What zero trust means in a plant
Zero trust drops one assumption: that a connection can be trusted because of where it comes from. Instead, each request is authenticated and authorized on its own merits, and the network is designed on the assumption that some part of it may already be compromised. NIST SP 800-207 describes the general architecture. In an industrial plant the principle stands, but two things come first: safety and availability. A security control that can stop a production line is itself a risk.
Constraints you must design around
- Many controllers and HMIs cannot do certificate-based authentication or multifactor login.
- Control traffic can be time-sensitive and must not be delayed or dropped by an inspection device.
- Vendor-maintained equipment limits what you can change, and changes need maintenance windows.
Where a device cannot protect itself, use compensating controls around it.
Step 1: See what you have
You cannot restrict what you cannot see. Build a passive asset inventory and map the real communication flows: who talks to whom, on which port, how often. Do this before enforcing anything.
Step 2: Segment by zone and conduit
Group assets into zones by function and criticality and control the conduits between them, as described in the introduction to IEC 62443 and the Purdue model. Moving toward micro-segmentation, down to a cell or a machine, makes rules narrower: permit only the addresses, ports and, where the firewall can inspect it, the protocol functions that a flow really needs.
Step 3: Give people and services a verifiable identity
- Named accounts for engineers and operators; no shared logins.
- Multifactor authentication on engineering workstations, jump hosts and remote access.
- Certificates for services where the protocol supports them (for example OPC UA).
Step 4: Broker third-party access
Vendors and integrators should reach only the device they are working on, for an approved period, through a controlled entry point that records the session. See secure remote access for legacy equipment and the session checklist.
Step 5: Verify continuously
Monitor flows against the baseline, and alert on a new device, a new flow, a changed firmware version or a configuration that no longer matches the approved one. Verification is what turns segmentation from a one-time project into a control.
Pitfalls
- Enforcing before learning. Blocking flows you have not mapped breaks processes. Start in monitor mode.
- Inline devices without a failure decision. Decide whether a failed inspection device fails open or closed, and test it.
- Assuming an air gap. Most plants have connections nobody listed: modems, laptops, USB media (removable media risks).