Industry Insights

Securing OT with Versa NGFW: A Practical Guide for Network Security Leaders

Operational Technology (OT) is no longer an air-gapped island. Manufacturing and distribution sites now connect Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), and sensors to cloud analytics and remote vendors, which expands both capability and the attack surface. In this context, Versa’s Next‑Gen Firewall (NGFW), delivered as part of its Universal SASE platform, provides OT‑aware visibility, segmentation, continuous inspection, and zero-trust controls to protect these devices.

Why OT Security Risks Are Rising

No longer air-gapped, remote operations have surged. Legacy OT now connects to IT, 5G, and the cloud. Third‑party vendors and field engineers routinely access equipment from outside the plant, and fleets of smart devices feed data to cloud services. Traditional, flat VPNs were never designed to enforce least‑privilege access at the asset level, which raises the risk of lateral movement and misuse.

Why OT Security Is Harder Than IT Security

OT security is a tougher nut to crack than IT security.  Key reasons include:

• Most industrial devices and protocols are long-lived — many predate modern authentication and encryption. In addition, many assets run vendor-proprietary software, which often does not support agents.
• OT networks are typically flat or minimally segmented, so once an attacker gains access, they can pivot across multiple zones because controls often rely only on IP/port filtering.
• Uptime is critical. OT devices are not patched like laptops and servers. Patching OT devices often requires a planned maintenance window or a scheduled outage—sometimes quarterly or even annually—so many assets run for long periods without updates.

OT Regulatory standards and the Purdue model

Regulatory pressure has been transposed into national laws in most countries, with a broader scope and stricter governance expectations for critical and important entities, including industrial operations. In the United States, TSA directives for pipelines and rail were updated and ratified across 2024–2025 (e.g., Pipeline‑2021‑02F effective May 3, 2025), adding concrete requirements for assessed mitigations, testing, and reporting.

Across regions, expectations have tightened for visibility, segmentation, secure remote access, and tested incident response. Audits increasingly require asset inventories, documented policies, and evidence that tabletop exercises are effective.

The Purdue model helps explain where controls must fit. At Levels 0/1/2 (sensors/actuators, I/O, PLCs), systems are closest to the physical process and often have strict real‑time requirements and minimal compute. They are hardest to patch, may not support encryption, and can’t host security agents—so segmentation, industrial DPI, and brokered remote access around these layers are essential. IEC 62443’s zones‑and‑conduits approach maps cleanly onto the Purdue model, so you can use it to isolate process‑critical zones and control conduits between Levels 0‑3 to reduce blast radius without disrupting deterministic behavior.

How Versa Secures OT

Versa offers several capabilities to help you secure your OT environment.  These include:

• Real‑time discovery and fingerprinting. Versa performs inline device discovery and behavioral baselining while its Deep Packet Inspection (DPI) recognizes thousands of applications and industrial protocols such as MQTT, CoAP, and Modbus, so you build an accurate, continuously updated asset and flow map without intrusive scans.

Figure: Sample IoT Protocols Recognized by Versa DPI Engine

• Industrial‑grade policy and inspection. Policies enforce least privilege down to specific commands and function codes, not just ports. NGFW/NG‑IPS, URL filtering, anti‑malware, and advanced threat protection operate on permitted and encrypted traffic where applicable, cutting command‑and‑control and protocol abuse without sacrificing visibility.
• Zero‑trust remote operations (not flat VPNs). Instead of broad network‑level access, Versa supports brokered, per‑session connections with MFA and session recording—an approach widely adopted in OT via privileged remote access models to keep users bound to specific assets and tasks.
• Unified SASE for scale and consistency. Networking and security converge with single‑pass processing, analytics, and compliance reporting, so small plants inherit the same guardrails as flagship sites—without adding unacceptable latency on critical paths.
• OT‑friendly operations. Agentless identification and SSL/TLS proxying preserve visibility even on encrypted flows, while dynamic risk assessment and anomaly detection allow risky devices to be quarantined quickly without taking entire lines offline.

By replacing their legacy VPN solution with Versa’s ZTNA solution, employees and contractors can now quickly and seamlessly access SB Energy plants from HQ or remote locations.

Why Versa NGFW Is Essential for OT Security Leaders

Regulators expect visibility, segmentation, and proven incident response — while attackers look for any disruption they can exploit. Versa’s NGFW—delivered through Unified SASE—provides OT‑aware discovery, granular policy, continuous inspection, and zero‑trust remote access on a single platform so you can reduce security risk without sacrificing uptime.