Network segmentation is the practice of dividing an OT network into separate, isolated segments and controlling the traffic allowed to pass between them, so that a problem in one part cannot freely spread to the rest. Its opposite - a flat network where every device can reach every other device - is one of the most dangerous conditions in industrial security. This guide explains what segmentation is, why flat networks are so risky, how segments are created and policed, and why containing lateral movement is the whole reason segmentation exists.
Network Segmentation in OT in one line: Network segmentation is the division of a network into distinct segments - by function, criticality, or trust level - with controlled boundaries that restrict which traffic can cross between them. In OT it isolates control-system devices from business systems and from each other, so a compromise or fault in one segment is contained rather than reaching the whole plant. The central benefit is limiting lateral movement: if everything is reachable from everywhere, one foothold exposes everything, whereas segmentation forces an attacker or a spreading fault to cross guarded boundaries.
A flat network is one where all devices share a single addressable space and can communicate directly, with no internal boundaries. It is easy to build and easy to operate, which is exactly why so many older industrial networks became flat over time. The danger is that flatness means uniform reachability: any device that is compromised can immediately attempt to reach every other device, because nothing sits between them. A single infected laptop plugged into such a network has a direct line to controllers, HMIs, historians, and instruments alike.
This matters more in OT than in a typical office network because of what the devices are. Many control-system devices are old, unpatched, and were designed for a trusted, isolated environment; they often have weak or no authentication and fragile network stacks that can be knocked over by unexpected traffic. On a flat network, all of that fragility is exposed to anything that gets a foothold. Malware that would be a nuisance on a hardened corporate network can cascade through a flat OT network and disrupt the process itself.
The classic failure story is a threat entering through the business side and spreading laterally into control systems because nothing separated the two. On a flat or poorly segmented network, an infection on an office PC, a contractor's laptop, or a compromised email attachment can find its way to the devices that run the process, because there is a continuous, unobstructed path. Segmentation exists precisely to break that path into guarded segments, so a foothold in one place does not translate into reach everywhere.
Segmentation is implemented by carving the network into segments and placing enforcement points at the boundaries between them. Physically or logically, devices are grouped by function and trust - business systems in one segment, supervisory SCADA in another, control devices in another, and so on - and traffic between groups is forced through a controlled boundary rather than flowing freely. VLANs, subnets, firewalls, and access control lists are the common mechanisms, applied so that crossing from one segment to another requires passing an explicit, restrictive policy.
The policy at each boundary is where segmentation earns its value. A boundary that allows everything through is a segment in name only; effective segmentation permits just the specific, expected flows and denies the rest by default. That means enumerating what genuinely needs to talk across the boundary - a historian reading from control devices, an HMI receiving specific data - and blocking everything else. The tighter and more explicit the boundary rules, the more the segment actually contains, and the harder it is for unexpected traffic to slip between zones.
A crucial and often overlooked point is east-west traffic - the communication between devices within and across internal segments, as opposed to north-south traffic between the network and the outside. Perimeter defenses only see traffic crossing the outer edge; they are blind to a threat moving sideways between internal devices. Internal segmentation is what governs that east-west movement, adding boundaries inside the network so that lateral spread is checked even by an attacker who is already inside. A strong perimeter with a flat interior controls north-south but leaves east-west wide open.
In SCADA architectures, the most important segmentation boundary is the one separating the control network from the enterprise network, and a demilitarized zone with firewalls on both sides is the classic way to implement that specific boundary. But that DMZ is one segmentation boundary, not the whole of segmentation. Broader segmentation also separates supervisory systems from field control devices, isolates critical safety systems, and can divide the network by site or by process area, so that the compromise of one segment does not endanger the others.
Cloud SCADA reshapes the picture in a useful way. When a platform such as Merobix collects data via device-initiated outbound connections, the field control network does not need inbound access from the internet, and the boundary between the field and the outside can be kept very tight - the site reaches out, and nothing reaches in. That does not remove the need for internal segmentation between control and business systems, but it does mean the most dangerous flat-network exposure, a control network directly reachable from the wider internet, can be avoided by architecture rather than only by firewall rules.
For distributed oil and gas operations, segmentation also has a per-site and per-region dimension. Isolating each site or asset group limits how far a problem at one location can propagate, so a compromise at a single pad does not become a fleet-wide event. Combined with a monitoring model that avoids inbound exposure at the field, well-planned segmentation keeps the blast radius of any single incident small - which, on a network of remote, hard-to-reach, often lightly patched control equipment, is exactly the containment operators need.
On a flat network every device can reach every other device directly, so a single compromised machine has an immediate path to controllers, HMIs, historians, and instruments. That is especially risky in OT, where many devices are old, unpatched, and have weak authentication, meaning malware that would be a nuisance elsewhere can cascade through the network and disrupt the process. Segmentation breaks that uniform reachability into guarded segments so a foothold in one place does not reach everywhere.
A DMZ with firewalls is one specific segmentation boundary - the one separating the control network from the enterprise network. Network segmentation is the broader practice of dividing the whole network into many isolated segments, which also includes separating supervisory systems from field devices, isolating safety systems, and dividing by site or process area. The DMZ implements a single important boundary, while segmentation as a whole governs all the internal boundaries.
East-west traffic is communication between devices inside the network, as opposed to north-south traffic between the network and the outside world. Perimeter defenses only inspect north-south traffic crossing the outer edge and are blind to a threat moving sideways between internal devices. Internal segmentation adds boundaries within the network to govern that east-west movement, so an attacker who is already inside cannot spread laterally without crossing guarded segment boundaries.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.