Industrial Network Segmentation: Defending Critical Infrastructure in Wartime

Network segmentation in industrial environments is the practice of dividing operational technology (OT) networks into isolated zones that cannot freely communicate with each other or with enterprise IT networks. The goal is to limit an attacker's ability to move from a compromised position (typically gaining initial access through enterprise IT) into the operational technology systems that control physical processes. Ukraine's critical infrastructure has been subjected to the most sophisticated industrial cyberattacks documented—attacks that traversed IT/OT boundaries to manipulate power grid equipment. The lessons from these attacks have driven concrete changes in segmentation architecture not only in Ukraine but in critical infrastructure protection frameworks globally.

Air-Gap Limitations in Modern Industrial Operations

The traditional "air-gapped" approach—physically disconnecting OT networks from all external networks—provides strong isolation but conflicts with modern operational requirements. Patch management, historian data collection, vendor remote support, and integration with enterprise resource planning (ERP) systems all create business demand for connectivity. Organizations attempting to maintain air gaps face operational pressure to create exceptions; each exception becomes a potential attack surface. The Ukraine 2015 attack appears to have exploited exactly such a bridge: attackers who compromised enterprise email accounts used that access to pivot toward substation automation systems. Pure air-gap security also creates false confidence—physical media (USB drives) and supply chain compromises have bridged air gaps in high-profile incidents including the Stuxnet attack on Iranian centrifuges. Ukraine's experience has reinforced the security community's consensus that true air-gap security is rare and that controlled, monitored connectivity is preferable to permeated isolation masquerading as an air gap.

Segmentation Architecture Approaches

Data Diodes in Critical Infrastructure

A data diode (hardware enforced unidirectional network device) uses optical or hardware mechanisms to permit data flow in only one direction—typically from the OT network toward the enterprise or monitoring network—while physically preventing any return path. Unlike software firewalls, which could theoretically be misconfigured or compromised, properly implemented data diodes physically cannot pass data in the reverse direction. For critical infrastructure applications where OT sensor data and historian telemetry must be available to enterprise systems (for billing, maintenance, optimization) but no data should flow from enterprise systems to OT, data diodes provide very strong segmentation. Ukraine's partners, including EU advisory missions, have recommended and assisted with data diode deployments at critical facilities as part of hardening programs. Waterfall Security Solutions, Owl Cyber Defense, and other vendors supply commercial data diode products widely used in energy and critical infrastructure sectors.

Industroyer and the Limits of Segmentation

The Industroyer malware (2016) and Industroyer2 (2022) demonstrated that segmentation alone is insufficient without comprehensive monitoring and detection capability. Both malware families were designed to execute attacks on OT systems that had already been accessed—the segmentation bypass had occurred in an earlier phase, using compromised vendor credentials and IT/OT boundary weaknesses that had been probed over months. Industroyer2's discovery in 2022 before execution showcased what effective defense looks like: CERT-UA and ESET identified anomalous activity indicative of pre-positioning and execution preparation, enabling defenders to act before the attack's operational phase. This detection success depended on monitoring that flagged anomalous OT network activity and lateral movement patterns—monitoring that requires OT-specific tools since enterprise security tools typically cannot inspect ICS protocol traffic.

Implementing Segmentation Under Wartime Constraints

Ukraine's infrastructure operators have faced the challenge of implementing or improving network segmentation while also responding to active threats, physical infrastructure damage, personnel shortages, and supply disruptions. Practical guidance from this experience emphasizes prioritization: segment the most critical systems (generation control, transmission protection) first; implement monitoring before segmentation so that the act of reorganizing networks does not blind defenders; use out-of-band management networks so that OT management plane communications cannot be disrupted by attacks on the primary network; document network architecture thoroughly so that personnel changes during conflict don't result in undocumented connections; and audit vendor remote access, which has historically been a segmentation bypass pathway. International partners including the US, UK, and EU have provided both technical assistance and equipment—including hardware firewalls and monitoring systems—to support Ukraine's OT security improvement under wartime conditions.

FAQ

What is a data diode?

A data diode is a hardware device that enforces unidirectional data flow using optical or electronic mechanisms, physically preventing data from flowing in the reverse direction. Unlike software firewalls that could be misconfigured, a hardware data diode provably cannot pass data back, making it very strong segmentation for scenarios where read-only remote access to OT data is needed.

Why is air-gapping OT systems difficult in practice?

Operational requirements—patch distribution, historian data collection, vendor support, ERP integration—create constant pressure for connectivity exceptions. Each exception creates attack surface. Pure air gaps are also vulnerable to physical media attacks. Security practitioners often recommend controlled, monitored connectivity over improperly maintained air gaps.

How did Industroyer bypass network segmentation?

Industroyer's initial access came through IT network compromise, with attackers pivoting to OT-adjacent systems over time. The malware exploited the IT/OT connectivity that existed for operational purposes. Segmentation was not comprehensive enough to prevent lateral movement from IT to the OT environment during the months-long pre-attack reconnaissance and positioning phase.

What is a DMZ in an OT context?

An OT Demilitarized Zone (DMZ) is a segmented network layer positioned between enterprise IT (Level 4 in the Purdue model) and OT networks (Level 3 and below), hosting services needed by both sides—historians, jump servers, analytics platforms—while preventing direct connectivity between IT and OT. All traffic between IT and OT passes through and is inspected in the DMZ.

What OT monitoring tools are appropriate for Ukraine?

Passive OT monitoring tools—including Dragos Platform, Claroty, and Nozomi Networks—are designed to perform asset discovery and anomaly detection in industrial networks without disrupting device operation. These tools can identify unauthorized protocol commands, anomalous engineering workstation behavior, and communication patterns indicating lateral movement, all without the availability risks of active scanning.

Sources

1. Dragos, "Industrial Network Security and Segmentation Best Practices," 2022
2. CISA, "Recommended Cybersecurity Practices for Industrial Control Systems," 2022
3. ICS-CERT, "Improving Industrial Control System Security," 2016
4. Waterfall Security Solutions, "Data Diode Technology Overview," 2022
5. ESET/CERT-UA, "Industroyer2 Technical Analysis," April 2022