Zero Trust has become the dominant paradigm in enterprise cybersecurity — but what happens when you try to apply its principles in Industrial Control System (ICS) environments? In OT networks where uptime trumps agility, devices predate identity controls, and changes can jeopardize safety, the promise of “never trust, always verify” runs headfirst into operational reality.
Complicating matters further, the boundary between IT and OT has become increasingly porous — often through years of ad hoc growth and digital transformation — expanding the attack surface and blurring security assumptions.
This session takes a grounded, practical look at how — and where — Zero Trust concepts can be adapted to ICS/OT networks. We’ll explore what works (like least privilege and segmentation), what doesn’t (like dynamic policy enforcement on legacy PLCs), and where hardware-enforced boundaries, such as data diodes, still offer unmatched assurance in environments where software-defined trust breaks down.
Attendees will walk away with a realistic view of how to translate Zero Trust into the language and limitations of OT, without introducing risk, fragility, or unnecessary complexity.