Forescout’s Vedere Labs analyzed 47,700 network segments containing over 2.5 million devices across 209 organizations, revealing significant risks associated with network convergence. The study found that IT, operational technology (OT), IoT, and medical devices often share the same environments, increasing the potential for lateral movement and cyberattack impact.
Key takeaways
- 62% of segments contained a single device category, while 29% had two categories and 9% had three or more.
- Only 13% of segments with OT devices were OT-only, and 6% of those with IoMT devices were IoMT-only.
- The average network segment contained 54 devices spanning four device types, creating a potential blast radius if one device is compromised.
- IP cameras were particularly exposed, with only 2% of segments containing cameras being camera-only.
- 72% of segments had between two and 50 devices, while 11% had more than 50 devices.
- Healthcare organizations experienced an average blast radius of 116, more than double that of the oil and gas industry at 72.
Why It Matters
The findings highlight the need for organizations to maintain continuous asset visibility, identify device convergence zones, separate critical operational assets from enterprise IT networks, and monitor for segmentation drift. The analysis also revealed that many devices are part of more than one segment, increasing the blast radius even further.
Network Segmentation Challenges
The study found that 50% of IoMT network segments contained IoMT, IT, and IoT devices, while 23% contained IoMT, IT, IoT, and OT devices. This convergence increases the risk of lateral movement and cyberattack impact.
Device Convergence Zones
Only 13% of OT segments were genuinely isolated, with the majority sharing broadcast domains and pathways with IT and peripheral IoT devices like cameras and printers. This makes them into attack vectors for threat actors.
Risk Management Strategies
Organizations should establish comprehensive asset visibility by building and maintaining an accurate inventory of all connected IT, OT, IoT, and IoMT assets. Continuous visibility into what is connected to the network, where devices are located, and how they communicate is foundational to identifying segmentation gaps.
Segmentation Best Practices
Reducing oversized network segments is essential, as large environments increase the opportunities for lateral movement. Breaking these environments into smaller, purpose-built segments can significantly limit the impact of a breach. Implementing policy-based access controls between segments ensures devices communicate only with the systems required for their function.