Extending Zero Trust to Operational Technology in the Navy and Marine Corps

For decades, operational technology (OT) aboard ships, in shipyards, and in logistics operations ran on its own network, separate from the enterprise. Today, fleet readiness, maintenance, and logistics depend on data moving between those industrial systems and the enterprise networks used to plan and track the work. Across the Department of War, a growing share of network traffic comes from equipment and industrial systems that earlier network designs were not built to carry.

Why Connected OT Expands the Attack Surface

Connecting these systems also exposes them. Much of the equipment is legacy and lacks native protections such as encryption and authentication, and these systems have already been targeted by ransomware and other cyberattacks. Adversaries are also using artificial intelligence to conduct autonomous, high-volume attacks faster than human defenders can respond, and connected systems without authentication are an easy target for those campaigns. The DoD Zero Trust Strategy points to this same dynamic: adversaries are already inside networks, exfiltrating data and exploiting users, and perimeter defenses alone are no longer sufficient to secure an information enterprise that now extends to connected OT and control systems.

What Zero Trust Means for Navy and Marine Corps OT

Navy and Marine Corps teams are now being asked to protect OT networks with the same security posture as the enterprise network, including Zero Trust. Every user and device should be verified before each access and continuously afterward, so that one compromised device or credential cannot be used to move across the network. Versa’s approach to Zero Trust Everywhere extends that same continuous verification model from enterprise networks into OT environments, rather than treating OT as a separate posture to design and manage on its own.

For Sailors and Marines, this means extending enterprise security to legacy OT environments, starting with an accurate inventory of what is fielded. A device has to be identified before it can be segmented, governed by policy, or monitored for abnormal behavior. As more of these systems are connected, teams also need visibility across a larger attack surface, and that work has to be done without disrupting the operations these systems support.

How Versa Protects OT Devices and Networks

Versa protects IoT and OT with five integrated Zero Trust capabilities:

Device Fingerprinting

Identifies and classifies over 1 million device types using 20+ attributes, enabling granular, device-level security policies.

Macro and Microsegmentation

Dynamically segments OT devices and networks based on security posture, isolating critical systems and controlling communication between them.

Lateral Movement Detection and Prevention

Uses network segmentation and integrated security controls to detect suspicious activity and restrict threats from spreading between devices.

URL Filtering

Applies category-based and reputation-based filtering, including allowlists and blocklists, to control access to malicious or unauthorized destinations.

Advanced Visibility

Provides network-level visibility into connected devices, applications, protocols, and traffic patterns to identify anomalies and potential security threats.

Versa combines OT device discovery, segmentation, visibility, and security enforcement within a unified networking and security architecture, reducing the need for separate point solutions.

Read the Versa OT Security Solutions Brief for a closer look at securing federal OT environments.

Why OT Security Belongs in the Enterprise Architecture

In Versa’s view, OT security should not be managed as a separate entity. Protecting OT with its own tools, apart from the enterprise, means training on and sustaining two systems, and neither one shows the full picture when an adversary moves between them. Bringing OT under the same architecture and Zero Trust policy model used for the enterprise allows each device to be identified, each connection to be verified, and visibility to stay consistent from enterprise networks to shipyards and shipboard systems.

Four Questions to Assess Any OT Environment

Program offices can use four questions to assess any OT environment:

1. Is every connected device identified?
2. Is each device segmented based on its role and risk?
3. Can a compromised device reach systems it does not need?
4. Is the same policy enforced and visible across OT and enterprise networks?

If the answer to any of these is unclear, that is where a Zero Trust assessment of your OT environment should start. Talk with Versa’s federal team about extending Zero Trust to your OT networks.