In an era where cyber threats are growing more sophisticated and industrial systems are becoming increasingly connected, protecting Operational Technology (OT) environments is no longer optional — it’s critical. On a manufacturing floor, that OT environment isn’t just PLCs and SCADA systems anymore. It’s also the integrator who needs into the line at 2am, the OEM service tech running diagnostics once a quarter, and every device they bring with them. That’s where Network Access Control (NAC) comes in — and why it has to cover both halves of the problem.
While NAC has long been used in traditional IT environments to manage user access, its value in OT security is rapidly gaining recognition. When implemented properly — especially with passive techniques like DHCP gleaning and MAC address clustering — NAC can dramatically improve visibility, reduce risk, and enforce policy without disrupting critical operations.
The Unique Security Challenges of OT Environments
OT systems are designed to prioritize availability and uptime above all else. They often involve:
- Legacy devices (e.g., PLCs, SCADA systems) — frequently running under OEM warranties that prohibit modification
- Proprietary protocols
- Minimal or no built-in security
- Static configurations with limited change tolerance
Unlike IT systems, many OT devices can’t handle active scanning or probing without risk of crashing or interfering with industrial processes. This makes traditional endpoint protection and vulnerability management tools ineffective — and even dangerous — in OT settings.
Layered on top of that: multi-site manufacturers are often running six plants with six different RADIUS deployments and zero consistency between them, inherited from years of point solutions and M&A. So how do you secure something you can’t touch, consistently, across every site?
Enter Network Access Control
NAC solutions provide a non-intrusive, policy-based framework for managing what devices are allowed to connect to the network, where they can go, and how they behave. In OT environments, NAC offers:
- Visibility: Discover and identify every device on the network — IT and OT alike
- Control: Apply policies to restrict access based on device type, risk, or role
- Segmentation: Isolate critical systems and prevent lateral movement
- Time-bound vendor access: Grant a contractor or OEM tech access to exactly the equipment they’re there to touch, automatically revoked when the job’s done — no standing VPN credentials left open long after the work order closes
All without requiring agents, scans, or direct interaction with fragile OT equipment.
Why Passive Fingerprinting Matters
Because many OT devices can’t tolerate active scanning, NAC solutions that use passive methods for identifying and classifying endpoints are critical. Two of the most powerful passive techniques in this context:
DHCP Gleaning: Safe, Silent Discovery
DHCP gleaning involves capturing information from DHCP requests to learn about new or existing devices on the network. Every time a device connects and requests an IP address, it sends a packet with valuable data such as:
- MAC address
- Hostname
- Device vendor
- Operating system hints
- DHCP options (like device type or role)
This process is agentless, non-disruptive, and ideal for real-time device discovery. In OT environments, DHCP gleaning provides instant awareness when new or unauthorized devices appear — without touching the device or interfering with its operation.
MAC Address Clustering: Profiling Devices Through Behavior
MAC address clustering enhances device fingerprinting by grouping devices based on similarities in:
- MAC address prefixes (revealing vendor/type)
- Network behavior (e.g., traffic patterns, protocols used)
- Port location or VLAN
NAC can infer what type of device is connecting, even if it provides minimal DHCP information. A set of devices with similar MAC prefixes, static IPs, and Modbus traffic patterns are likely to be PLCs; a device in a known location with similar traits to other HMIs can be classified — even without login credentials or rich metadata. This allows for context-aware access control, even with legacy or silent devices.
Why This Breaks Down With Legacy NAC
Platforms like Cisco ISE and Aruba ClearPass were built for a different network — one where devices are largely managed, IT-owned, and tolerant of agents and active polling. Applied to a plant floor, that architecture runs into the same problem it was never designed for: appliance- and agent-heavy deployments that don’t fit lean IT teams running multiple sites, and fingerprinting approaches that assume the device can be interrogated rather than just… watched.
The other common setup — Microsoft NPS bundled into Windows Server as free RADIUS — solves authentication but stops there. No device visibility, no OT/IoT profiling, no automated enforcement. It answers “can this connect,” not “what is this and should it.”
A cloud-native NAC platform built for distributed, mixed IT/OT environments avoids both problems: no per-site appliances to maintain, no agents to push to devices that can’t run them, and centralized policy that stays consistent whether you have one plant or twelve. It’s also worth asking what happens when the internet blips — local RADIUS enforcement means each plant keeps applying policy even if connectivity to the cloud drops, so a network hiccup never becomes an open door.
Benefits of NAC in OT Environments
- Visibility — You can’t protect what you can’t see. NAC provides a live inventory of all connected devices, including unmanaged and third-party equipment. Essential for both security and compliance efforts.
- Reduced Attack Surface — By enforcing device-based access policies, NAC ensures only known, trusted devices can connect, and only to what they should. Rogue devices are blocked or isolated automatically.
- Safer Network Segmentation — Microsegmentation based on device type, risk level, or business function. Keep your building management system on a separate VLAN from your production line.
- Governed Vendor and Contractor Access — Scoped, time-limited access tied to the work order, not a standing credential someone forgets to revoke.
- Incident Response and Forensics — A full history of device activity, MAC address relationships, and policy logs enables faster incident response and helps pinpoint the origin of any network anomaly.
- Passive Monitoring that Respects OT Stability — All of the above without active interrogation — keeping processes running smoothly and securely.
Operational networks are no longer isolated — and that means they can no longer remain unsecured, or unaccountable for who’s touching them. As IT and OT converge, and as vendor and contractor access becomes a routine part of keeping plants running, organizations need a way to enforce strong access control, gain visibility, and manage third-party access — without endangering uptime or safety.
Network Access Control offers exactly that, especially when enhanced with smart, passive techniques like DHCP gleaning and MAC address clustering, and extended to cover who gets in, not just what’s already there. If you’re looking to modernize your OT cybersecurity posture, NAC isn’t just a nice-to-have — it’s a must-have.
