Should You Segment or Harden First?

When CISA and the FBI issued their August 19 advisory about AI-assisted attacks on Siemens S7 Series PLCs, they provided operators with a list of urgent actions. But if you're dealing with legacy industrial systems and a limited budget, the real question is: which defensive measure should you prioritize when you can't do everything at once?

This isn't theoretical. You've got PLCs that might be exposed to the internet, OT networks sharing infrastructure with IT, and third-party integrators needing remote access to keep production running. The advisory warns that threat actors are using AI to generate exploitation scripts, scan for vulnerable systems with tools like Censys and ZoomEye, and create custom tools that mimic legitimate OT monitoring solutions. Your next move will determine whether you close the most dangerous gaps or create new operational risks.

The Decision You're Facing

You need to choose between two priorities:

Network segmentation: Isolating OT from IT and removing internet exposure for PLCs.

Endpoint hardening: Patching devices, disabling unused services, and strengthening access controls.

Some operators try to do both simultaneously. That's ideal if you have the resources. But if you must choose where to start, or if operational constraints force you to sequence these efforts, you need a framework that fits your specific risk profile.

Key Factors That Affect Your Choice

Current exposure level. Are your Siemens S7 Series PLCs reachable from the internet? The advisory makes it clear that internet-exposed PLCs face immediate exploitation risk. If scanning services can find your devices, so can attackers.

Third-party access requirements. Do system integrators or vendors need remote access to your PLCs for maintenance? The advisory notes that asset owners may not realize their systems are exposed through these relationships.

Patch management capability. Can you apply critical patches to all Siemens S7 devices without causing unplanned downtime? If your patching process requires extended outages, you're trading one risk for another.

Detection coverage. Do you have visibility into abnormal PLC connections? The advisory lists specific indicators of compromise: connections from non-engineering workstations, repeated connection attempts with varying parameters, and connections from unexpected IP ranges.

Operational tolerance for change. How much can you modify the production environment before affecting uptime commitments? Network segmentation often requires more disruptive changes than device-level hardening.

Path A: Prioritize Network Segmentation When

You have confirmed internet exposure. If your PLCs are discoverable through external scanning, segmentation is your first line of defense. The advisory's description of threat actor tactics shows they start with reconnaissance using legitimate scanning services. Remove that visibility before tackling anything else.

You rely heavily on third-party remote access. When integrators and vendors connect directly to your OT environment, you're extending your attack surface beyond your control. Segmentation lets you create controlled access points with stronger authentication requirements. The advisory recommends enabling multifactor authentication for all remote access to OT networks, but that control only works if remote access flows through a segmented architecture.

Your patch management process is slow or untested. If applying patches requires coordination across multiple teams and extended testing windows, you can't rely on patching as your primary defense. Segmentation buys you time by limiting what attackers can reach even if devices remain unpatched.

You have detection capabilities but limited prevention. If you can hunt for the indicators of compromise listed in the advisory, segmentation reduces the volume of traffic you need to monitor. You're creating choke points where detection is more effective.

Start here:

• Conduct an immediate inventory of all internet-facing PLCs and remove that exposure.
• Separate OT and IT networks with defined access control points.
• Document all legitimate remote access requirements and route them through authenticated gateways.
• Implement connection logging that captures source IP, connection time, and protocol details.

Path B: Prioritize Endpoint Hardening When

Your devices are already segmented but poorly configured. If you've isolated OT from IT but haven't disabled unnecessary services on the PLCs themselves, you're vulnerable to lateral movement once an attacker gains initial access. The advisory describes how threat actors use AI-assisted scripting to create tools that provide read/write access to PLC memory and configuration data via the S7comm protocol. Hardening limits what those tools can accomplish.

You have a functioning patch management process. When you can apply critical patches without extended downtime, hardening becomes immediately actionable. The advisory specifically urges operators to apply critical patches for affected Siemens devices. If you can execute that recommendation within days rather than months, start there.

Your biggest risk is insider threat or compromised credentials. Network segmentation assumes the threat comes from outside your OT environment. If authorized users or compromised vendor accounts pose your primary risk, device-level controls provide more direct protection.

You need quick wins to demonstrate progress. Hardening individual devices shows measurable improvement faster than network redesign. If you're building support for a larger security program, documenting the specific services you've disabled and protocols you've restricted creates tangible evidence of risk reduction.

Start here:

• Inventory all Siemens S7 Series PLCs and identify which models require patches.
• Disable web servers on PLCs (the advisory lists this as a specific mitigation).
• Disable unused communication protocols beyond S7comm.
• Restrict PLC access to specific engineering workstations by MAC address or certificate.
• Contact Siemens for model-specific hardening recommendations (the advisory explicitly suggests this).

Path C: You Need Both, Sequenced by Risk

Most environments require both segmentation and hardening, but in a specific order based on your threat model.

If you're in critical infrastructure sectors (water, energy, food and agriculture, manufacturing), the advisory's description of threat actor objectives suggests they're conducting persistent reconnaissance for future attacks. That means you're facing a two-stage threat: current exploitation attempts and preparation for future operational disruption.

For this scenario:

1. Immediately remove internet exposure (this addresses current scanning and exploitation).
2. Apply critical patches to internet-exposed devices that you've just segmented (this closes known vulnerabilities before you move to the next set).
3. Implement segmentation between OT and IT (this limits lateral movement).
4. Harden remaining devices systematically, starting with those that control safety-critical processes.

If you discover you're already compromised (you find the indicators of compromise the advisory describes), reverse the order:

1. Isolate affected segments immediately.
2. Harden devices to limit attacker capabilities.
3. Hunt for additional compromise indicators before you restore connectivity.
4. Redesign segmentation to prevent recurrence.

Summary Matrix

Factor	Segment First	Harden First
Internet-exposed PLCs	Yes	Only if you can patch within 48 hours
Heavy third-party access	Yes	No
Slow patch management	Yes	No
Strong detection capability	Yes	Either path works
Devices already segmented	No	Yes
Fast patch management	Either path works	Yes
Insider threat primary concern	No	Yes
Need quick visible progress	No	Yes
Critical infrastructure sector	Yes, then harden	Only if already segmented
Active compromise suspected	Yes (isolate), then harden	No

The advisory's emphasis on proactive defense means you can't wait for perfect conditions. Choose the path that closes your most dangerous gap first, document what you've done, and move to the next control. Threat actors are using AI to lower their barrier to attack. Your job is to raise your barrier to compromise faster than they can adapt.