Network Segmentation Best Practices for IoT/OT Security

Network segmentation divides your network into smaller zones so a compromised device cannot reach the rest of your environment. That matters because attackers move fast. CrowdStrike’s 2026 Global Threat Report puts average breakout time at 29 minutes, while IBM reports an average of 247 days to identify and contain a breach.

Here's what this article covers:

See why segmentation limits damage, but never replaces device security
Compare macro segmentation with micro segmentation before choosing a scope
Map the zones most networks miss on their first pass
Turn real device traffic into policy instead of best guesses
Avoid the mistakes that stall segmentation projects before launch

What Network Segmentation Limits

When an attacker compromises one device, segmentation prevents that access from spreading to other systems on the network. The National Institute of Standards and Technology frames this differently than a traditional network boundary.

Its Zero Trust Architecture standard, SP 800-207, states that security posture should attach to "resources (assets, services, workflows, network accounts, etc.), not network segments." Location alone no longer defines the boundary. Segmentation narrows what an attacker can reach, but it does not patch a vulnerable device, authenticate a user, or encrypt data in transit. Teams still need those controls.

Segmentation Limits	Segmentation Does Not Replace
Contains a breach to one zone	Patching a vulnerable device
Blocks unauthorized traffic between zones	Authenticating users and devices
Narrows audit scope for standards like PCI DSS and HIPAA	Encrypting data in transit

Macro Segmentation vs. Micro Segmentation

Macro segmentation splits a network into broad zones: IT, OT, guest Wi-Fi, and a demilitarized zone. Firewalls or VLANs separate these zones and enforce policy. Microsegmentation goes further, controlling traffic between individual devices or workloads within a single zone. A hospital network might use macro segmentation to separate clinical devices from guest Wi-Fi, then use micro segmentation to stop one infusion pump from reaching another.

Most organizations start with macro segmentation because it takes fewer policies to deploy. Micro segmentation takes more device-level visibility to set up, but it closes the gap macro segmentation leaves open: lateral movement within a single zone.

Attribute	Macro Segmentation	Micro Segmentation
Scope	Broad zones (IT, OT, DMZ, guest)	Individual devices or workloads
Enforcement Point	Firewalls and VLANs between zones	Policy applied per device or session
Typical Starting Point	First pass at IT/OT separation	Containing movement inside a zone
Visibility Required	Zone-level	Device-level

The Zones Most Networks Miss

A joint CISA advisory calls for defining the "acceptable communication conduits" between zones and placing security controls at those conduits. That forces an attacker into a small area rather than the entire network. Most organizations separate IT from OT early.

Fewer add a DMZ, and fewer still isolate IoT and medical devices in their own zone, even though these devices often can't run security agents or receive regular patches. CISA's OT mitigation guidance recommends a DMZ specifically for passing control data to enterprise systems. It keeps that data flow out of direct contact with the OT network.

Zone	What Lives There	Why It Stays Separate
IT Network	Laptops, servers, business applications	Highest exposure to phishing and external traffic
OT Network	Industrial controllers, building systems	Cannot tolerate downtime or active scanning
DMZ	Data historians, remote access gateways	Passes control data to IT without direct OT exposure
IoT and Medical Devices	Cameras, sensors, connected medical equipment	Often unpatched and unable to run security agents

Turning Device Traffic Into Policy

Writing policy based on assumptions rather than real traffic tends to block legitimate connections and stall the project. Teams get better results when they first observe how devices actually communicate, then write policy around that behavior. Four signals matter most when deciding how to segment devices and control communication:

Device identity: What the device is.
Communication patterns: Which devices and services it talks to.
Protocol behavior: Whether its traffic matches expected behavior.
Operational impact: What happens if the device goes offline.

Mapping these signals before writing a single policy rule prevents the two most common failures: too many exceptions, and too many outages.

Signal	What It Tells You
Device Identity	The device’s actual identity beyond its IP address
Communication Pattern	Which other devices and services it talks to
Protocol Behavior	Whether traffic matches expected, legitimate use
Criticality	What happens to operations if the device goes offline

Segmentation Mistakes That Stall Projects

Segmentation projects often stall because teams lack complete asset visibility, rely on outdated network assumptions, create policies before mapping dependencies, or underestimate enforcement's operational impact.

Mistake	Consequence	Fix
Grouping Zones by Department Instead of Function	High-risk and low-risk devices share a zone	Group devices by what they do and who they talk to
Writing Policy Before Mapping Traffic	Legitimate connections break and the project stalls	Observe real communication first, then write policy
Treating Segmentation as a One-Time Project	Zones drift as new devices join the network	Review and adjust zone membership on a set schedule
Skipping a DMZ Between IT and OT	One phishing email can reach industrial controls	Add a DMZ for any data crossing between networks

Build Segmentation Around Real Device Behavior

ORDR gives security teams the device visibility they need to segment networks with confidence. It identifies connected assets, maps how they communicate, and helps teams build policies around real traffic and device behavior, reducing lateral movement without disrupting critical operations. Contact us to see how ORDR supports network segmentation.