A firewall won't protect your OT

“We have a firewall to the internet, so OT is protected.” It’s a comforting thought, and a dangerous one. The firewall is necessary, but it rarely protects what people think it does.

Where the problem actually sits

A firewall guards the boundary with the internet. But most serious incidents in control systems don’t start with a direct attack from outside onto OT. They start on the IT side — an email, a leaked login, a vulnerable server — and move across, and if the network is flat, nothing stops them.

Three things make it worse than people assume:

• A flat network. Whoever gets a foothold in one place can reach almost everything else. The internet-facing firewall does nothing about movement on the inside.
• IT and OT connect more than the diagram shows. A forgotten link, a shared server, a remote-access route a supplier was given long ago.
• OT can’t just be taken offline. A control system often can’t be patched or rebooted like an ordinary server, so old weaknesses stay around for years.

The firewall is the wall around the house. Once someone is inside, it’s the doors within the house that decide how far they get. For OT, those internal doors are what save you.

What actually protects OT

The answer is segmentation: dividing the network into zones and controlling every crossing between them, so an intrusion on the IT side stops at the boundary instead of reaching the process. That’s the core idea in IEC 62443, the international standard for OT security — zones, and controlled connections between them.

In practice:

• Map where IT and OT actually meet. Nearly always more places than expected.
• Divide into zones and control each crossing; only what should pass, passes.
• Keep track of remote access, especially suppliers’, and log it.
• Check that the segmentation holds in practice, not just on paper.

And one more thing: you don’t probe OT with active scanning. The safe way to check segmentation is passively — observing whether the traffic is actually kept apart — without touching the sensitive systems.

A firewall is necessary. But it’s the beginning, not the protection.