OT Segmentation Must Survive Edge Compromise

An OT network can contain multiple VLANs and still have no meaningful containment.

The test is simple: if an attacker compromises the edge device, remote-access account, or management plane, can that attacker reach every controller, HMI, engineering workstation, and protection device behind it?

If the answer is yes, the architecture has internal organization. It does not have a durable security boundary.

CERT Polska’s report on the coordinated attacks against Poland’s energy sector on 29 December 2025 is a useful case study. The report covers attacks against at least 30 wind and solar facilities, a large combined heat and power plant, and a manufacturing company. The destructive actions affected both IT systems and physical industrial devices.

The technical details expose two different ways containment can fail:

At distributed renewable-energy sites, the attacker controlled the VPN and firewall appliance at the edge. VLANs existed, but a privileged VPN path could reach all subnets.
At the combined heat and power plant, the attacker obtained privileged Active Directory access and could move across the environment. The final attempt to distribute wiper malware through Group Policy was blocked by EDR.

One failure started at the network edge. The other used enterprise identity and administration. Both reached toward operational impact.

The lesson is not that VLANs, VPNs, Active Directory, or EDR are useless. The lesson is that OT containment must remain effective after one of those controls fails.

What The Incident Actually Showed

CERT Polska found that the affected renewable-energy sites used FortiGate appliances as both VPN concentrators and firewalls. The SSL VPN was exposed to the Internet, accounts did not use multifactor authentication, and some devices had previously remained vulnerable to remote-code-execution flaws. The report also notes that account and password reuse across sites was common industry practice.

Inside the sites, separate VLANs were often present. But the attacker had administrator rights on the edge appliance and could obtain or create access across the internal subnets. The attacker then targeted reachable operational devices in ascending IP-address order.

The actions were direct and destructive:

RTUs were damaged using modified firmware or destructive commands.
protection controllers were disrupted through default FTP credentials;
HMIs were reached with known local administrator credentials and prepared for SMB-based remote execution;
serial device servers were reset and reconfigured to delay recovery;
edge appliances were returned to factory settings, which also removed useful evidence.

The report says the attack severed communication between the affected renewable sites and distribution-system operators. It did not disrupt current electricity production or destabilize the Polish power system, but the access obtained could have caused production outages at individual sites.

The combined heat and power plant followed a different path. CERT Polska found long-running reconnaissance, credential theft, access to the domain controller, interest in systems containing “scada” in their names, and movement through RDP, SMB, and PsExec. The attacker eventually used privileged domain access to attempt wiper distribution through GPO. EDR detected and blocked that final action.

This is the architectural point: a security control can stop the last step while the environment remains far too traversable. Prevention at execution time is valuable. It is not a substitute for limiting which systems and control paths can be reached in the first place.

A VLAN Is A Boundary Only When Policy Survives Administration

VLANs are useful building blocks. They separate broadcast domains and create places where policy can be enforced. But a VLAN alone does not determine who may cross the boundary.

If routing between every OT VLAN terminates on one edge appliance, and one administrator can change every route and rule, compromise of that appliance collapses the segmentation design.

The same problem appears in other forms:

one VPN role grants access to every plant subnet;
one Active Directory group administers IT, OT, backup, and security systems;
one engineering workstation can connect to every controller;
one jump host serves operators, vendors, and general administrators;
one management console can reconfigure both the access boundary and the protected assets;
one shared local password works across many remote sites.

The topology may look segmented. The authority graph is flat.

NIST SP 800-82 Revision 3 recommends organizing OT devices into levels, tiers, or zones, then using mapped data flows to permit only authorized communications between them. It specifically recommends a deny-all, permit-by-exception posture where possible and says firewall rules should permit connections only between adjacent levels, tiers, or zones.

That is stronger than creating subnets. It makes every boundary answer a precise question: which source, using which protocol, may reach which destination, for which operational purpose?

Design For A Compromised Edge

The edge appliance is exposed by design. It terminates remote connectivity, often accepts Internet traffic, and may hold credentials, routing, firewall, and VPN configuration. Treat it as a high-risk enforcement point, not a permanent root of trust.

A resilient remote-site design should assume that this device can be compromised.

Put a second enforcement boundary behind remote access

Do not let the Internet-facing VPN or cellular router route directly to every OT asset. Terminate remote access into a dedicated access zone or industrial DMZ. From there, enforce separate allowlists toward engineering workstations, HMIs, historians, RTUs, PLCs, and management interfaces.

The outer device can authenticate and encrypt the session. The inner boundary decides what that session may actually reach.

Where consequences justify it, use enforcement from a different administrative plane or device class. An attacker who controls the remote-access appliance should not automatically control the next boundary.

Separate telemetry from administration

Normal SCADA telemetry and exceptional maintenance are different trust paths.

Telemetry should use fixed source and destination pairs, expected industrial protocols, and the minimum required direction. Administrative access should enter through a monitored jump host, use a separate identity, require explicit authorization, and exist only for the duration of the work.

Do not grant a maintenance account broad network access because troubleshooting might need it someday. Predefine emergency procedures and narrow break-glass policies instead.

Isolate by function and consequence

An HMI, RTU, serial gateway, protection relay, safety controller, and engineering workstation do not have the same role or consequence of failure. They should not share identical reachability.

At minimum, distinguish:

remote-access and vendor-access zones;
operator and engineering workstations;
supervisory systems and historians;
process-control devices;
protection and safety-related systems;
management, logging, backup, and recovery services.

High-consequence devices may justify physically separate switching or unidirectional gateways. NIST explicitly advises organizations to consider physically separate switches for high-criticality devices such as safety systems.

Deny peer-to-peer reachability by default

Distributed sites often share templates, addressing, vendors, and support teams. That creates operational efficiency and attacker scalability.

One compromised renewable site should not provide a route to another. One field device should not initiate connections to its peers. One vendor session should not discover every asset using the same product.

Enforce site isolation in the WAN, VPN, private APN, or SD-WAN layer, then repeat the restriction at each site boundary. Private connectivity reduces Internet exposure, but it does not prove least privilege inside the private network.

Segment The Management Plane, Not Just The Process Network

The Polish incident demonstrates why OT segmentation cannot stop at process zones.

The systems that can change the environment deserve stronger boundaries than the systems that merely use it:

firewall and VPN management;
Active Directory and identity services;
Group Policy;
endpoint and security-management consoles;
firmware repositories and update services;
engineering software and project files;
backup and recovery platforms;
switch, router, cellular, and serial-gateway administration.

These are the paths through which one compromise becomes many synchronized changes.

Management access should originate only from hardened administrative workstations or jump hosts. It should use separate privileged identities, MFA where the technology supports it, session recording, and narrow destination policy. Ordinary user networks, application servers, and general VPN users should not be able to address management interfaces at all.

CISA’s guidance for industrial remote access stresses that no single remote-access solution provides adequate protection without defense in depth. That principle matters most when the remote-access product itself becomes the attack path.

Make Default Credentials And Shared Secrets Unusable

CERT Polska documented default credentials on RTUs, controllers, HMIs, and serial device servers. It also found evidence of repeated credentials across sites.

Credential hygiene is necessary, but the network should reduce what a stolen credential can do.

For legacy assets that cannot support modern identity controls:

block their management interfaces from normal process and user networks;
allow management only from named engineering stations or jump hosts;
restrict protocol, source, destination, and time window;
use unique device or site credentials stored in a controlled vault;
monitor every attempted connection to a management port;
disable unused services such as FTP, web administration, RDP, and SMB;
prevent the device from initiating unnecessary outbound traffic.

This is where microsegmentation becomes a compensating control. It cannot repair weak device authentication, but it can make the weak interface unreachable from most compromise points.

Test The Failure Case, Not The Diagram

An architecture diagram will show zones and firewalls. A useful validation exercise asks what happens when a trusted component is already lost.

Test at least these scenarios:

The Internet-facing VPN appliance is fully compromised.
A vendor account and its MFA session are stolen.
One engineering workstation is controlled by an attacker.
A domain administrator credential is compromised.
A cellular or private-APN-connected router is reconfigured.
One remote site uses a shared password that has leaked.
The central security console is unavailable during destructive activity.

For each scenario, measure reachable systems and permitted actions. Do not stop at rule review. Attempt the connection from representative source zones and confirm that the enforcement point logs the denial.

The desired result is not zero connectivity. OT has to operate. The desired result is bounded failure:

loss of the outer VPN does not expose controller management;
loss of one site does not expose peer sites;
loss of an IT domain account does not create an OT administration path;
loss of an HMI does not permit firmware changes to every RTU;
loss of one enforcement point does not remove every boundary;
loss of central monitoring does not disable local policy.

CISA’s Microsegmentation in Zero Trust guidance frames microsegments as protect surfaces built around risk, visibility, and control rather than inherited trust zones. OT is exactly where that distinction matters. A plant network is not trusted because it is a plant network. Every permitted path still needs an operational reason.

Containment Is An Availability Control

OT teams sometimes hear segmentation as a proposal to add fragility. Poorly designed segmentation can do that. An undocumented dependency blocked during production is not a security win.

The answer is to map real flows, stage policy, observe before enforcement, and test with operations and safety teams. NIST recommends temporarily allowing and recording communication between proposed segments when necessary to identify legitimate traffic before isolation rules are implemented.

Done properly, the result supports availability:

destructive actions cannot fan out across every reachable device;
recovery can focus on one site or function instead of the entire estate;
operators retain unaffected paths to monitor and control healthy systems;
incident responders can isolate a zone without improvising the architecture;
legacy devices gain protection without waiting for a firmware or hardware replacement.

The Polish attacks did not destabilize the national power system. EDR also stopped the attempted wiper deployment at the combined heat and power plant. Those outcomes matter.

But defenders should not build strategy around catching the final destructive command. The stronger design reduces how many systems the attacker can address before that command is ever issued.

Segmentation is real only when it survives the compromise of something trusted.

In OT, that is not just a lateral-movement control. It is part of keeping the process running.

Sources

This article was generated with the assistance of AI and reviewed by the author.

microsegment.io