How do you segment a network without stopping production?

In two stages: the filters first go in observation only, meaning the rules are written but everything still passes while the traffic that would have been blocked is logged, and only then is blocking switched on zone by zone, starting with the least critical and inside an agreed window. A few weeks of that log reveal the flows nobody had documented, typically a printer, a licensing system or the business application's link to an archive. Blocking switched on blind cuts exactly the legitimate flows nobody knew existed, and those only surface by watching.

What is the difference between VLANs and network segmentation?

A VLAN separates traffic at the link layer; segmentation adds the filter that decides what may cross from one zone to another, and without that filter a VLAN remains an administrative tidy-up. In most corporate networks every VLAN is then routed on the same device with no rule between them, and an intruder moves from one to the next as if it were not there. Separation exists only where two zones meet at a control point that denies by default, allows just the required ports and logs what it refuses.

What is network segmentation?

Splitting a network into separate zones with controlled crossing points, to limit how far an intruder can reach after the first access.

Network segmentation is the division of an infrastructure into separate zones, with crossings allowed only where they are needed and denied by default everywhere else. The goal is not to prevent the first access, which sooner or later happens, but to limit how far an intruder can reach once inside: if the purchasing office workstation has no route toward the plant controllers, a compromised machine in administration stays a local problem instead of becoming a production stoppage. Technically it is built with networks separated at the link layer, filters applied between zones and rules written one for each authorized flow. The concept is as old as corporate networks, but it has become central again for two concrete reasons: ransomware spreads by moving laterally, and the industrial world is full of equipment that cannot be updated.

See also: IEC 62443 · A family of industrial cybersecurity standards that assigns distinct parts to product supplier, integrator and asset owner.

How segmentation is done in practice

The first step is not technical, it is an inventory exercise: knowing which systems talk to which, in what direction and for what reason. Without that list every rule is born permissive so as not to break anything. From there zones are defined by function and criticality, offices, business applications, production, exposed services, systems management, along with the crossing points between them, each with a filter allowing the required ports and blocking the rest. Microsegmentation takes the same principle down to single-workload granularity, applying rules to a service identity instead of an IP address. In the industrial world the reference is the zones and conduits model of the IEC 62443 family, which formalizes the same reasoning for plants and splits responsibility between manufacturer, integrator and operator.

The machines that cannot be updated

This is the case that makes segmentation non-negotiable. A three-hundred-thousand-euro CNC milling machine bought in 2011 runs an operating system out of support for years, and it cannot be updated for three reasons no IT department can solve: the vendor releases nothing any more, the control software is certified only on that version, and touching the configuration voids the warranty on the machine. The correct answer is neither to update, which is impossible, nor to give up: it is to isolate. A dedicated zone with no Internet access, communication allowed only toward the data collection server and only on one port, program transfers through a controlled path instead of the maintenance technician's USB stick, and vendor remote access opened on request and for the duration of the job. The vulnerability remains, but the surface from which it can be reached shrinks to almost nothing. In jargon this is a compensating control, and it is the most concrete form of risk treatment available on a factory floor.

What segmentation does not do

It does not stop phishing, it does not prevent the use of valid stolen credentials, and it defends nothing if the rules between zones end up permitting any traffic. The typical way it dies is not an attack: it is the temporary exception granted to a supplier on a Friday afternoon and never revoked. Which is why a segmentation is worth as much as the process maintaining it, with periodic rule review, automatic expiry for exceptions and a declared owner for every crossing point.

Then there is the case that overturns the result of a well-built segmentation: the machine builder's permanent remote assistance. A 4G router or a remote control program left behind by the service engineer at installation, with an outbound tunnel always up and often written into the warranty terms. No rule between zones catches it, because the connection starts from the inside; and if it runs over a data SIM the machine is not even on the company network, so there is nothing to segment. That connection has to be removed, or funnelled through a single controlled point of access: a jump host with multi-factor authentication, time-limited enablement and session recording. On new machines this belongs in the purchase contract as a clause, before commissioning.

Why it matters for decision makers

It is the intervention with the best ratio between cost and damage reduction in a manufacturing company, because it acts on the extent of an incident rather than its probability, and because it also protects what cannot be fixed. It sits upstream of detection: EDR, XDR and MDR tools see what is happening, segmentation decides how far it can happen. And it is the infrastructural pillar a Zero Trust design actually rests on, besides being one of the measures explicitly expected from organizations inside the NIS2 scope.