For plant managers in manufacturing facilities that have been operating for decades, implementing modern network segmentation practices is a challenging, but increasingly necessary, task. This is because over time, legacy equipment, machines, programmable logic controllers (PLCs), computers, servers, software, and network connections accumulate, often without complete documentation or a clear understanding of how everything interacts.
The complexity of these existing environments creates cybersecurity risk, but because many of the systems have supported production reliably for years, plants are hesitant to make changes due to concerns around cost, complexity, and potential downtime. However, reliability and security are not the same.
Fortunately, network segmentation does not have to be an all-or-nothing effort. This article explores how manufacturers can take practical steps to address their most important cybersecurity risks while continuing to improve their networks over time.
Common network segmentation challenges in existing plants
Ideally, all manufacturing plants would have their networks, equipment, software, and hardware installed at the same time. While that can happen for new facilities, the reality is different for older facilities where changes to control systems, computers, equipment, and software have accumulated over decades.
As a result, for existing plants, network segmentation is often complicated by three interconnected factors: the complexity of the existing technology, operational constraints around making changes, and the cost of implementing change. Once manufacturers understand these factors, they can better determine where to start and which improvements to prioritize.
The complexities of existing technology
Think of all the hardware upgrades, software patches, and fixes that can take place in a manufacturing plant over the course of a few decades. Each change adds complexity to the network environment, particularly when some information technology (IT) or operational technology (OT) assets are unaccounted for or undocumented.
While older assets may lack modern security capabilities, unknown or undocumented dependencies between systems can further complicate segmentation. Changing one system can have the unintended consequence of disrupting another if those dependencies aren’t well understood or documented.
Operational constraints for making changes
Whether it’s limited staff, a lack of resources, not wanting to touch reliable OT systems, or uncertainty about when to schedule shutdowns, cybersecurity improvements to existing systems can be hard to justify. Limited shutdown periods only exacerbate these issues. Cybersecurity improvements must be precisely scheduled, completed, tested, and troubleshot within these limited windows. If work extends beyond the planned downtime window, the result can be an extended shutdown and additional lost production time.
The costs of implementing change
It’s easy for manufacturers to have one of two extreme views when it comes to the cost of network segmentation: underestimation or overestimation. Ultimately, costs depend on the network’s size and complexity, the number of legacy systems and their limitations, and the time needed for testing, troubleshooting, and installation.
Understanding these variables is a critical first step when determining what can realistically be accomplished with network segmentation based on available budgets and resources. But before manufacturers can determine what changes are practical, they first need an accurate understanding of the existing OT environment.
Start with an assessment of the existing environment
When getting started with network segmentation, keep this simple concept in mind: you can’t protect what you don’t know exists. Older plants have network connections that have grown with every new addition. PLCs for new machines, hardware upgrades, SCADA software installations, firmware patches, and new equipment and machinery that have been introduced over time create an increasingly complex environment that must be fully understood before segmentation begins.
One of the primary challenges many older facilities face is whether their existing network diagrams and asset inventories accurately reflect what is actually connected and communicating within the OT environment. Ultimately, every unaccounted-for OT asset or unknown connection represents a potential cybersecurity vulnerability that can’t be resolved until it’s identified.
So, where do manufacturers start? The solution lies in performing an assessment of their existing environment. The assessment should identify all equipment, machinery, PLCs, control systems, computers, servers, software, security systems, and any third-party connections that provide outside access to plant systems.
Keep in mind that identifying third-party connections is particularly important, yet many are often overlooked as they tend to be poorly documented. Some common third-party connections to keep an eye out for include:
- Software providers that have remote access to perform patches or upgrades.
- Equipment integrators that can connect to diagnose or troubleshoot machinery.
- Facility management providers that have access to systems such as the HVAC.
These connections need to be identified and understood as part of assessing the existing environment.
Second, the assessment should identify interdependencies between these systems. For example, which systems must communicate for production? Which connections are no longer needed, are outdated, or are not properly understood or documented?
Third, the assessment should identify which assets represent the greatest cybersecurity risks. Prioritize business-critical systems based on factors such as their exposure and the potential consequences if they are compromised.
Together, the information identified during the assessment will provide a more accurate picture of the existing OT environment, including which assets and connections present the greatest risk and which system dependencies need to be considered when planning segmentation.
Balancing “ideal-state” architecture with achievable risk reduction
What constitutes an ideal network can vary depending on operational requirements and cybersecurity objectives. An air-gapped environment may appear ideal from one perspective because it eliminates all outside connectivity. For another group, a zero-trust approach that tightly controls which users, devices, and systems are permitted to access and communicate with one another may be preferred. Or, some organizations may simply want to separate the business IT network from the plant OT network.
Rather than treating the ideal architecture as an all-or-nothing goal, manufacturers should focus on making incremental improvements that meaningfully reduce risk. This means a more realistic starting point for network risk reduction is to identify the most vulnerable, business-critical systems first and prioritize improvements based on risk.
Prioritizing improvements and identifying quick wins
Not all vulnerabilities have the same risk level, and not every cybersecurity improvement requires downtime. This is why prioritizing the most important vulnerabilities and identifying quick wins can help support a long-term plan for segmentation.
Prioritizing cybersecurity vulnerabilities
Getting closer to an ideal state of network segmentation becomes more manageable when the OT assets that present the greatest risks are identified. This should include assets that are essential to production, have clear exposure to cybersecurity breaches, and represent the biggest risk if they were to be compromised.
To appropriately prioritize, consider both the level of risk and the effort required to make an improvement. This can help separate high-risk, lower-effort improvements that may be addressed first from high-risk, higher-effort improvements that require more planning and investment. Lower-risk improvements can likewise be evaluated based on the effort required and incorporated into the longer-term roadmap as appropriate.
Focus on quick wins
Patching software, improving backups, isolating higher-risk legacy systems, and tightening existing firewalls are all examples of quick wins that can lead to cybersecurity improvements. These quick wins help build momentum while providing a much clearer roadmap to the long-term goal of secure network segmentation.
Long-term network segmentation
After addressing identified quick wins, facilities should then prioritize more complex improvements with a long-term network segmentation plan. The plan can be based on risk tolerance, the company’s available resources, and whether outside help is needed, all while being cognizant of production needs and targets.
Building a straightforward network segmentation roadmap
While an assessment identifies priorities, the roadmap outlines how and when network segmentation improvements will be implemented by determining what can realistically be accomplished based on available budget and resources.
Prioritize available budget for the highest-risk improvements, particularly those where the potential risk reduction justifies the required investment. Higher-effort improvements that cannot be completed immediately can be incorporated into future budgeting and capital planning. Be sure to take advantage of planned shutdown windows by scheduling improvements that require production interruptions around those opportunities. When scheduling, also be sure sufficient time is included for testing and troubleshooting.
Leverage planned hardware and software upgrades
As already mentioned, it’s important not to treat network segmentation improvements solely as stand-alone projects. Instead, look for opportunities to incorporate them into planned hardware and software upgrades. Replacing older PLCs with new ones, for example, may provide an opportunity to update IP addressing and make related network segmentation improvements as part of the same project.
Similarly, software upgrades are a great opportunity for cybersecurity teams to identify and analyze existing network connections to determine which communication paths are still necessary, what access is required, and whether additional controls should be implemented.
Developing a practical plan for network segmentation
Network segmentation in older manufacturing facilities does not have to be a one-time, all-encompassing project. Even when an ideal-state architecture isn’t immediately achievable, manufacturers can make incremental improvements that meaningfully reduce cybersecurity risk while accounting for production requirements, available resources, and budget constraints.
To do this, start with an assessment of the current OT environment that identifies all assets, their connections, system dependencies, and cybersecurity risks. From there, prioritize improvements based on both the level of risk and the effort required, and start with high-risk areas where meaningful improvements can be made.
Then, build a longer-term roadmap for making more complex changes. Align those efforts with available budgets and planned shutdown windows and look for opportunities to incorporate network segmentation improvements into already-scheduled hardware and software upgrades.
Remember the goal should not be to create the perfect network overnight. Instead, start by understanding where the greatest risks exist and continue making practical, prioritized improvements that move the plant toward a more secure architecture over time.
