Converged and specialized networks

Most networks today are converged: they carry data, voice, video, storage, building systems and industrial control traffic over shared IP infrastructure. Convergence saves money and simplifies operations, but it also means that a weakness in one system can affect others that were once physically separate. This lesson covers the specialized networks a security manager is likely to meet: operational technology and industrial control systems, the Internet of Things and building systems, storage networks, content delivery networks, and converged protocols that carry one kind of traffic over another. CISSP-112 lesson 6 introduced industrial control systems as an architecture topic; here we focus on the network.

Converged protocols

Converged protocols carry traffic that once needed its own network over standard Ethernet and IP. Fiber Channel over Ethernet, FCoE, carries storage traffic over Ethernet at layer 2, relying on data center bridging enhancements for lossless delivery. Internet Small Computer Systems Interface, iSCSI, carries block storage commands over TCP/IP, so it can be routed. Voice over IP converges telephony. Multiprotocol Label Switching, MPLS, used by carriers and large enterprises, forwards packets using short labels rather than IP lookups, creating virtual circuits for different customers or classes of service; it separates traffic logically but does not encrypt it, so organizations with confidentiality requirements still encrypt across carrier MPLS. Building systems increasingly run over IP too, through protocols such as BACnet/IP for heating and ventilation.

The security consequence is shared fate. A broadcast storm, a misconfigured switch or a denial of service attack on the converged network can take down phones, storage, cameras and door controllers at the same time as email. Separation still matters: put storage, voice, building systems and management on their own VLANs or virtual routing instances, apply quality of service so that critical traffic keeps working under load, and filter traffic between these segments as strictly as between any other zones.

Operational technology and industrial control systems

Operational technology, OT, monitors and controls physical processes: power grids, water treatment, pipelines, manufacturing lines, rail signaling and building systems. Industrial control systems, ICS, include supervisory control and data acquisition, SCADA, systems that monitor geographically spread assets such as pipelines and electricity networks; distributed control systems, DCS, that run continuous processes in plants; and programmable logic controllers, PLCs, and remote terminal units, RTUs, that directly operate equipment. Human-machine interfaces give operators views and controls, and historians store process data.

OT priorities differ from IT priorities. Safety and availability come first, because a failure can injure people, damage equipment or harm the environment. Systems run for decades, often on unsupported operating systems, and cannot simply be patched and rebooted. Many industrial protocols, such as Modbus, DNP3 and older versions of EtherNet/IP and PROFINET, were designed for closed networks and authenticate nothing: any device that can reach a controller can usually send it commands. Secure versions exist, such as DNP3 Secure Authentication and Modbus Security over TLS, but deployment is slow.

Attacks on OT are no longer theoretical. Stuxnet, discovered in 2010, sabotaged uranium enrichment centrifuges by reprogramming PLCs. Attacks on Ukraine's power grid in 2015 and 2016 cut electricity to hundreds of thousands of people. The Triton malware, found in 2017, targeted safety instrumented systems at a petrochemical plant. The 2021 ransomware attack on Colonial Pipeline hit IT systems, but the company shut down pipeline operations as a precaution, showing how IT incidents can halt physical operations. Attacks on water utilities, including through internet-exposed controllers with default passwords, have prompted repeated government advisories in recent years.

The Purdue Enterprise Reference Architecture, adapted for security in the ISA/IEC 62443 series of standards, is the usual reference for segmenting OT. It arranges systems into levels, from physical processes at level 0, through controllers at level 1, supervisory systems at level 2 and site operations at level 3, up to business systems at levels 4 and 5. An industrial DMZ, sometimes called level 3.5, sits between business and control networks, so that no traffic passes directly between them; instead, services such as historian replicas, patch servers and remote access gateways in the DMZ broker the exchange. ISA/IEC 62443 adds the concepts of zones and conduits, groups of assets with common security requirements and the controlled communication paths between them, and security levels from 1 to 4 describing the strength of attacker a zone must resist.

Monitoring in OT should be passive where possible. Active vulnerability scanning that is routine in IT can crash fragile controllers, so OT security programs rely on passive, protocol-aware monitoring of mirror ports to build asset inventories and detect anomalies, such as a new device appearing or an engineering workstation sending a program download outside a maintenance window. Changes to control logic should go through change management with engineering and safety sign-off.

In the United States, bulk electric system entities must comply with the mandatory NERC CIP standards enforced under the oversight of the Federal Energy Regulatory Commission. The Transportation Security Administration issued security directives for pipeline operators after the 2021 Colonial Pipeline attack, and CISA and the Environmental Protection Agency have issued repeated advisories for water and wastewater systems. CISA publishes cross-sector cybersecurity performance goals and maintains an ICS advisory program (checked October 2026).

The Internet of Things and building systems

The Internet of Things, IoT, covers billions of connected devices: cameras, sensors, smart meters, medical devices, televisions, voice assistants and building controllers. Common weaknesses include default or hard-coded passwords, unencrypted communication, no secure update mechanism, long life with short vendor support, and cloud dependencies that send data to third parties. The Mirai botnet of 2016 enslaved hundreds of thousands of cameras and routers with default passwords and used them for record-breaking denial of service attacks; its descendants still operate.

Network controls for IoT start with inventory and segmentation. Place IoT devices in their own segments, allow them to talk only to the controllers or cloud services they need, block lateral traffic and internet access they do not need, and monitor their behavior, which is usually very predictable, for deviations. Network access control should profile devices and put them in the right segment automatically. Buy devices that support secure updates, unique credentials and encryption, and ask vendors how long they will provide security updates. Smart building systems deserve particular care because they often link physical security, such as door access and cameras, with heating, lighting and elevators, and are frequently installed and maintained by contractors outside IT's view.

In the United States, the IoT Cybersecurity Improvement Act of 2020 requires federal agencies to buy IoT devices that meet NIST guidance, and the FCC's voluntary US Cyber Trust Mark labeling program for consumer IoT devices, based on NIST criteria, was adopted in 2024. Companies selling into Europe must also consider the EU Cyber Resilience Act, with main obligations applying from December 2027 (checked October 2026).

Storage networks

Storage area networks, SANs, give servers block-level access to shared storage. Fiber Channel SANs use their own switches and protocols; iSCSI and FCoE converge storage onto Ethernet. Network-attached storage, NAS, provides file-level access over protocols such as SMB and NFS. Storage networks hold an organization's most valuable data and its backups, so attackers who reach them can steal or encrypt everything. Controls include dedicated, isolated storage networks or VLANs; Fiber Channel zoning, which restricts which hosts can see which storage ports, and LUN masking, which restricts which logical units a host can access; CHAP authentication and IPsec for iSCSI; strong separation of storage management interfaces; and immutable or offline backups that ransomware operating with stolen administrator credentials cannot delete.

Content delivery networks and edge services

Content delivery networks, CDNs, cache and serve content from servers distributed around the world, close to users. They improve performance and absorb traffic spikes, which makes them a key part of denial of service protection: large CDNs and DDoS mitigation providers can absorb attacks of several terabits per second that would overwhelm any single organization's links. Many CDNs also provide web application firewalls, bot management and TLS termination at the edge. The trade-offs are dependence on the provider, which becomes a single point of failure if it suffers an outage, and the provider's ability to see decrypted traffic it terminates. Origin servers should accept connections only from the CDN, so attackers cannot bypass it by connecting directly, and certificates and keys held by the CDN should be governed by contract and policy.

Thinking like a manager

In specialized networks, the manager's job is to adapt security to the environment rather than force IT practice onto it. In OT, safety and availability are paramount, so changes involve engineers, testing and maintenance windows, and monitoring is passive. In IoT, procurement is a control: buying secure devices is cheaper than defending insecure ones. In storage, the crown jewels include backups, so isolate and protect them as carefully as production data. When a question asks for the first step in securing an unfamiliar specialized network, the answer is usually an inventory and an understanding of how it works, followed by segmentation.