Network Segmentation and Access Control Strategies: Building Defense Layers That Actually Work

Week 4 of 5: Building OT Security Business Cases for Small-Medium Businesses

You've secured your perimeter—congratulations! But here's the uncomfortable truth: attackers will eventually get past your firewall. Whether through a phishing email, a compromised vendor laptop, or a zero-day exploit, your perimeter will be breached. When that happens, network segmentation becomes your most critical defense.

Network segmentation creates internal boundaries that limit an attacker's ability to move laterally through your network. Combined with robust access control, segmentation transforms your network from a flat, vulnerable environment into a series of controlled zones where attackers must overcome multiple barriers to reach critical systems.

For SMBs, the challenge isn't understanding why segmentation matters—it's implementing it in a way that doesn't break operational workflows or require dedicated security staff to maintain.

Why Traditional Network Segmentation Fails in OT Environments

Most IT segmentation strategies focus on user productivity and data protection. OT segmentation has fundamentally different requirements:

Operational Continuity: Production systems can't wait for authentication servers or network policy updates. Segmentation must maintain operational reliability even during security incidents.

Protocol Complexity: Industrial protocols like EtherNet/IP use multicast communications and dynamic port ranges that break traditional firewall rules.

Legacy System Integration: Your 15-year-old HMI system wasn't designed for modern network security and may not support advanced authentication or encryption.

Real-Time Requirements: Many OT communications are time-sensitive. Adding network hops or security processing that introduces latency can cause production issues.

Vendor Access Needs: Equipment vendors need periodic access to systems for maintenance, but traditional VPNs create excessive network exposure.

Building Practical OT Network Segmentation

The Zone-Based Approach

Effective OT segmentation organizes your network into zones based on function, criticality, and trust level:

Five zones, from the outside in

Trust drops at each boundary. Traffic crosses only where a rule allows it.

Outside networksInternet, corporate IT, vendors

Untrusted from the plant’s point of view

DMZExternal connectivity

Remote access, cloud connections, vendor support systems

• Buffer between OT and outside
• Enhanced monitoring and logging
• Strict access and session control

Zone 3Operations support

MES, asset management, local file servers

• Integrates with corporate systems
• Standard IT security controls

Zone 2Supervision and HMI

Operator interfaces, engineering workstations, local historians

• User authentication required
• Limited corporate connectivity if needed

Zone 1Control systems

PLCs, RTUs, DCS controllers, motor drives

• Segmented from corporate networks
• Controlled vendor access only

Zone 0Safety systems

Emergency shutdown, fire suppression, physical safety controls

• Highest security
• Minimal connectivity
• Read-only monitoring only

Micro-Segmentation for Critical Assets

Beyond zone-level segmentation, implement micro-segmentation for your most critical systems:

Asset-Level Isolation: Critical controllers get their own network segment that can use firewall rules, integrated switches or segmentation gateways

Function-Based Separation: Separate read-only monitoring traffic from control communications.

Vendor Isolation: Create temporary network segments for vendor access that automatically expire.

Time-Based Access: Network access that's automatically granted and revoked based on operational schedules.

Integrated Solutions: Fortinet's Industrial Security Ecosystem

For greenfield deployments or major network upgrades, integrated security platforms can provide comprehensive protection with simplified management.

Fortinet Industrial Security Stack

FortiGate Rugged Industrial Firewalls

• Deep packet inspection for industrial protocols

• Integrated threat intelligence and malware detection

• Centralized management and policy enforcement

• Cost: $5K-$10K depending on throughput requirements

FortiSwitch Industrial Managed Switches

• Native integration with FortiGate firewalls

• Automated VLAN provisioning and policy enforcement

• Industrial-grade environmental specifications

• PoE+ support for IP cameras and wireless access points

• Cost: $800-$2K per switch

FortiClient Secure Remote Access Add-On

• Zero-trust network access (ZTNA) capabilities

• Application-specific access control

• Device compliance checking

• Session recording and monitoring

• Cost: $500-$1,000 per year

Why the Fortinet Integrated Approach Works for SMBs

Simplified Management: Single management interface for firewalls, switches, and remote access Consistent Policies: Security policies automatically propagate across all network devices Reduced Training: IT staff only need to learn one management system Better Support: Single vendor relationship for all network security components Cost Efficiency: Integrated licensing often provides better pricing than point solutions

Fortinet Implementation for Common SMB Scenarios

Two Fortinet builds, priced out

	Small facility (50–100 devices)	Multiple sites
FortiGate 60F industrial firewall	1 × $6K = $6K	3 × $6K = $18K
FortiSwitch 148F-FPOE switches	3 × $2K = $6K	12 × $2K = $24K
FortiClient ZTNA (first year)	10 users, $2.4K	40 users, $9.6K
FortiManager	—	$3K
Professional services	$5K	$18K
First-year total	$19.4K	$72.6K

Next-Generation Segmentation: Blastwave's Consolidated Platform

For SMBs looking to minimize the number of security tools while maximizing protection, emerging platforms like Blastwave offer compelling alternatives to traditional point solutions.

Blastwave's Integrated Approach

Software-Defined Segmentation: Creates network microsegments without requiring new hardware or network redesign Built-in Secure Remote Access: Zero-trust remote access integrated with segmentation policies Network Cloaking: Makes network segments invisible to unauthorized users and attackers Unified Management: Single platform for segmentation, access control, and monitoring

Key Advantages for SMB OT Environments

Reduced Complexity: One platform replaces multiple point solutions (firewalls, VPN, network access control, network cloaking) Faster Deployment: Software-based approach doesn't require hardware refresh cycles Lower Ongoing Costs: Reduces licensing, training, and management overhead Enhanced Security: Cloaking technology makes network segments invisible to reconnaissance

Blastwave Implementation Considerations

Deployment Model: Cloud-managed service with on-premises enforcement points Cost Structure: Subscription-based pricing typically $2k-10k per site per year Required: Minimal networking expertise required due to automated configuration Time to Deploy: 2-4 weeks for typical SMB deployment including testing and validation

When Blastwave Makes Sense:

• Organizations wanting to minimize security tool sprawl

• Limited internal networking expertise

• Need for rapid deployment without hardware refresh

• Strong preference for cloud-managed solutions

• Budget flexibility for operational expenses vs. capital expenses

• Limited ability to make network changes 

When Traditional Solutions Are Better:

• Existing investment in compatible network infrastructure

• Strong preference for on-premises management Integration needs with existing enterprise security tools

Practical VLAN Design for OT Environments

Whether you choose integrated platforms or traditional approaches, effective VLAN design forms the foundation of your segmentation strategy. This is best if you believe your network needs a refresh and are willing to make changes to how your network is configured. 

OT VLAN Architecture Best Practices

A starting VLAN plan

Five VLANs cover most small plants. Adjust numbering to your existing scheme.

VLAN	What lives here	Access rules	Extra controls
10 Critical control	PLCs, RTUs, safety systems	No internet; minimal cross-VLAN traffic	Enhanced monitoring and logging
20 HMI and operators	Operator and engineering workstations	Controlled access to VLAN 10; user authentication	Web filtering, endpoint protection
30 Operations support	Historians, MES, file servers	Bridge between OT and IT	Standard IT controls, regular patching
40 Guest and vendor	Temporary vendor laptops and devices	No production access; internet for updates and support	Automatic cleanup after the vendor leaves
50 Infrastructure	Domain controllers, DNS, NTP, backups	Secure administrative access only	Audit logging, redundancy and high availability

VLAN Implementation Timeline and Requirements

Five to nine weeks from plan to cutover

Run in sequence. Migration is the phase most likely to stretch.

Low estimateUp to high estimate

Planning and design

2–3 wks

Infrastructure preparation

1–2 wks

Migration and testing

2–4 wks

01 wk234

Phase 1: Planning and Design (2-3 weeks)

• Network discovery and asset mapping

• VLAN design and IP addressing scheme

• Security policy development

• Change control approval

Phase 2: Infrastructure Preparation (1-2 weeks)

• Managed switch deployment or configuration

• Firewall rule development and testing

• DHCP and DNS configuration updates

• Documentation and runbook creation

Phase 3: Migration and Testing (2-4 weeks)

• Phased migration of network segments

• Connectivity testing and validation

• Performance monitoring and optimization

• Staff training and knowledge transfer

Skills Required for VLAN Implementation:

• Network Administration: VLAN configuration, IP subnetting, routing protocols

• Firewall Management: Inter-VLAN routing rules, access control lists

• Industrial Systems: Understanding of OT communication requirements

• Project Management: Coordinating changes across operational systems

Access Control Integration with Existing Systems

Effective access control must integrate with your existing operational workflows while providing enhanced security.

Windows Domain Integration

Most SMBs already use Windows Active Directory for user management. Leverage this investment for OT access control:

Industrial Firewall Integration: Modern industrial firewalls integrate with Active Directory for user authentication Role-Based Access: Map existing job roles to network access permissions Group Policy Integration: Use existing Group Policy infrastructure for endpoint security Single Sign-On: Reduce password fatigue while maintaining security

Multi-Factor Authentication (MFA) for OT Access

Where MFA helps, and where it gets in the way

Require MFA for

• Remote access to OT systems
• Administrative access to critical infrastructure
• Access from untrusted networks or devices
• Regulatory requirements such as NERC CIP

Plan around MFA for

• Emergency response that needs immediate access
• Devices that can’t support modern authentication
• Workflows with frequent system access
• Shared operator workstations in control rooms

Cost-Effective Implementation Strategies

Three ways to segment, compared

	Budget-conscious	Enhanced	No network changes
First-year cost	$25K	$37K	$17K–$25K
What you buy	Managed industrial switches: $10K Firewall with inter-VLAN routing: $5K Basic remote access: $5K/yr Professional services: $5K	Integrated platform (Fortinet or similar): $20K Remote access with session recording: $6K/yr Network access control: $3K Services and training: $8K	Segmentation platform (Blastwave or similar): $2K–$10K/yr Security assessment and design: $15K
What you get	3–4 VLANs Controlled inter-VLAN traffic Secure vendor access Central logging	Micro-segmentation Zero-trust remote access Ties into existing authentication Advanced monitoring and alerting	Software-defined micro-segmentation Network cloaking Privileged access management

Common Implementation Challenges and Solutions

Challenge #1: Legacy System Compatibility

Problem: Old industrial systems don't support modern networking or security features.

Solution:

• Create dedicated VLANs for legacy systems with enhanced monitoring

• Use protocol gateways to modernize communications

• Implement out-of-band management networks for legacy devices

• Plan for gradual system modernization over 3-5 years

Challenge #2: Operational Workflow Disruption

Problem: Traditional Network segmentation breaks existing operational procedures.

Solution:

• Involve operations staff in segmentation design

• Implement changes during planned maintenance windows

• Provide comprehensive training before implementation

• Create detailed rollback procedures for each phase

Challenge #3: Vendor Access Management

Problem: Equipment vendors need flexible access that traditional security controls make difficult.

Solution:

• Implement just-in-time access for vendor support

• Create standardized vendor onboarding procedures

• Use session recording for all vendor access

• Regular review and audit of vendor access rights

Challenge #4: Performance Impact

Problem: Security controls introduce latency that affects real-time operations.

Solution:

• Size security hardware appropriately for traffic loads

• Use hardware-accelerated security processing where available

• Monitor network performance continuously

• Implement bypass procedures for emergency situations

Measuring Segmentation Effectiveness

Security Metrics

Lateral Movement Prevention: Time and effort required for attackers to move between network segments Access Control Violations: Number of unauthorized access attempts blocked Vendor Access Management: Percentage of vendor access sessions properly managed and recorded Privileged Account Security: Number of privileged accounts with appropriate controls

Operational Metrics

Network Performance: Latency and throughput impact of segmentation controls System Availability: Uptime of critical systems with segmentation in place Operational Efficiency: Impact on staff productivity and workflow completion times Change Management: Time required to implement network changes safely

Business Metrics

Compliance Improvement: Progress toward regulatory compliance objectives Risk Reduction: Quantified reduction in cyber risk exposure Cost Optimization: Reduction in security tool licensing and management costs Insurance Benefits: Impact on cyber insurance premiums and coverage if aligned with NIST CSF Framework 

Your Segmentation Implementation Checklist

Segmentation checklist

Network design

• VLAN architecture designed based on operational requirements
• Inter-VLAN communication policies documented and approved
• IP addressing scheme optimized for segmentation
• Network performance requirements validated

Infrastructure deployment

• Managed switches deployed and configured
• Firewall rules implemented and tested
• Network monitoring capabilities deployed
• Documentation and runbooks completed

Access control integration

• Active Directory integration configured
• Multi-factor authentication deployed for remote access
• Privileged access management implemented
• User training and awareness completed

Vendor and remote access

• Secure remote access solution deployed
• Vendor access procedures documented and tested
• Session recording and monitoring implemented
• Emergency access procedures established and tested

Looking Ahead: Network Monitoring and Incident Response

Next week, we'll complete our OT security series with practical network monitoring and incident response strategies specifically designed for SMB environments. We'll cover:

• Affordable OT-specific monitoring solutions

• Alert tuning to minimize false positives

• Incident response procedures that work with limited staff

• Integration with existing operational procedures

• Automated response capabilities that maintain operational reliability

Your segmented, access-controlled network provides the foundation for effective monitoring and response. Without proper segmentation, monitoring becomes overwhelming and incident response becomes nearly impossible.

Key Takeaways

Effective network segmentation and access control for SMB OT environments requires:

1. Zone-based architecture that reflects operational requirements and risk levels

2. Integrated solutions like Fortinet or next-generation platforms like Blastwave that reduce complexity

3. Practical VLAN design that supports operations while enhancing security

4. Access control integration with existing systems and workflows

5. Cost-effective implementation strategies that deliver security without breaking budgets

Remember: The goal isn't perfect isolation—it's practical risk reduction that maintains operational reliability while significantly increasing the effort required for attackers to compromise critical systems.

Proper segmentation transforms your network from a flat, vulnerable environment into a series of controlled zones where attackers must overcome multiple barriers to reach critical systems. Combined with the perimeter defense we covered last week, you're building layers of protection that force attackers to work much harder while giving you multiple opportunities to detect and respond to threats.

 

---

 

This is part 4 of a 5-part series on practical OT security for small-medium businesses. Have questions about network segmentation and access control? Drop them in the comments below.