Segmentation, and what it does not solve

Separating the environment into parts that cannot freely reach each other

The shop floor on one network, the office on another, covered work in an enclave, with controlled crossings. It is the single most common architectural response to the requirement and it is usually correct.

Four things

Reduces the boundary, which reduces every cost in the programme. Limits what an intrusion in one part reaches. Allows equipment that cannot be secured to sit behind something that can. And makes the boundary describable, which is what the documentation needs.

Four things it is frequently believed to solve

It does not remove machines from scope if they still handle covered information. Segmentation changes what reaches them, not what they hold.

It does not stop the file arriving by hand. A network boundary is not a data boundary while there is a memory stick, which is why the entry on removable media sits beside this one.

It does not survive a flat management network. Segmented production networks administered from one workstation with access to everything have moved the problem to the workstation.

It does not document itself. An assessor needs the diagram, the rule set and the evidence that the rules are what the diagram says.

By function, not by convenience

Machines handling covered work in one zone, machines that do not in another, and the crossing points few and defined. Where mixed use is unavoidable, treat the zone as covered rather than attempting a distinction that cannot be shown.

The commonest mistake is segmenting by physical location because the cabling already runs that way, which produces zones that do not correspond to what the machines do.

Where files enter the production zone

One defined path, with authorisation and a record. This is the point the entry on technical data describes as governing the package rather than the perimeter, and it is where the two ideas meet.

Where there are three crossings because three teams needed one, there is effectively no boundary.

Test it rather than assuming it

Attempt to reach an in-scope system from an out-of-scope one and record the result. Do this after any change to the network.

Segmentation is believed to be in place far more often than it is, and the gap is usually a rule added for a project three years ago and never removed.

Three artefacts

A diagram showing zones and crossings. The rule set, exported. And the test results with dates.

Those three together demonstrate the control operating, which is what distinguishes an implemented control from an intended one throughout this section.

The network that ignores your zones

Wireless coverage rarely respects the segmentation drawn for the wired network, and a guest network reaching production areas is a crossing nobody drew.

Include wireless in the diagram and in the verification, or the diagram describes half the environment.

What segmentation actually costs

Usually switching hardware, some cabling, a firewall or two, and configuration time. For a single-site manufacturer this is a modest capital item and the least glamorous line in the budget.

It is also the line that reduces every other line, which is worth stating when it is challenged.

The rule that was added for a project

Every rule set accumulates them. Each should have a stated reason, an owner and a review date, and the ones that have none are the ones the verification exercise finds.

An annual review removing dead rules takes an hour and is the cheapest way to keep a diagram truthful.

One zone, correctly, before three

Separate the production floor from everything else and get that crossing right. It delivers most of the benefit, it is achievable in weeks, and it teaches the organisation what a crossing costs before it commits to several.

Elaborate zone models designed on paper before anybody has operated one tend to be simplified within a year, in production, by people under pressure.

Elsewhere in the shop floor

• What the three levels are, and which appliesThe level is set by your contract, not by your size. Most suppliers handling controlled unclassified information are at the second.
• Reading the clause that binds youReading the clause that binds you. What the requirement says, what it means in practice, and what an assessor will ask.
• Which systems are in scopeWhich systems are in scope. What the requirement says, what it means in practice, and what an assessor will ask.
• Self-assessment, and why the scores driftedSelf-assessment, and why the scores drifted. What the requirement says, what it means in practice, and what an assessor will ask.
• Who assesses you, and how each kind worksWho assesses you, and how each kind works. What the requirement says, what it means in practice, and what an assessor will ask.
• What the standard does not requireWhat the standard does not require. What the requirement says, what it means in practice, and what an assessor will ask.
• Machines older than the requirementsA control written for a server, applied to a lathe with a shared login, a decade-old operating system and a USB port.
• Drawings, job packets and paperDrawings, job packets and paper. What the requirement says, what it means in practice, and what an assessor will ask.
• Removable media, and why bans failRemovable media, and why bans fail. What the requirement says, what it means in practice, and what an assessor will ask.
• Vendor remote accessVendor remote access. What the requirement says, what it means in practice, and what an assessor will ask.
• Technical data packages and what they containTechnical data packages and what they contain. What the requirement says, what it means in practice, and what an assessor will ask.
• What insider risk actually coversWhat insider risk actually covers. What the requirement says, what it means in practice, and what an assessor will ask.
• What detection can and cannot establishWhat detection can and cannot establish. What the requirement says, what it means in practice, and what an assessor will ask.
• Monitoring, and where the law constrains itMonitoring, and where the law constrains it. What the requirement says, what it means in practice, and what an assessor will ask.
• The fortnight around a departureThe fortnight around a departure. What the requirement says, what it means in practice, and what an assessor will ask.
• Privileged access, and who reviews itPrivileged access, and who reviews it. What the requirement says, what it means in practice, and what an assessor will ask.
• False positives, and what they costFalse positives, and what they cost. What the requirement says, what it means in practice, and what an assessor will ask.
• The documents an assessor reads firstThe documents an assessor reads first. What the requirement says, what it means in practice, and what an assessor will ask.
• What counts as evidenceWhat counts as evidence. What the requirement says, what it means in practice, and what an assessor will ask.
• The findings that recurThe findings that recur. What the requirement says, what it means in practice, and what an assessor will ask.
• Plans of action, and their limitsPlans of action, and their limits. What the requirement says, what it means in practice, and what an assessor will ask.
• What the assessment week is likeWhat the assessment week is like. What the requirement says, what it means in practice, and what an assessor will ask.
• The certificate, and what it coversThe certificate, and what it covers. What the requirement says, what it means in practice, and what an assessor will ask.