Only 13% of OT Network Segments Are Fully Isolated: Analysis
A new study by Forescout found that only 13% of operational technology (OT) network segments are fully isolated, with most OT devices sharing space with IT or IoT equipment. This lack of isolation creates significant security risks, particularly in industries like utilities, healthcare, and oil and gas. Forescout recommends improved visibility, device inventory, and segment restructuring to mitigate these vulnerabilities.
A recent study by Forescout’s Vedere Labs revealed that a substantial portion of operational technology (OT) network segments are not adequately isolated, despite the critical importance of securing these systems. Researchers analyzed data from 47,700 network segments across 209 organizations, categorizing devices into IT, OT, IoT, and medical (IoMT) categories. The study indicated that 62% of segments contained devices from a single category, with IT devices alone accounting for 54% of segments, and paired with IoT gear 26%.
However, when examining segments containing at least one OT device, only 13% consisted of OT devices alone, while IoMT segments fared even worse, with just 6% dedicated solely to IoMT. IP cameras emerged as the least isolated device type, appearing in 2,266 segments, representing approximately 5% of the total, with only 2% of those segments containing cameras exclusively.
The average segment held 54 devices across four different device types, and the average device belonged to 1.5 segments. A significant 11% of segments exceeded 51 devices, and 17% were single-device ‘micro-segments’. Industries like business and professional services, healthcare, and oil and gas exhibited the largest average blast radius.
Forescout recommends a strategy focused on visibility and containment rather than a complete network redesign. Key recommendations include building a comprehensive inventory of connected devices, identifying segments where risky device types converge, moving critical OT and IoMT systems off general IT networks, breaking up oversized segments, and restricting unnecessary traffic between segments. The full report is available on Forescout’s website.