Microsegmentation of the OT Network

Beyond coarse zones, every controller pair is placed in its own micro-perimeter, so lateral movement between two OT nodes requires an explicit allow rule that mostly does not exist.

Zones are not enough

Purdue levels stop north-south traversal but leave east-west movement inside a level open. An attacker who lands on one supervisory host will try to reach peers. Microsegmentation shrinks the perimeter to the individual workload: the magnet power-supply controller, the gas-injection controller, each diagnostic acquisition node, and each edge FPGA gets its own policy identity, and the default rule between any two is deny.

Identity-based, not IP-based

Rules are written against cryptographic workload identity (see zero-trust identity), not IP addresses, so re-cabling or DHCP churn cannot silently open a path. A flow is permitted only when the source identity, destination identity, port, and current plant mode all match an allow entry.

In the matrix above the four workloads are, in order, the L1 shape controller, the magnet supply, the gas-injection node, and the historian. Note the historian (last column) receives from many but originates to none - a sink, never a source into control.

Policy as code

# Microsegmentation allow-list evaluated per connection
def permit(flow, plant_mode):
    rule = policy.lookup(src=flow.src_id, dst=flow.dst_id, port=flow.port)
    if rule is None:
        return DENY                      # default deny
    if plant_mode not in rule.modes:     # e.g. no reconfig during a discharge
        return DENY
    audit(flow, rule.id, plant_mode)     # every decision is logged
    return ALLOW

Design status

The policy engine and identity-keyed allow-lists run in the twin OT network. Enforcement points (host firewalls, smart NICs, switch ACLs) are specified for FOAK. The blast-radius intent - one compromised node cannot reach the interlock chain - is validated by simulation, not yet by an operating plant.