Zero Trust for OT: Identity-Based Security in Industrial Environments
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
Zero Trust for OT: Identity-Based Security in Industrial Environments
Zero trust adoption in OT environments grew by 34% in 2024, driven by the failure of perimeter-based security models that assume internal network trust once the IT/OT boundary is crossed (Forrester, 2024). With 96% of OT incidents originating from IT networks, the perimeter model's assumption that OT-internal traffic is trusted has proven incorrect in the majority of industrial incidents. Zero trust for OT applies the core principle, verify every access request regardless of network location, to industrial environments that were never designed for identity-based security. This guide explains how zero trust adapts for OT constraints and where the model requires modification.
Key Takeaways
- Zero trust for OT replaces implicit network trust with explicit verification of every access request, reducing lateral movement opportunity.
- Most OT devices can't support identity agents; zero trust for OT operates primarily at the network layer and application layer (HMIs, SCADA).
- Identity management for human access (engineers, operators, vendors) is the highest-value zero trust application in OT.
- Microsegmentation using IEC 62443 zones and conduits implements zero trust network principles without requiring device-level identity.
- Zero trust adoption in OT grew 34% in 2024; organizations applying it report 45% reduction in lateral movement during incidents (Forrester, 2024).
Zero trust is not a single technology. It is a security philosophy implemented through a combination of identity management, access control, network segmentation, and monitoring. The implementation approach for IT environments, centered on identity providers, endpoint agents, and policy-as-code, works poorly in OT because most OT devices can't run agents, don't have identity certificates, and can't participate in modern authentication protocols. Zero trust for OT requires a different implementation strategy that preserves the philosophy while adapting to industrial device constraints.
[UNIQUE INSIGHT: The most practical path to zero trust in OT is not starting with OT devices, which can't support zero trust natively. It's starting with human access to OT systems. Engineers, operators, vendors, and remote maintenance staff who access OT systems can be subjected to modern zero trust controls (identity verification, device health checks, session recording, just-in-time access) without touching OT devices. Securing human access to OT first delivers 80% of the zero trust security benefit in OT environments while the harder problem of OT device identity is addressed incrementally.]
What Does Zero Trust Mean in an OT Context?
In IT, zero trust means: never trust, always verify. No user or device is trusted based on network location alone. Every access request is authenticated, authorized against least-privilege policies, and logged. In OT, zero trust means the same thing, but the implementation must account for three OT-specific realities. First, OT devices often can't authenticate: PLCs, RTUs, and many field devices don't support certificates, MFA, or modern authentication protocols. Second, OT communication patterns are deterministic: unlike IT environments where communication patterns are fluid, OT devices communicate with a small, predictable set of peers using specific protocols. This determinism enables zero trust implementation through network policy rather than device identity. Third, availability constraints limit how aggressively trust can be revoked: cutting off a PLC's network access mid-process for failed authentication could cause a safety event.
Zero trust for OT therefore operates primarily at three control points rather than at the device level. Human access control: all humans accessing OT systems are subjected to identity-based access controls. Network access control: all OT network communications are defined by explicit allow policies (zone and conduit rules); anything not explicitly permitted is denied. Application access control: SCADA, HMI, and historian applications enforce role-based access with individual user identities rather than shared accounts.
How Do You Implement Identity Management for OT?
OT identity management covers three populations: internal staff (operators, engineers, IT security), third-party vendors, and automated system accounts. Each requires different identity management approaches. Internal staff should have individual accounts in a directory service (Active Directory or equivalent) with role-based access to OT systems calibrated to their specific responsibilities. No shared accounts should exist on OT systems, including HMIs where shared accounts are common for operational convenience. Individual accounts enable attribution of all actions to specific individuals, which is foundational for both security monitoring and incident investigation.
Third-party vendor access is the highest-risk identity management challenge in OT. Vendors require periodic access for maintenance, troubleshooting, and firmware updates. Traditional vendor access uses shared credentials and persistent VPN connections, creating access paths that are effectively unmonitored and uncontrolled. A zero trust approach to vendor access uses a dedicated vendor access platform (Claroty SRA, Xage, CyberArk Alero) that provides: just-in-time access provisioning (access granted only for the specific maintenance window); session recording of all vendor actions; granular access scoping (vendor A can access only the PLC they maintain, not all PLCs); and automatic access revocation when the window closes.
[IMAGE: Zero trust OT access control architecture diagram showing identity provider, policy engine, human access via jump server, and OT device access through network policy - search terms: zero trust OT architecture identity-based industrial security access control diagram]
Need expert help with zero trust for ot?
Our cloud architects can help you with zero trust for ot — from strategy to implementation. Book a free 30-minute advisory call with no obligation.
How Does Microsegmentation Apply Zero Trust Principles to OT Networks?
Microsegmentation is zero trust implemented at the network layer. Instead of trusting any traffic that's already inside the OT network, microsegmentation applies explicit allow policies to every network communication: only permitted source-destination pairs using permitted protocols can communicate. Everything else is denied. This is precisely the zero trust principle, never trust based on location alone, applied at the network layer rather than the identity layer. IEC 62443 zones and conduits provide the architectural framework for OT microsegmentation ([IEC 62443-3-3, 2013](https://webstore.iec.ch/publication/7033)).
Microsegmentation limits lateral movement dramatically. In a perimeter-based OT network where all OT devices share a flat network, an attacker who compromises one device can reach all other devices. In a microsegmented OT network, an attacker who compromises one device can only reach the devices that device is explicitly permitted to communicate with, which in a well-designed zone is typically one to three peer devices for operational purposes. This containment of lateral movement is the primary security benefit of zero trust for OT, directly reducing the blast radius of initial compromise.
Citation Capsule: Zero trust adoption in OT environments grew 34% in 2024, with organizations applying zero trust principles reporting 45% reduction in lateral movement during security incidents. The primary implementation approaches are human identity management for OT access and microsegmentation using IEC 62443 zones and conduits as the network policy framework (Forrester, 2024).
What Are the Challenges of Zero Trust in Legacy OT Environments?
Legacy OT environments present three primary challenges for zero trust implementation. Legacy protocol limitations: Modbus, DNP3, and many industrial protocols were designed without authentication. A Modbus master can't verify the identity of a Modbus slave, and a Modbus slave can't verify the authority of a command-issuing master. Zero trust at the protocol level requires either upgrading to protocols that support authentication (DNP3 Secure Authentication v5/v6, OPC UA with security enabled) or implementing authentication at the network layer through firewalls that restrict Modbus access to authorized source IPs.
Legacy device operating systems: many OT devices run Windows XP, Windows 7, or proprietary operating systems that don't support modern identity protocols (SAML, OAuth 2.0, certificate-based authentication). These devices can't participate in an identity-centric zero trust model at the device level. The compensating control is network-based zero trust: the device itself doesn't authenticate, but access to the device is controlled by network policy that limits connections to authorized sources. This is a weaker guarantee than device-level identity, but it provides meaningful protection without requiring device replacement.
Zero Trust for Remote Access to OT
Remote access to OT is the application where zero trust delivers the most immediate security improvement and faces the fewest legacy constraints. Remote access via zero trust network access (ZTNA) principles replaces VPN-based remote access with application-specific access controls. Instead of a VPN that places remote users on the OT network, ZTNA provides access only to the specific application (the SCADA server, the HMI, the historian) that the user is authorized to access, verified against their identity and device health posture. Vendors including Zscaler, Palo Alto Networks (Prisma Access), and Cloudflare Access provide ZTNA capabilities that can be applied to OT remote access with appropriate OT-specific configuration.
How Do You Build a Zero Trust Roadmap for OT?
A zero trust roadmap for OT follows a five-stage sequence that prioritizes high-value, low-disruption improvements first. Stage 1: establish asset inventory (you can't apply zero trust policies to devices you don't know about). Stage 2: implement identity management for human access to OT, starting with vendor access (highest risk) and expanding to internal user accounts. Stage 3: deploy microsegmentation at the IT/OT boundary and between major OT zones. Stage 4: implement microsegmentation within OT zones and apply protocol-aware access policies. Stage 5: address device identity for OT devices that support it and apply continuous monitoring to verify policy compliance.
The roadmap takes 18-36 months to complete for most mid-to-large industrial organizations. Stages 1-2 can be completed in 6-12 months and deliver immediate security improvement for the human access attack vectors that are most commonly exploited. Stages 3-5 require engineering planning and change management coordination with OT operations teams and typically follow in subsequent 12-month phases.
Frequently Asked Questions
Is zero trust compatible with OT's real-time communication requirements?
Yes, when implemented at the network layer rather than the application layer. Zero trust network policies (microsegmentation using VLANs and firewalls) add no latency to permitted communications: a firewall rule that permits a Modbus read request from the SCADA server to a PLC doesn't add measurable latency to the communication. Application-layer zero trust controls (MFA for HMI login) add latency only to the login event, not to ongoing communications. Real-time control communications are not affected by network-layer zero trust implementations when properly designed ([NIST Zero Trust Architecture SP 800-207, 2020](https://doi.org/10.6028/NIST.SP.800-207)).
Can ZTNA replace VPN for OT remote access?
ZTNA can replace VPN for OT remote access to specific applications (SCADA web interfaces, remote desktop to engineering workstations, historian access). It cannot replace VPN for OT remote access that requires direct network-layer connectivity to OT devices (such as PLC programming connections that require direct Ethernet connectivity to the PLC's programming port). A hybrid model is common: ZTNA for application-layer OT access, with jump servers providing controlled, recorded sessions for direct OT device connections.
What is the difference between zero trust and network segmentation for OT?
Network segmentation (IEC 62443 zones and conduits) creates boundaries that limit where traffic can go. Zero trust adds a policy layer to those boundaries: traffic isn't just limited by network location, it must be explicitly authorized by identity and context. Zero trust for OT builds on network segmentation rather than replacing it. Segmentation provides the architectural boundaries; zero trust policy provides the verification layer within and across those boundaries. The two approaches are complementary and both are required for a mature OT security posture.
Conclusion
Zero trust is the right security philosophy for OT environments, but its implementation must be adapted to OT constraints rather than imported wholesale from IT. OT devices can't support identity agents; the zero trust model applies through network policy, protocol-aware access controls, and human identity management at the access points that do support modern security. The 34% growth in OT zero trust adoption in 2024 reflects organizations finding practical implementation paths that deliver the lateral movement reduction benefit without requiring OT device replacement.
The starting point is human identity management for OT access: every person who touches OT systems should have an individual, audited identity with access scoped to their specific responsibilities. This single improvement addresses the human access attack vectors that are most commonly exploited in OT incidents and establishes the identity infrastructure needed to extend zero trust principles further into the OT environment over time.
Related Articles
About the Author
Group COO & CISO at Opsio
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
Editorial standards: This article was written by a certified practitioner and peer-reviewed by our engineering team. We update content quarterly to ensure technical accuracy. Opsio maintains editorial independence — we recommend solutions based on technical merit, not commercial relationships.
