Zero-Trust for Rockwell PLCs: A Non-Disruptive Micro-segmentation Blueprint for EtherNet/IP

Introduction: The Brownfield Conundrum

In the realm of industrial automation, legacy Rockwell Automation Programmable Logic Controllers (PLCs)—such as the venerable ControlLogix and CompactLogix families—represent the bedrock of modern manufacturing. These devices are the workhorses of production, engineered for reliability and operational longevity. However, their design predates the era of pervasive network connectivity and sophisticated cyber threats. Deployed within networks once presumed to be isolated and secure, they now represent a significant attack surface in converged IT/OT environments. The core engineering challenge is stark: How can an organization superimpose a modern, granular Zero-Trust security posture upon these legacy systems without modifying validated firmware, triggering costly re-certification processes, or, most critically, disrupting deterministic production cycles?

Traditional approaches, such as perimeter firewalls and network-wide VLANs, are insufficient. They create coarse-grained security zones that fail to prevent lateral movement once a perimeter is breached. The answer lies in a network-centric, protocol-aware micro-segmentation strategy that treats each PLC as its own protected domain. This research desk blueprint outlines a pragmatic, non-disruptive methodology for achieving this level of security for Rockwell EtherNet/IP environments, effectively ring-fencing critical assets without altering their core operational state.

The Inherent Vulnerability of Legacy EtherNet/IP Architectures

EtherNet/IP, as a protocol suite maintained by the ODVA, is built upon the Common Industrial Protocol (CIP) layered over standard TCP/IP and UDP/IP. This design choice facilitated its rapid adoption by leveraging commercial off-the-shelf (COTS) Ethernet hardware. However, foundational versions of the protocol lack intrinsic security mechanisms. Key vulnerabilities in a typical brownfield deployment include:

• No Authentication: The protocol does not natively require authentication for connections. Any device on the network can, in principle, initiate a connection with a PLC.
• Lack of Authorization: There is no granular mechanism to control what a connected device is permitted to do. An HMI meant only for monitoring process values could potentially be used to upload new ladder logic if compromised.
• Unencrypted Data: All communications, including tag data and programming commands, are transmitted in cleartext, making them susceptible to man-in-the-middle (MitM) attacks for espionage or manipulation.
• Flat Network Topologies: Many older OT networks were designed as flat, switched Layer 2 domains for simplicity and low latency, inadvertently creating a