IT CISOs' Guide to OT: Create an IT/OT Circuit Breaker with Cryptographic (Micro)segmentation
(Tom)
In our previous posts, we hid our inherited house from the street using Network Cloaking and shielded its vulnerable plumbing so we could step off the emergency patching treadmill. But now, it’s time to talk about the electrical blueprint of the building itself.
If you look at how your inherited home was constructed (especially older ones), you may discover that the fuse box is a mess and the wiring makes no sense. A single fuse may cover several rooms, or additions may have been made without labels, and you have no idea what they are for. The fuses are usually organized by room rather than by function, and some circuit breakers may have been disabled (or bypassed) because they were inconvenient for the previous owner.
In the operational technology (OT) world, this is what happens when you treat an OT network like an IT network. Firewall-based VLAN segmentation based on location or the switch ports things are connected to, because it is convenient, does not result in a more secure, and most importantly, a logically separated and secure network. And for a newly responsible IT CISO, it represents the single greatest threat to your physical operation.
The biggest threat to your manufacturing lines, substations, or water treatment plants isn't a hyper-targeted exploit launched directly at an individual machine. The single greatest threat to your OT network is your corporate IT network.
The Reality of IT/OT Contagion
Historical data tells an undeniable story: major industrial shutdowns rarely start on the plant floor. Instead, they begin when an employee in the administrative office clicks a phishing link or when an HR server is breached through credential theft.
Because traditional industrial sites are built on flat or nearly flat networks, once a hacker or a piece of automated ransomware compromises that corporate laptop, they can seamlessly move laterally through the organization. They can hop from the office printer, across the administrative network, and route malicious traffic directly to a critical PLC or HMI on the factory floor.
[Traditional Flat Layout]: Corporate Phishing ──> Corporate Network ──> (Lateral Movement) ──> Critical PLCs/HMIs (Plant Shutdown)
[Cryptographic Enclave]: Corporate Phishing ──> Corporate Network ──X (No Lateral Path) ──> [Isolated OT Enclave] (Plant Runs Safely)
In a poorly segmented home electrical grid, a power surge in the upstairs office can trip the master circuit breaker for the whole house - the equivalent of a plant shut down because someone in Finance got phished!. In legacy OT networks, perimeter and standard internal firewalls are no longer sufficient to stop this; they are too easily misconfigured, bypassed, or overwhelmed by automated threat engines.
First-Principles Structural Engineering: Cryptographic Enclaves
To protect the physical operation, we must enforce strict, uncompromising (micro)segmentation. But on an inherited plant floor, you cannot just rewire the network and force a massive, multi-million-dollar hardware overhaul. You can’t replace dozens of legacy switches or recable an entire facility without causing catastrophic operational downtime.
Our approach at BlastWave relies on first-principles engineering: we use a host-based, hardware-agnostic Software-Defined Perimeter (SDP) to build virtual, impenetrable circuit breakers directly around your assets.
Instead of relying on physical network hardware to segment the floor, BlastWave breaks flat networks into isolated, peer-to-peer cryptographic enclaves.
Eliminating the Lateral Path entirely
When you place your critical OT systems into a BlastWave cryptographic enclave, you are fundamentally rewriting the laws of the network:
- No Implicit Trust: Devices within an enclave communicate only with explicitly authorized peers. A corporate laptop can sit on the exact same local network fabric as a critical substation controller, but without the correct cryptographic keys, it cannot even see the controller.
- Hardware-Agnostic Deployment: Because our solution is software-based, you can drop this protective layer over your existing brownfield infrastructure without replacing a single legacy switch or pulling new copper wires.
- Operating Through Compromise: If a corporate workstation is infected with ransomware, our cryptographic tunnels ensure that the threat is entirely contained. The administrative side of the business can experience a full IT outage, but the manufacturing line keeps running safely because the lateral path into the OT enclave simply does not exist.
Seal the Rooms, Protect the Mission
As a CISO, your goal shouldn't be to build a perfect, unhackable corporate network (that is an impossibility!). Your goal must be structural containment. When you bring up this idea to your IT security team, they are likely to tell you that this project will take several years, require new firewalls, and result in more downtime than your plant manager would ever tolerate. Don’t accept that answer!
By implementing software-defined cryptographic microsegmentation, you ensure that an IT power surge stays in the IT kitchen with the right circuit breakers. You isolate your critical operational rooms, protect your legacy infrastructure from lateral spillover, and guarantee that the physical mission continues uninterrupted. All without network redesign or extensive downtime.
In our fifth and final post, Vince and I are going to tackle the keys to the house. We’ll look at why legacy master passwords and traditional VPNs are setting you up for a break-in, and how to completely change the locks using passwordless, phishing-resistant identity. Stay tuned for Blog 5.
Frequently Asked Questions
What is cryptographic microsegmentation in OT security?
Cryptographic microsegmentation divides a flat OT network into isolated, software-defined enclaves. Devices communicate only with explicitly authorized peers using encrypted, authenticated connections, which prevents unauthorized lateral movement.
Why is the corporate IT network a major threat to OT operations?
Many industrial incidents begin in corporate IT through phishing, credential theft, or ransomware. If IT and OT networks are poorly segmented, attackers can move from compromised business systems to PLCs, HMIs, controllers, and other critical operational assets.
How does cryptographic microsegmentation prevent IT-to-OT lateral movement?
It removes the open network paths that attackers rely on. Even when an IT workstation and an OT controller share the same physical network, the workstation cannot discover or communicate with the controller unless it has the required cryptographic identity and authorization.
How is cryptographic microsegmentation different from VLAN segmentation?
VLANs typically separate devices according to network location, switch ports, or IP addresses. Cryptographic microsegmentation enforces access based on verified identity and policy, allowing organizations to isolate assets by function, risk, or operational role rather than physical location.
Can an organization microsegment a brownfield OT network without replacing hardware?
Yes. A host-based, hardware-agnostic Software-Defined Perimeter can create protected OT enclaves over existing switches, cabling, and legacy infrastructure. This reduces the need for extensive network redesign or equipment replacement.
What happens if the corporate IT network is compromised?
The IT environment may still experience disruption, but properly isolated OT enclaves can continue operating because the compromised systems have no authorized lateral path into the protected OT environment.
Does cryptographic microsegmentation require significant operational downtime?
It can often be deployed as a software-defined overlay without recabling the facility or replacing legacy switches. This allows organizations to improve segmentation while minimizing disruption to production and other critical operations.
What is an IT/OT circuit breaker?
An IT/OT circuit breaker is a security boundary that contains an incident within the compromised environment. Cryptographic microsegmentation acts like a digital circuit breaker by preventing malware, ransomware, and unauthorized traffic from spreading from IT into OT.
How to Create an IT/OT Circuit Breaker with Cryptographic Microsegmentation
1. Identify critical OT assets
Create an inventory of PLCs, HMIs, SCADA systems, engineering workstations, historians, controllers, and other systems that support essential physical operations.
2. Map required communications
Document which users, devices, applications, and services must communicate. Focus on operationally necessary connections rather than allowing broad access based on network location.
3. Prioritize IT-to-OT boundaries
Identify every path connecting corporate IT, remote users, contractors, administrative systems, and OT assets. Treat these crossover points as the highest-priority segmentation risks.
4. Group assets by function and criticality
Create logical enclaves for systems that perform related operational functions. Separate critical controllers and safety systems from general-purpose workstations, corporate devices, and less-sensitive assets.
5. Deploy a software-defined security overlay
Apply a hardware-agnostic Software-Defined Perimeter over the existing brownfield network. This creates encrypted, peer-to-peer connections without requiring a complete network redesign.
6. Enforce default-deny access
Block communication unless it is explicitly authorized. Devices should not be able to discover or connect to OT assets simply because they share the same switch, subnet, or local network.
7. Apply cryptographic identity to every connection
Require verified identities and cryptographic authorization before two systems can communicate. This prevents compromised or unauthorized devices from accessing protected OT assets.
8. Test containment during an IT compromise
Simulate a compromised corporate workstation and confirm that it cannot discover, scan, or communicate with systems inside the OT enclave.
9. Monitor and refine policies
Review access activity, remove unnecessary permissions, and update segmentation policies as equipment, operational processes, and user responsibilities change.
10. Expand microsegmentation across the OT environment
After securing the IT/OT boundary, extend cryptographic segmentation to individual production cells, substations, facilities, device groups, and high-risk legacy systems.
REvil’s Kaseya attack showed how trusted tools can become attack paths. BlastWave explains why Zero Trust and network cloaking protect OT environments worldwide.
Explore the complete analysis of 23 OT attacks that defeated firewalls, VPNs, and air gaps.
.svg)
.svg)
.jpg)