Zero trust is the essence of modern industrial network protection, bringing security away from the traditional perimeter to an asset-centric model. This shift is a recognition of the meaningful role that operational technology (OT) and other cyber-physical systems (CPS) have within critical infrastructure, and the need to authenticate and verify every asset and identity in these environments before any interaction with a physical process.
Zero trust is the evolution of identity and asset management emerging from Industry 4.0 and digital transformation. Connecting industrial control systems (ICS), building management systems (BMS), and smart internet-of-things (IoT) devices to enterprise networks and cloud services eliminated air-gapping as a security boundary. Instead, OT and CPS assets now absorb the attack surface of these new connections. A zero-trust architecture built on a never-trust-always-verify philosophy, bolstered by a least-privilege approach to authorization, ensures that only trusted assets, people, and data are granted access.
Anchoring Network Protection in Zero Trust Architecture
Zero trust eliminates trust-by-default security models and instead applies an approach that continuously verifies access requests, especially as threats, risks, and business needs change. This is key because static trust does not work, especially with the speed of today’s AI-powered threats. Immediate revocation of system access coupled with other controls such as threat detection and network segmentation can mitigate risks on an ongoing basis.
Let’s examine three key pillars of zero-trust architectures for CPS and OT environments:
1. Asset Visibility Foundational to Zero-Trust Network Protection
Critical infrastructure organizations understand the foundational importance of visibility into OT and CPS environments. Visibility informs the development and maintenance of asset inventories and overall asset management; it also illuminates machine-to-machine communication pathways that can be exploited by determined attackers. Security teams and engineers have an understanding of which systems can reach OT and CPS assets, known vulnerabilities impacting those systems, and whether there is a business reason for those assets to talk to one another.
Zero trust enforcement comes directly from visibility into asset behavior. Once legitimate communication paths have been established, zero trust can be used to restrict access only to users, assets, protocols, and applications necessary for a particular operation.
2. Continuous Threat Detection Alerts on Untrusted Behaviors
Zero trust works on the assumption that a breach has occurred and attackers have gained access to the OT and CPS environments. Continuous threat detection, therefore, is another facet of zero trust that provides visibility into known, trusted network behaviors, and alerts as to whether access should be revoked.
User actions that fall outside of policy or unexpected device behaviors can be detected in real time and correlated with known threats. This is an important facilitator of zero trust; the approach operates on the assumption that protection must follow an asset wherever it resides on the network, and reinforces the approach that security decisions are made based on real-time conditions.
3. Virtual Network Segmentation Mitigates Lateral Movement
Segmentation is the king of compensating controls. It is used to isolate sensitive systems and assets so that in the event of an incident, an attacker has limited ability to move deeper onto the network. It’s part of an overall zero-trust strategy that relies on asset visibility and management to identify machine-to-machine and user-to-machine communication in order to effectively limit the blast radius of an attack through isolation. Alerts from threat detection also inform decisions to isolate affected systems.
Specifically to OT networks, which are traditionally flat and allow north-south communication through levels of the Purdue Model architecture, a zero-trust strategy limits the ability of an attacker to abuse these established pathways, minimizing the available attack surface. This is an area where least-privilege enforcement and never-trust-always-verify stands out on the internal network, applying strict access controls and zero-trust principles rather than trusting all assets inside the perimeter.
Operationalizing Zero Trust and Network Protection
Zero-trust brings asset visibility, segmentation, access controls, continuous threat detection, and network monitoring together under one architecture. Every communication pathway is understood. Access is always verified. Critical processes are isolated through these controls. Every connection and action is intentional and verified.
Traditional network perimeter boundaries have been erased, and zero trust is a modern approach to network protection in CPS and OT environments. With AI ramping up vulnerability discovery and exploitation, zero trust within OT and CPS networks will be the face of security practices that ensure operational resilience.
