What Is Network Segmentation and What Is It For?

Segmenting a network means dividing it into separate zones (production, administration, guests, cameras, servers) with rules about what may talk to what. It ensures that an incident in one zone does not reach the others and that each device sees only what it needs.

A flat network: when everything can talk to everything

Most industrial networks grew by accumulation. First came the office computers; then the printers, the server, the line controllers, the cameras, the IP phones and the visitors' WiFi. Each new device was plugged into whichever switch had a free port, and the result is a flat network: a single space where any device can reach any other. It works every day, until the day one of those devices becomes the entry point.

The contractor, the printer and the controller at the same table

On a flat network, the contractor's laptop and the production line controller are, for all practical purposes, sitting at the same table. An infected machine does not need to get through any defense to look for the next one: it finds them on the same network, with the same permissions. And an industrial controller, designed years ago to talk to its supervisory computer and nothing else, rarely has any way to defend itself from a request it was not expecting.

What the perimeter firewall cannot see

The firewall watches the border between your network and the internet, and there it does its job well. What happens between two devices inside the network never passes through it. That is why a company can have a well-configured next-generation firewall and, at the same time, an internal network where an incident travels from the meeting room to the production floor in minutes. Segmentation is the defense that works on the inside, where the perimeter does not reach.

What segmenting is and what it looks like in practice

Segmenting means building logical walls inside the network: dividing it into zones according to the function of the devices and defining, for each pair of zones, whether they may communicate, in which direction and for which services. The physical network can stay the same; what changes is that not everything reaches everything anymore.

VLAN: logical separation over the same cabling

The basic tool is the VLAN, a virtual network that groups ports and devices even when they are spread across several switches. A managed switch can have the meeting room port on the guest VLAN, the server port on the server VLAN and the controller port on the production VLAN, over the same structured cabling. Without managed switches, segmentation does not exist; with them, it is a matter of design and configuration.

Rules between zones: the internal firewall decides who crosses

Separating into VLANs without rules between them is like putting up walls without closed doors. Segmentation is complete when an internal firewall, or the next-generation firewall itself with one interface per zone, decides which traffic crosses from one to another: the supervisory computer may talk to the controller over the line's protocol, and nobody else; the camera server receives video from the cameras and delivers it to the monitoring room, and nothing more. Everything not explicitly allowed is blocked.

The typical zones of an industrial plant

Although every plant is different, almost all end up with the same zones: production or OT, with controllers, HMIs and line equipment; administration, with the office computers; servers and applications; IP telephony; video surveillance and access control; guest and contractor WiFi; and a management zone for the switches and firewalls themselves. Each one has its rules toward the others, and the guest zone only goes out to the internet.

What it is for beyond security

Segmentation justifies itself on incident containment alone, but its operational benefits are the ones the IT team notices first.

Containment: the incident that stays in its zone

The main benefit is still the one that avoids the opening scenario. With a segmented network, the contractor's laptop lives in the guest zone and only goes out to the internet; the malware it carries looks for neighbors and finds none. If the incident happens in administration, production keeps working while IT contains it. And when it is time to investigate, the internal firewall's log shows what tried to cross, from where and to where, which is the information that never exists on a flat network.

Performance: less noise in each zone

On a flat network, every device hears the broadcast traffic of every other one. With hundreds of devices, that noise consumes capacity and causes slowness nobody can explain. When you segment, each zone hears only its own traffic, and sensitive services such as IP telephony or video can be prioritized without competing with office downloads.

Compliance: what audits and customers require

More and more industrial customers, especially in automotive, food and pharmaceuticals, audit the network security of their suppliers before signing. Security frameworks for industrial environments start from zone separation as a basic requirement. A segmented network, with its diagram and its documented rules, answers that audit in an afternoon; a flat network fails it at the first question.

How segmentation is designed without stopping the plant

The most common fear is that segmenting will break something that works today. It is avoided with method: inventory, design and phases.

Inventory of devices and flows

The first step is knowing what is connected and who talks to whom. A network survey identifies every device, its function and its real communications, including the ones nobody remembers configuring. That map is what prevents you from blocking, when you segment, the flow the quality system was using to read data from the line.

Phased implementation and managed switches

With the map in hand, the zones and rules are defined and implemented in phases: first the zones with the lowest operational risk, such as guests and administration, and production last, in a window agreed with the plant and with a rollback ready. If the current switches are not managed, replacing them is part of the project. At TeleCloud we design and implement segmentation with certified equipment and with the prior survey as the foundation, so the plant notices the change only in what stops happening.

The mistakes that make a segmentation useless

Four mistakes repeat: creating VLANs without rules between them, so everything keeps crossing; allowing "anything" between production and administration because one system needed it and nobody narrowed down what; leaving the cameras or the guest WiFi in the same zone as the office computers; and not documenting the rules, so the next technician opens them to fix a fault and nobody ever closes them again. A segmentation is only as good as the discipline with which it is maintained.

The way to sustain it is to treat the rules as part of the operation: one owner, a current diagram, a procedure for opening a new rule with a review date, and a quarterly review of what was opened and is no longer used. With that, the segmentation designed in the project still exists two years later, which is when it usually gets tested.

If at your plant any free port gives access to the same network as the production controllers, your firewall is guarding one door while the building has no walls. At TeleCloud we map your network, design the zones and implement them in phases without stopping operations. Request a diagnosis at https://telecloud.com.mx