--- title: How to segment your OT network without stopping production description: A practical, step-by-step approach to separating IT and OT networks on a running plant, from NetSeg, an Australian OT network segmentation consultancy. image: https://www.netseg.io/hubfs/grok-image-b1be8429-497a-4b86-af5b-ff28c2e0431f.jpg --- [Skip to content](https://www.netseg.io/netseg-blog/segment-it-from-ot-without-stopping-production#main-content) ![](https://www.netseg.io/hs-fs/hubfs/transparent%20white%20logo.png?width=946&height=302&name=transparent%20white%20logo.png)Homepage - [Home](https://www.netseg.io) - [Capabilities](https://www.netseg.io/netsegs-capabilities) - [Thought Leadership](https://www.netseg.io/netseg-thought-leadership) - [Contact](https://www.netseg.io/contact-us) - [OT Maturity](https://www.netseg.io/picsel-maturity) - [Blog](https://www.netseg.io/netseg-blog) - [Home](https://www.netseg.io) - [Capabilities](https://www.netseg.io/netsegs-capabilities) - [Thought Leadership](https://www.netseg.io/netseg-thought-leadership) - [Contact](https://www.netseg.io/contact-us) - [OT Maturity](https://www.netseg.io/picsel-maturity) - [Blog](https://www.netseg.io/netseg-blog) ![](https://www.netseg.io/hs-fs/hubfs/grok-image-b1be8429-497a-4b86-af5b-ff28c2e0431f.jpg?width=1134&height=614&name=grok-image-b1be8429-497a-4b86-af5b-ff28c2e0431f.jpg) # How to segment your OT network without stopping production ![Leon Poggioli - NetSeg.io](https://www.netseg.io/hs-fs/hubfs/CyberCon%20%20Melbourne%202026%20JMP_2417.jpg?width=48&height=48&name=CyberCon%20%20Melbourne%202026%20JMP_2417.jpg) Leon Poggioli - NetSeg.io October 17, 2026 **Short answer:** You segment IT from OT without stopping production by learning the traffic first, building the boundary in parallel, and cutting over one conduit at a time in planned windows, never in a single big-bang change. NetSeg, an Australian OT network segmentation consultancy, runs segmentation this way so the plant keeps running while the attack paths close. ## Why this is harder than it looks On an IT network, a misconfigured firewall rule usually means a help-desk ticket. On a plant network, the same mistake can drop a historian feed, stop a batch, trip a safety interlock or leave an operator blind at the HMI. That is why many OT sites have flat networks years after everyone agreed they should be segmented: the risk of the change feels bigger than the risk of the threat. The answer is not to avoid the change. It is to design the change so that each step is small, observable and reversible. ## Step 1: Agree what “production” means for this site Before touching the network, write down what must keep running and what can tolerate a short interruption. Typical categories: - **Must not interrupt:** safety instrumented systems, control loops, PLC-to-PLC interlocks, drive and motion networks. - **Can tolerate seconds to minutes:** HMI-to-server traffic with local fallback, historian collection with store-and-forward. - **Can tolerate hours:** engineering workstation access, reporting, patch downloads, vendor remote access. This list drives every later decision about cutover order and timing. Get operations, maintenance and the control systems engineer to sign it, not just IT. ## Step 2: Build an accurate picture of what talks to what You cannot write a safe rule for traffic you do not know exists. Use three sources and compare them: 1. **Passive network monitoring.** If the site already has Claroty, Armis, Dragos, Nozomi or a similar tool, use its asset inventory and communication maps. If not, a SPAN or TAP capture over a representative period (including a shift change, a batch changeover and, ideally, a maintenance activity) is the minimum. 2. **Switch and firewall configuration.** Existing VLANs, ACLs and routing tell you what the original designers intended. 3. **People.** Ask the control engineers and integrators which connections are occasional, such as month-end reports, vendor support sessions or recipe downloads. These rarely show up in a short capture and are the ones most likely to break after cutover. The output is a flow inventory: source, destination, protocol, port, purpose, owner and how often it occurs. ## Step 3: Design zones and conduits Group assets into zones that share a function and a level of trust, following the zones-and-conduits approach in IEC 62443-3-2. A common starting point maps to the Purdue model: - Enterprise IT (Levels 4–5) - An industrial DMZ between IT and OT (often called Level 3.5) - Site operations: historians, MES, engineering workstations (Level 3) - Area supervisory control: HMIs, SCADA servers (Level 2) - Basic control and field devices (Levels 0–1) Each permitted path between zones becomes a conduit with a documented purpose. The design principle is that nothing passes directly from IT to Level 2 or below; it terminates in the DMZ and is brokered from there (for example, a replicated historian, a jump host for remote access, or a patch staging server). Do not over-segment on day one. A sensible first target is a solid IT/OT boundary with a DMZ, then finer zones inside OT once the boundary is stable. ## Step 4: Build the new boundary in parallel The key to avoiding downtime is that the new firewalls, DMZ servers and switches are installed and tested while the old path still carries live traffic. - Install the boundary firewalls in a routed or transparent position that can be bypassed. - Stand up DMZ services (historian replica, jump host, file transfer, patch staging) and test them against real data. - Write the rule base from the flow inventory, with every rule tied to a documented flow and owner. ## Step 5: Run in monitor mode before you enforce Put the firewall in the traffic path with rules set to log rather than block, or with a final “allow and log” rule underneath your explicit rules. Leave it for long enough to see the occasional flows identified in Step 2. Every hit on the catch-all rule is either a flow you missed or something that should not be there. Investigate each one with the asset owner before deciding to allow or deny it. This is usually where sites find unexpected things: a vendor laptop that connects monthly, an old reporting job, or an IT tool scanning OT addresses. ## Step 6: Cut over one conduit at a time Enforce the rules in small batches, starting with the lowest-risk conduits from Step 1 and working towards the most sensitive. For each change: - Schedule it in an agreed maintenance or low-load window with operations. - Have the control engineer on site or on call. - Write a rollback step that takes minutes, not hours (for example, re-enabling the allow-and-log rule or restoring a bypass). - Define what “working” looks like: HMI values updating, historian tags current, alarms flowing, no new communication faults on the PLCs. Only move to the next conduit when the previous one has been stable for an agreed period. ## Step 7: Move remote access into the DMZ Vendor and staff remote access is one of the most common paths into OT. Once the boundary is enforcing, route all remote access through a jump host or secure access platform in the DMZ, with individual accounts, multi-factor authentication, session approval and recording where practical. Remove direct VPN paths into Level 2 and below. ## Step 8: Keep it maintained Segmentation degrades if nobody owns it. Put in place: - A change process for new flows that includes both IT and OT sign-off. - A periodic review of firewall rules against the flow inventory. - Alerts from your OT monitoring tool when new cross-zone communication appears. ## A clearly labelled example *Example only, not a real site:* a food manufacturer with one flat network might plan the work in three windows over a quarter. Window one installs the boundary firewall in bypass and builds the DMZ. Window two enables monitor mode and resolves unexpected flows. Window three enforces the IT/OT boundary and moves remote access to a DMZ jump host. Inner OT zoning is planned as a second phase once the boundary has run cleanly. ## FAQ **Can we segment OT without any production outage at all?** Often, yes, if the boundary is built in parallel and cut over in planned windows. Some legacy devices need a brief restart to pick up new addressing or gateways, so plan for short, scheduled interruptions rather than promising zero. **Do we need to re-IP the plant?** Not necessarily. Firewalls in transparent (layer 2) mode can enforce policy without changing addresses. Re-addressing may still be worth doing later for cleaner zones. **Should IT or OT own the firewalls?** Ownership should be shared and documented. IT usually brings firewall operations skills; OT must approve any change that affects the process. **How long does segmentation take?** It depends on site size, documentation quality and maintenance windows. The flow discovery and monitor-mode phases usually take longer than the physical install. Should this be our first priority? No.  You need good stakeholder engagement between both Cyber and OT teams, a good understanding of your OT network through a visibility tool that can continuously monitor your network, and there are likely other priorities that should come ahead of the level of disruption and change that a network segmentation strategy requires. Before delivering a full-blown network segmentation strategy using firewalls, you can alert on policy deviations with your visibility tool.  You may also select to focus on an IT/OT DMZ early in your OT cybersecurity journey to have one chokepoint of connectivity back to networks external to OT, and to support creation of an IT/OT DMZ for services that need to connect to both, such as patching servers and remote access servers. **Where does NetSeg fit?** NetSeg designs and delivers IT/OT segmentation for Australian industrial and critical infrastructure sites, using the staged approach described above. ## Share this post ## Keep reading ### [![](https://www.netseg.io/hs-fs/hubfs/grok-image-e1481c97-ec8a-4680-8151-9a81e3ad295e.jpg?width=1117&height=618&name=grok-image-e1481c97-ec8a-4680-8151-9a81e3ad295e.jpg) How to build and fund a 3–5 year OT security program](https://www.netseg.io/netseg-blog/build-fund-3-5-year-ot-security-program) ### [![](https://www.netseg.io/hs-fs/hubfs/grok-image-5091ba93-2bc9-4fa4-b6ce-2e5757852682.jpg?width=1140&height=623&name=grok-image-5091ba93-2bc9-4fa4-b6ce-2e5757852682.jpg) What the SOCI Act and IEC 62443 means for Critical Infrastructure Operators](https://www.netseg.io/netseg-blog/soci-act-iec-62443-ot-sites) [![](https://www.netseg.io/hs-fs/hubfs/transparent%20white%20logo.png?width=946&height=302&name=transparent%20white%20logo.png)](https://www.netseg.io/) --- [Privacy Policy](https://www.netseg.io/privacy-policy) © 2026. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Leon Poggioli - NetSeg.io", "url" : "https://www.netseg.io/netseg-blog/author/leon-poggioli-netseg-io" }, "dateModified" : "2026-10-17T07:35:46.062Z", "datePublished" : "2026-10-17T07:34:44.000Z", "headline" : "How to segment your OT network without stopping production", "image" : [ "https://www.netseg.io/hubfs/grok-image-b1be8429-497a-4b86-af5b-ff28c2e0431f.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.netseg.io/netseg-blog/segment-it-from-ot-without-stopping-production", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.netseg.io/hubfs/transparent%20white%20logo.png" } } } ```