OT Network Segmentation Planning, Implementation, and Validation

No ratings

Presented at DEF CON 33 by

Tony Turner

This presentation will provide ICS security practitioners with a comprehensive introduction to Operational Technology (OT) network segmentation. As industrial control systems face increasing cyber threats, proper network segmentation has become a critical security control to limit attack surfaces and protect critical infrastructure. Attendees will learn practical approaches to planning segmentation architectures, implementing controls across OT environments, and validating the effectiveness of their segmentation strategy. The session blends theoretical concepts with practical implementation guidance suitable for security practitioners with introductory to intermediate knowledge of industrial control systems. Key topics include: OT Network Segmentation Fundamentals (objectives, benefits, IT/OT differences, reference architectures); Planning Strategies (asset inventory, flow analysis, zone design, risk-based requirements, legacy systems); Implementation Approaches (physical vs. logical separation, DMZs, deep packet inspection, data diodes, appropriate tools); Validation Methods (verification techniques, safe penetration testing, monitoring, measuring success); and Real-World Case Studies with lessons learned and common challenges. This session is designed for industrial cybersecurity professionals, control system engineers, IT/OT security architects, and other stakeholders responsible for securing operational technology environments. Attendees should have basic familiarity with industrial control systems and networking concepts.