Just 13% of network segments are OT-only, says Forescout Research

Enterprises have had a poor record with network segmentation for years, and a study released Sept. 22 by Forescout Research analyzing 47,700 network segments across 209 organizations and 2.5 million devices supports that notion.

Only 13% of network segments with operational technology (OT) devices are OT-only, and nearly half of the segments with OT or Internet of Medical Things (IoMT) devices also mix in IT and Internet-of-Things (IoT) assets, widening the attack surface and opening the door to lateral movement.

The researchers also found that IP cameras typically share a segment with workstations and servers — turning a single compromised IP camera into a potential networkwide breach.

“OT and IoT systems have often been managed and maintained by the line-of-business such as manufacturing, facilities, or physical security, and lack IT-level hygiene around network management and cybersecurity,” said John Gallagher, vice president at Viakoo. “This is another example alongside things like not updating firmware or using default passwords that also are found in OT/IoT systems.” 

Gallagher said the Forescout findings highlight a dangerous reality for the enterprise overall: enterprise networks still rely on the illusion of separation. Gallagher noted that with only 13% of OT segments genuinely isolated, the vast majority share broadcast domains and pathways with IT and peripheral IoT devices like cameras and printers, making them into attack vectors.

John Strand, owner at Black Hills Information Security, said the 13% number actually seems a bit high.

“We’ve been doing offensive security testing for years, and the vast majority of the time when an organization says a network is air-gapped, it really isn’t,” said Strand. “The only places where we consistently see truly air-gapped networks are classified environments and classified security assessments.”

Strand pointed out that much of the OT technology is typically legacy, difficult to manage, and still requires some form of remote administration. Sometimes these systems are in locations where traditional remote access isn’t practical, so Strand said organizations end up connecting them through cellular networks or other methods. Strand said the Forescout report shows is consistent with what his team has seen for years.

“Security teams also need to accept that maintaining a perfect air gap may not always be realistic,” said Strand. “What’s realistic is having a documented plan to rapidly disconnect OT systems from external networks during an incident. Organizations need to know exactly how that happens and who has the authority to make that call. That authority cannot be limited to waiting for the CTO or CEO.”

Dan Schiappa, president of technology and services at Arctic Wolf, added that as AI helps attackers move faster and operate at greater scale, the gap between IT and OT networks becomes an increasingly attractive target.

“Organizations need to assume that an attacker will eventually get in and focus on limiting what they can access next,” said Schiappaa. “That starts with a clear inventory of connected assets, stronger segmentation between IT and OT systems, continuous visibility, and tighter access controls.”

Schiappa said isolating OT devices on a separate network is an extension of micro segmentation. In this case, Schiappa said security teams should employ micro segmentation dedicated to OT/IoT devices with the option for additional segmentation within that population for higher mission critical devices.

“The goal is to limit an attacker’s ability to move laterally and contain threats before they disrupt critical operations,” said Schiappa. “Reducing an attacker’s ability to move through the environment can make the difference between a contained incident and a major operational disruption.”

Here's how Forescout recommends security teams can improve network segmentation on enterprise networks: