT andOT systems, often distributed across multiple geographic locations▶

Lack of basic authentication methods in controllers or otherfield devices▶

Inability to detect and mitigate lateral movement of malware andmalicious actors, inter-zone threats crossing over from IT, andremote users impacting cyber-physical and OT infrastructure▶

Heterogeneous device and vendor landscape withinconsistent policy controls across OT environments

When applied in a way that meets the specific needs of OT/ICS,
segmentation can improve an organization’s security posture against
an ever-evolving threat landscape and improve operational efficiency.

Why we need segmentation for OT/ICS
ICSs are complex, multi-vendor environments, often with geographically
distributed resources and management systems. Each system has its own
proprietary protocols and industrial applications, security requirements,and specific risk mitigation policies. OT operators and security team haveto manage an increasing number of remote connections and transient
assets – OT/ICS and SCADA engineers, system integrators or OEM vendors

1Zero Trust Segmentation for OT Solution Brief

all connect to the OT networks, both locally and remotely, to support
management and maintenance functions.

Instead of patching,insecure-by-design
OT devices must
often be segmented
from other parts ofthe network andmonitored to detect
unwanted changes

No wonder the classic IT approach doesn’t work in OT/ICS environments.
Most SCADA systems or controllers do not support authentication
mechanisms, and traditional routers and firewalls cannot enforce
security policies based on the content of network traffic (e.g.,
dangerous commands or unexpected process values). Nor is it enoughto depend on security at the edge of the network. More protection
is needed inside the network, where different OT and IoT assets
and systems must communicate with each other and often rely on
connections to other industrial subsystems to run the process.
While we all agree that zero trust network segmentation is afundamental part of any cybersecurity framework, it remains
very difficult to implement in an ICS environment because of thespecialized expertise required – regarding OT and IoT device types,
their roles in the control system, their security and operational risk,
and their interconnectivity and interdependencies. Both your vendor
and in-house team need this understanding to make informed
decisions about how to segment and build zero trust policies
without impacting industrial processes and causing downtime.

Risk management and zero trust
segmentation for IT-OT networks
The Forescout Platform helps you manage cybersecurity and operationalrisk and optimize mitigation while laying the foundation for zero trust
segmentation across all cyber assets. With Forescout, you can:▶

Accelerate zero trust segmentation across IT and OT groups using
device profiling and control system baselines to draw granular policies▶

Gain an instant understanding of IT-OT segmentation state inreal time on any device, anywhere in the extended environment▶

Visualize traffic flows based on logical taxonomy of users,
applications, services, functions, locations, devices and risk level▶

Reduce the attack surface and maintain compliance throughdynamic segmentation across IT, IoT and OT networks▶

Optimize IT-OT workflows and leverage existing investments witha consistent segmentation policy across the entire enterprise▶

Reduce compliance risk and cost by efficiently managing
inter-network access, requiring fewer hands on deck▶

Detect, isolate or block insecure and unwanted network
traffic, unauthorized access and non-compliant devices

2

Zero Trust Segmentation for OT Solution Brief

The Forescout Platform provides in-depth device
visibility for OT networks and enables effective, real-time
management of a full range of operational and cyber risks.
The solution addresses your cross-domain, multi-usecase segmentation, and risk-mitigation challenges acrossyour digital terrain, including OT and IoT environments, toaccelerate nondisruptive threat detection and response.
The platform helps you design and deploy zerotrust segmentation by automatically mapping traffic
flows to a logical taxonomy of users, applications,services, functions, locations, devices and risk
levels across the entire enterprise network.

Forescout protects critical infrastructure with patented
anomaly detection and deep packet inspection (DPI)
and a vast library of ICS-specific threat indicators. The
platform monitors network communications in real timeand provides rich contextual information about connectedassets, protocols and content of communications.
With powerful functions such as Advanced Alert Aggregation
and Asset Baselining, you can automate threat-detection
and compliance tasks that reduce risk and support OT
segmentation enforcement. For example, you may needto activate temporary segmentation policies to isolate
vulnerable assets and contain detected malware threats.

You’re able to baseline OT and IoT traffic in real time
without deploying agents or re-architecting infrastructure.
Most importantly, you’re able to model the impactof segmentation policies before enforcing them.

Figure 1. The Forescout segmentation matrix allows you to focus on what is important to you so that you can analyze and investigate a particular traffic pattern in your environment.
No matter where you are in the matrix hierarchy, you can instantly create desired policies to segment a specific traffic pattern to protect your business while ensuring production andbusiness continuity.

3

Zero Trust Segmentation for OT Solution Brief

Forescout’s dynamic network segmentation solution addresses a widearray of use cases for OT and IoT. In every case, the platform’s flexibility
helps to reduce the risk of business disruption and minimize operating
costs related to segmentation projects. Below are a few key use cases:

DATA CENTER

SCCM

DVR

STORAGE▶

Segmenting IT and IoT networks from OT networks
as well as segmenting unpatchable assets▶

Simulating changes to OT segmentation policies andvisualizing the implact on traffic flows so you can finetune policies without causing disruption

CLOUD/IaaS

BUSINESS CRITICAL‘PRODUCTION’REVENUE
GENERATINGSYSTEMSPROTECTED DATA

eyeSegmentAD
SERVERAPPLICATIONSFILESERVER

EAST-WESTADMINISTRATORACCESSBYOD

CAMPUS / CORPORATE NETWORKIOTNETWORKBUILDING
DEVICES MANAGEMENT MANAGEMENTSYSTEM

ENGINEERINGWORKSTATIONDCS / SCADASERVER

PLC / RTU

PLC / RTU

PLC / RTU

EAST-WEST

HMI

PLC /RTU

eyeInspect

EAST-WEST

SITE NCAMERA

HMIN-S

ACTIVE
DIRECTORY /LDAPPROTECTED DATAOT AND ICSCOMMANDCENTER

SITE 2ENTERPRISE
COMMANDCENTER

STORAGEPRIVILEGED ADMINSNORTH - SOUTH

CORPORATEDEVICESWORKLOADS‘PRODUCTION’REVENUE
GENERATINGSYSTEMSEAST-WEST

SITE 1REMOTE USERS

BUSINESS CRITICAL

INTERNET

N-S

SIEM

Monitoring and assessing the security posture of a vendor orcontractor accessing the OT network, remotely or while on-site,and granting access only to the required network segments

N-SADFILESERVER SERVER▶

HMI

eyeInspect ACTIVESENSOR (OPTIONAL)

eyeInspect
PASSIVE SENSOR

PLC /RTU

eyeInspect

EAST-WEST

Figure 2. The Forescout Platform can help you mitigate threats and gain an instant understanding of your segmentation state in real time. Here, Forescout’s segmentation component,
eyeSegment, keeps connected devices from crossing IT-OT domains while Forescout’s network monitoring and threat detection component, eyeInspect, monitors for cyber andoperational risks in the OT/ICS environment. In this way, segmentation policies can be updated dynamically as the threat landscape changes.

Forescout Technologies, Inc.

©2024 Forescout Technologies, Inc. All rights reserved. Forescout Technologies,

Toll-Free (US) 1-866-377-8771
Tel (Intl) +1-408-213-3191
Support +1-708-237-6591

Inc. is a Delaware corporation. A list of our trademarks and patents is available at
Other brands, products, or service names may be trademarks or service marks ofLearn more at Forescout.com

their respective owners. 01_03

www.forescout.com/company/legal/intellectual-property-patents-trademarks.

4