By Cyber Defense Technologies November 3, 2026 4 min read
November is Critical Infrastructure Security and Resilience Month, when CISA and its partners focus on the systems that keep power, water, manufacturing and transportation running. Much of that work comes down to one place: the boundary between the business network (IT) and the operational technology (OT) that controls physical processes.
We covered the fundamentals of OT security in Securing Operational Technology and Embedded Systems and the strategic threat in Pre-Positioning in Critical Infrastructure. This article focuses on the boundary itself: how attackers cross it, and how to design it so they cannot.
Why the boundary matters most
Attacks that go straight from the internet to a controller are rare. Far more often, an attacker compromises the business network through phishing, a stolen password or an unpatched edge device, then looks for a way into OT. The crossing points are usually ordinary:
- Remote access set up for vendors or engineers, sometimes years ago and never reviewed.
- Shared identity, where the same Active Directory domain controls both IT and OT accounts.
- File transfers for recipes, firmware, historian exports and reports.
- Dual-homed systems, such as an engineering workstation with one network card on each side.
- Flat networks, where IT and OT were never truly separated.
Every one of these is a business convenience. The goal is not to remove convenience, but to make each crossing deliberate, narrow and watched.
Design: put a DMZ between the two worlds
The common reference model places an industrial demilitarized zone (often called Level 3.5) between the enterprise network and the control network. The principle is simple: no traffic passes directly between IT and OT. Each side talks only to systems in the DMZ.
Systems that belong in the DMZ include:
- A historian replica that business users query, so they never touch the plant historian.
- Jump hosts for remote access into OT.
- Patch and antivirus staging servers that pull updates from IT and serve them to OT.
- File transfer services that scan and log everything moving across.
Firewall rules on both sides of the DMZ should be written as explicit allow-lists, reviewed on a schedule and logged. Where data only needs to flow out of OT, a one-way gateway (data diode) enforces that in hardware.
A defensible IT/OT boundary
-
Enterprise network
Business systems, email and users. Never talks directly to OT.
-
Industrial DMZ
Historian replica, jump hosts, patch staging and file transfer, behind allow-list firewalls.
-
Operations network
Plant historian, engineering workstations and operator consoles.
-
Control network
Controllers, safety systems and field devices.
Control remote access
Remote access is the most common way into OT and the one most worth getting right.
- One path in. All remote access, including vendors, goes through a single jump host or remote access platform in the DMZ. No vendor-installed modems, cellular routers or remote desktop tools on OT systems.
- Strong authentication. Use phishing-resistant MFA for every remote session.
- Approval and time limits. Vendor sessions are enabled for a specific window and a specific task, then disabled.
- Recording. Sessions into OT are recorded so you can review exactly what was done.
Separate identity
If an attacker who gains domain administrator rights in IT also gains control of OT, the boundary does not exist. Give OT its own identity domain, or use local accounts managed carefully, with no trust relationship to the enterprise domain. Administrators should use separate accounts for each side.
Remove hidden bridges
Look for connections nobody drew on the diagram:
- Engineering laptops that move between networks.
- Backup systems that reach into both IT and OT from one server. If ransomware reaches that server, it reaches both sides and your backups.
- Monitoring or management tools with agents on both sides.
- Wireless access points and cellular modems added for a project and left in place.
Asset discovery that uses passive network monitoring is the safest way to find these in OT, where active scanning can disrupt fragile devices.
Watch the boundary
A boundary you cannot see is a boundary you cannot defend. At a minimum:
- Log every firewall decision at the DMZ, and alert on denied attempts from IT to OT.
- Monitor jump hosts and file transfer systems as high-value assets.
- Use OT-aware network monitoring to establish what normal traffic looks like, then alert on new connections, new protocols and new devices.
Questions to ask this month
- Can you draw every connection between IT and OT from memory? Does the drawing match reality?
- How many ways can a vendor reach a control system, and who approves each session?
- Does any account or server have authority on both sides?
- Would ransomware on the business network reach your OT backups?
- When did someone last test the boundary from the IT side?
How CDT can help
CDT's secure architecture team designs and reviews IT/OT boundaries, and our embedded and OT security specialists assess control environments without disrupting operations. Our penetration testing team can test the boundary from the business side, the way an attacker would.
