OT and Warehouse Networks: Segmentation That Survives Ransomware

Start with the answer: ransomware survives in a warehouse or plant when the office network and the operations network are one flat network. Segmentation fixes that. You place conveyors, scanners, controllers and building systems in their own zones, allow only the specific traffic they need across each boundary, and keep a manual way to run when the business side is down. NIST Special Publication 800-82 Revision 3, the federal guide to operational technology security, and the Cybersecurity and Infrastructure Security Agency both point to this design.

Why warehouses are exposed

Operational technology means the computers that run physical processes: programmable logic controllers, conveyor and sortation controls, handheld scanners, label printers, robots, refrigeration and door systems. Many run old software that cannot be patched easily, and some cannot be taken offline for updates. Meanwhile a warehouse management system must exchange orders with the office, so there are always links between the two worlds. Attackers use those links. A stolen office password becomes a foothold, and a flat network then lets them reach everything else.

The CISA StopRansomware Guide lists network segmentation among its core defenses. It also describes how attackers move sideways, steal data and then encrypt many systems at once. The harm to a distribution business is immediate: no picking, no shipping, no receiving, and customers who go elsewhere.

Build the zones

NIST SP 800-82r3 describes defense in depth for operational technology: layered boundaries, controlled paths and monitoring at each. A practical layout for a warehouse looks like this.

• Business zone: office computers, email, finance and the corporate directory.
• Demilitarized zone between business and operations: the only place where the two sides meet. Data historians, file transfer servers and remote-access gateways live here.
• Operations zone: the warehouse management system servers, label and print services and supervisory systems.
• Control zone: controllers, drives, sensors and conveyor equipment, grouped by line or area so a fault in one does not spread.
• Wireless and handheld zone: scanners and vehicle terminals on their own network, with separate keys and no path to the office.
• Guest and contractor zone: vendor laptops and visitors, with no route into operations.

Control what crosses the boundary

A zone is only as good as the rules at its edge. Write them as an allowlist: this server may talk to that server on this port, and nothing else. Deny everything not named. Where a flow can go one way only, such as readings from the floor to a reporting server, enforce that direction. Do not allow the floor to browse the internet or receive email. Updates should come through a staging server that you control.

Remote access deserves its own attention. Vendors often need to reach equipment. Give each vendor an individual account with multifactor authentication, land them in the demilitarized zone, record the session and switch the access on only for the work window. Shared vendor passwords and always-on remote tools are the classic way in.

Inventory first, then isolate

Start with an asset inventory: what is connected, what it runs, who owns it and what it talks to. Passive network monitoring helps, because probing fragile controllers with active scans can disrupt them. Once you can see the traffic, you can write rules that match reality. Roll out in stages, beginning with the office-to-operations boundary, because it blocks the most common ransomware path. Run new rules in monitor-only mode for a short period, review what they would have blocked, then enforce.

Plan for the day it happens

Segmentation limits the spread; it does not stop every infection. Prepare so operations can run while IT recovers.

• Keep offline, tested backups of controller programs, configurations and warehouse system data. Store them where ransomware on the office network cannot reach.
• Write a manual fallback: paper pick lists, a local label printing method and a clear rule for who decides to cut the link between zones.
• Make the cut-off real. You should be able to disconnect the demilitarized zone from the business side within minutes, and know what will keep working when you do.
• Keep a separate recovery path for the identity system, so rebuilding the office does not depend on a compromised directory.
• Run a tabletop exercise, then a technical drill: take the business network offline and confirm that shipping continues.

Measure whether it works

Ask your team a few direct questions. Can a standard office computer reach a controller? Can a scanner reach the finance server? Who has remote access to the floor, and is it logged? When did you last restore a controller program from backup? The answers show where the design fails in practice. A penetration test of the boundary, done under written authorization and with safe methods suited to fragile equipment, will confirm whether the segmentation holds.

Our team can map your zones, write the boundary rules and test them without disrupting the floor.

Sources

• NIST, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• CISA, #StopRansomware Guide
• CISA, Industrial Control Systems

This article is general information, not legal advice. Standards and vendor documentation change; confirm current requirements with your regulator, counsel and IT provider. Last reviewed November 9, 2026.

Keep reading

Next · RegulationPenetration Testing for Community Banks: What Examiners and Boards ExpectCommunity bank examiners expect independent, risk-based testing of security controls, and boards expect a plain report they can act on. This article explains what the federal guidelines require, how the FFIEC IT Handbook frames testing, and how to scope a penetration test that satisfies both.5 min read

• SPF, DKIM and DMARC: Why Email Authentication Matters, and How a Resilient Exchange or Microsoft 365 Platform Is Run9 min
• Backups That Actually Restore: 3-2-1, Immutability, Restore Tests and Hurricane Season for Coastal Firms9 min