Most NWA manufacturers run two parallel worlds: the office side of the business — email, accounting, ERP — and the plant floor, where PLCs, SCADA systems, and industrial controllers keep production moving. The problem is that far too many facilities have these worlds connected to the same flat network. One compromised laptop in HR can become a direct path to a production line CNC machine.
Network segmentation changes that. It’s one of the highest-impact security measures a manufacturer can implement, and yet it remains widely misunderstood or underused. This guide explains what it is, how it works, and how to implement it without grinding operations to a halt.
What Is Network Segmentation?
Network segmentation is the practice of dividing your network into separate zones — or segments — so that devices in one zone cannot freely communicate with devices in another without deliberate, controlled permission.
Think of it like the compartments on a naval vessel. If one compartment floods, sealed bulkheads keep the water from spreading. On a flat network, a breach spreads freely. On a segmented network, it hits a wall.
In manufacturing, segmentation typically separates:
- Corporate IT — workstations, email servers, file shares, business applications
- Operational Technology (OT) — PLCs, SCADA servers, HMIs, industrial sensors
- Guest/contractor Wi-Fi — vendor laptops, mobile devices, IoT devices
- Production networks — machine-to-machine communication within a production cell
Why Flat Networks Are a Liability for Manufacturers
A flat network is one where every device sits on the same network segment with no meaningful barriers between them. In the early days of industrial computing, this was the norm — plants weren’t connected to the internet, so internal threats weren’t a major concern.
That’s no longer the world we live in. Today, virtually every NWA manufacturer has some level of internet connectivity. Remote monitoring, vendor support tunnels, cloud ERP integrations, and remote access for engineers are all standard. Each of these connections is a potential entry point.
Once an attacker is inside a flat network, lateral movement is trivial. They can scan every device on the network, probe for vulnerabilities, and reach your industrial control systems with the same ease as they’d reach the printer in the break room.
The consequences of an OT network breach are severe:
- Production shutdowns that cost thousands of dollars per hour
- Damage to equipment from unauthorized commands
- Safety incidents from manipulated sensor data
- Ransomware infections that encrypt both business and production systems simultaneously
How Network Segmentation Works: The Basics
At its core, segmentation is implemented using a combination of:
VLANs (Virtual Local Area Networks) — Traffic is tagged so that devices in different VLANs can’t communicate directly, even if they share the same physical switches. VLANs are inexpensive to implement if your existing switch hardware supports them.
Firewalls — A firewall sits between network zones and enforces rules about what traffic is allowed to pass. A stateful firewall understands context — it doesn’t just look at ports and protocols, it tracks the state of connections and can make smarter decisions.
Demilitarized Zones (DMZ) — A DMZ is a middle zone that contains systems that need to communicate with both the IT and OT sides. A historian server that collects production data and sends it to the ERP is a classic example — it belongs in a DMZ rather than directly on either the corporate or plant floor network.
Access Control Lists (ACLs) — Rules configured at the router or switch level that restrict which hosts can communicate with which other hosts, regardless of VLAN membership.
A Practical Segmentation Model for NWA Manufacturers
Here’s a segmentation architecture that works well for small to mid-sized manufacturers in Northwest Arkansas:
| Zone | What Lives Here | Traffic Rules |
|---|---|---|
| Corporate IT | Workstations, email, ERP client, file servers | Internet access allowed; OT access blocked by default |
| OT/ICS | PLCs, HMIs, SCADA, industrial sensors | No internet access; no inbound from IT except defined paths |
| DMZ | Historian servers, remote access jump hosts | Controlled access to both IT and OT; logging mandatory |
| Guest/Contractor | Visitor Wi-Fi, vendor devices | Internet only; all internal zones blocked |
| Management | Network switches, firewalls, UPS management | Isolated; accessible only by IT admins from defined hosts |
The key principle: default-deny. If you haven’t explicitly allowed a communication path, it’s blocked. This is the opposite of most flat networks, where everything is allowed unless explicitly denied.
The IT/OT Convergence Challenge
One of the biggest obstacles to segmentation in manufacturing is that IT and OT have traditionally been managed by different teams with different priorities. IT focuses on confidentiality, availability, and patch cycles. OT prioritizes uptime above almost everything else — patches that require reboots of SCADA systems are often deferred for months or years.
Segmentation has to account for this reality. Here’s what that looks like in practice:
-
Map existing communication flows before you segment. You can’t write firewall rules for connections you don’t know exist. Before implementing segmentation, spend time with your operations team documenting what communicates with what — which engineer laptops access which PLCs, which servers pull historian data, which vendor connections come in and where they land.
-
Start with a permissive ruleset, then tighten. A common mistake is implementing overly restrictive rules from day one, then spending weeks troubleshooting production issues caused by blocked traffic. It’s better to segment first with generous rules, monitor what traffic is actually flowing, and then tighten incrementally.
-
Create a change control process. Once the network is segmented, any new communication path needs to go through a formal approval process. This prevents well-intentioned “temporary” exceptions from becoming permanent security holes.
-
Plan for vendor remote access. Many plant floor vendors require remote access to support and maintain equipment. That access should land in a jump host or bastion server in the DMZ — never directly on the OT network. Time-limited access with monitoring and logging is the standard.
Common Segmentation Mistakes to Avoid
Segmenting only at the network boundary, not internally. Many facilities implement a firewall between IT and OT but leave the OT network itself completely flat. A breach that lands inside the OT zone can still spread freely to every PLC and controller on the plant floor.
Skipping documentation. Segmentation without documentation is just complexity without control. Every firewall rule should be documented with a business justification, an owner, and a review date.
Neglecting wireless. Plant floor Wi-Fi is an expanding attack surface. Handheld barcode scanners, tablets used by operators, and condition-monitoring sensors all require wireless access. If this traffic isn’t segmented onto a dedicated wireless VLAN with appropriate restrictions, it becomes a soft entry point to the OT network.
Forgetting about legacy systems. Many NWA manufacturers run equipment that’s 15 or 20 years old — older than modern network security practices. These systems often can’t be patched or updated, which means they need to be isolated behind strict firewall rules that limit their exposure, not left on a flat network where they’re one hop from everything else.
What Does Proper Segmentation Require?
Implementing segmentation in a manufacturing environment doesn’t require replacing your entire network infrastructure, but it does require:
- Managed switches that support VLANs (unmanaged switches cannot enforce segmentation)
- A next-generation firewall capable of stateful inspection and application-layer filtering — not just a consumer-grade router
- Network documentation — an accurate map of what’s connected where and what needs to talk to what
- Staff or managed IT support to configure, monitor, and maintain the segmented environment
For most small manufacturers in the Rogers, Bentonville, Fayetteville, or Springdale area, this work is best handled by a managed IT provider with OT/IT convergence experience. The configuration complexity isn’t insurmountable, but getting it wrong can cause production downtime — and getting it right requires understanding both network engineering and manufacturing operations.
Measuring the Security Improvement
After implementing segmentation, you should be able to answer yes to all of the following:
- If ransomware encrypts every workstation in the office, can production continue?
- If a vendor’s remote access is compromised, is the blast radius limited to a single zone?
- If an unauthorized device connects to your guest Wi-Fi, can it reach a PLC?
- Do you have logs showing every connection that crosses a zone boundary?
If any of those answers are currently “no” or “I don’t know,” network segmentation should be near the top of your IT security roadmap.
Getting Started
You don’t have to implement full segmentation across your entire facility in a single project. A phased approach works well:
- Phase 1: Separate guest/contractor Wi-Fi from the corporate network and OT network
- Phase 2: Create a dedicated OT VLAN and deploy a firewall between corporate IT and the plant floor
- Phase 3: Implement a DMZ for shared services (historian, remote access jump host)
- Phase 4: Segment the OT network itself by production cell or criticality level
Each phase delivers security improvement on its own. You don’t need to wait for phase four before you start getting value.
Ready to build a segmented network that keeps your plant floor protected? Get in touch.