A Network Segmentation Checklist After the Siemens PLC Advisory

CISA's advisory on the Siemens PLC threat recommends network segmentation as a top mitigation — genuinely correct guidance, but high-level. Here's a practical, hands-on checklist for engineers actually implementing that recommendation, not just acknowledging it.

Starting With a Real Inventory, Not an Assumed One

CISA's first recommendation — inventory all Siemens S7 Series PLCs — sounds basic but is frequently incomplete in practice: PLCs added by contractors, integrators, or legacy installations outside the current IT team's direct knowledge are a common, genuine gap, and segmentation work built on an incomplete inventory leaves real exposure that looks addressed on paper.

A Practical Segmentation Checklist

• Conduct an active network scan specifically for PLC and industrial protocol traffic (not just relying on an asset management system that may already be stale) to catch devices missing from documented inventory
• Verify zero direct internet accessibility for every identified PLC — not just "should be behind a firewall" as a policy statement, but an actual, tested confirmation from outside the network
• Implement genuine network-layer segmentation (VLANs, dedicated OT network segments, industrial firewalls) between IT and OT networks, not just access-control-list rules on a shared network — segmentation needs to survive a compromised IT-side credential, not just casual unauthorized access
• Test segmentation effectiveness with an actual internal red-team exercise attempting to reach OT systems from a compromised IT starting point — untested segmentation is a documented intention, not a verified control