Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control need · Segmentation that holds

Your network diagram shows a boundary. Your cabling may not.

Segmentation is usually described as a set of zones and enforced as a set of rules. The two are not the same thing. If a credential, a misconfiguration or a forgotten route can carry traffic across a boundary, that boundary exists on the diagram rather than in the estate.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

What is exposed

A boundary you cannot demonstrate is a boundary you cannot rely on.

Where operational systems sit behind logical separation only, the exposure is easy to describe and uncomfortable to look at.

Unpatchable systems

Systems that cannot defend themselves

Controllers and instruments running unpatchable software were designed for isolation, then connected for visibility and reporting.

Inherited compromise

Shared administrative tooling

When identity, monitoring or jump servers span both sides of the boundary, a compromise on one side inherits the other.

Hidden crossings

Routes nobody documented

Engineering laptops, temporary links and supplier connections create crossings that never appear in the architecture record.

Physical consequence

Consequences measured physically

In operational environments, the outcome of a crossing is not data loss. It is production stoppage, safety risk and service failure.

Why the exposure exists

Convergence delivered real benefits and quietly removed the gap.

Operational networks were connected for good commercial reasons. The problem is that the protection they previously relied on was physical, and what replaced it was configuration.

The honest position

You cannot configure your way back to an air gap.

Firewalls, VLANs and rule sets are valuable, and they are still configuration. Configuration is changed by people, inherited from previous teams and occasionally wrong. A boundary that matters to safety and continuity deserves an enforcement mechanism that does not depend on a rule being correct on the day.

Control the path, protect the asset.

  • Reporting needed a routeProduction data had to reach the business, and the simplest way to deliver it was a permanent connection.
  • Remote support became standardEquipment vendors expect to reach their kit, and that expectation was met with standing access.
  • Rule sets accumulateFirewall policies grow over years until no one is confident about what any individual rule still permits.
  • Operational systems cannot be patched freelyAvailability requirements mean known vulnerabilities remain in place far longer than in corporate IT.
  • Two teams, two languagesIT and operations measure risk differently, so boundary decisions fall between the two.
  • The gap was never replacedWhen the air gap was removed, nothing physical was put in its place. Only policy was.

Which paths need controlling

Segmentation becomes real when each crossing has an owner.

Rather than debating zone models, start by naming the crossings that exist today and deciding how each one should behave. Switch between today and with Control.

  • Corporate IT to operational network

    Who uses itReporting, planning and business systems

    How it behaves todayPermanent route governed by rulesWhat Control governsPhysically closed by default, opened only for defined exchange

  • Engineering and maintenance access

    Who uses itInternal engineers and equipment vendors

    How it behaves todayStanding access through shared jump hostsWhat Control governsScheduled window, named person, closed automatically

  • Operational data to the business

    Who uses itHistorians, dashboards and analytics

    How it behaves todayContinuous two-way connectivityWhat Control governsOne directional, defined route for the data that must flow

  • Shared identity and management tooling

    Who uses itIT administration and monitoring

    How it behaves todaySpans both environmentsWhat Control governsSeparated, so a compromise on one side does not inherit the other

Zone models, level mapping and conduit design belong in the Blueprint. This page is about agreeing which crossings exist and which of them should stop being permanent.

What physical Control changes

The boundary stops being a rule and starts being a fact.

Control puts a physical enforcement point on the crossings you have named, so the boundary holds regardless of what happens in configuration.

Today

Logical segmentation

Zones exist in policy and are enforced by devices that can be reconfigured, misconfigured or traversed with valid credentials.

  • The boundary depends on rules being correct today and tomorrow
  • Valid credentials can cross a boundary that policy says is closed
  • Undocumented routes accumulate without being noticed
  • Assurance is an architecture document rather than a state
  • Operational risk is carried by a configuration change process

With Control

Physically enforced segmentation

Crossings exist only when they have been opened for a purpose, and the closed state is a property of the hardware rather than of a rule.

  • No permanent path between corporate IT and operational systems
  • Data flows on a defined route, in the direction it is meant to travel
  • Engineering and vendor access opened on schedule and closed automatically
  • A boundary that survives a misconfiguration or a stolen credential
  • Segmentation you can demonstrate to a regulator or an auditor

In operational environments, the consequence of a crossing is measured in downtime and safety, not in records.Connected when approved. Disconnected by default.

The Control philosophy

Control the path, protect the asset.

Control restores the discipline that operational environments used to get from physical separation, without giving up the visibility that convergence delivered.

  1. 1

    Start with the path, not the tool

    Every incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.

  2. 2

    Make the default state disconnected

    A path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.

  3. 3

    Open on approval, close on schedule

    When work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.

  4. 4

    Prove it physically, not on paper

    A policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.

  1. NeedSets the direction
  2. ControlSets the rule
  3. BlueprintSets the architecture
  4. Modules and Firebreak®Implement it

Where this goes next

The Blueprint for this need is CP-04 Enforce Physical Segmentation.

With the crossings agreed, the Blueprint sets out the zone architecture, the enforcement points and the phased deployment that gets there without interrupting production.

CP-04 Enforce Physical Segmentation

Segmentation should not just be logical. It should be physically enforceable. Applied to trust boundary enforcement between zones.

Lead module

FV-Firebreak

Physically opens or closes connection paths to prevent unauthorised access and stop attack progression.

Read FV-Firebreak

Lead module

FV-Isolate

Separates systems and networks into controlled zones to reduce lateral movement and enforce trust boundaries.

Read FV-Isolate

Lead module

FV-Unlink

Removes persistent connections, live dependencies and inherited trust that keep sensitive assets exposed.

Read FV-Unlink

Questions

What teams ask about critical systems

Deployment is phased and designed around operational constraints. Control sits at boundaries rather than inside control systems, so programs, logic and protocols are not modified.

No. Operational data reaches the business on a defined, one-directional route for the data that must flow, rather than over continuous two-way connectivity.

Engineering and maintenance access opens for a scheduled window, for a named person, and closes automatically, rather than as standing access through shared jump hosts.

No. This page agrees which crossings exist and which should stop being permanent. CP-04 Enforce Physical Segmentation carries the zone architecture, the enforcement points and the deployment sequence.

All questions

Name the crossings. Then design the boundary.

CP-04 Enforce Physical Segmentation shows how zones are separated in hardware and how approved crossings are governed.