Why it matters in practice
Within OT and ICS Security, Segmentation, Safety and Process Manipulation changes how scope, prerequisites and evidence should be handled. Focus on the concrete asset or data flow under test, record the assumptions that make the condition exploitable and connect verified behavior to an operational consequence and remediation decision.
Primary coverage
- Validate network boundaries with actual path testing, not with diagrams alone.
- Identify vendor tunnels, jump hosts, dual-homed systems and historian links that blur process boundaries.
- Think in terms of safety degradation, view manipulation and process drift, not only in terms of shell access.
- Write findings in language that operations teams can action without guessing the consequence.
Assessment focus
For Segmentation, Safety and Process Manipulation, document the starting condition, tested action, observable result and any constraint that limited validation. Separate what was proven from what remains inferred, then tie each recommendation to the control boundary described in the evidence.
Selected public references
- CISA ICS Recommended PracticesSegmentation and operational hardening guidance.
- SANS ICSOperational ICS security references.
- MITRE ATT&CK for ICSTechnique framing for process manipulation and control.