Who's Allowed on the Bridge: MTSA's Network Segmentation Requirement
Summary: This third post in Dragos's MTSA cybersecurity series moves from asset inventory to network segmentation, arguing that knowing what is on the network is only step one and that what each asset can reach determines exposure. It cites the 2026 Dragos OT Cybersecurity Year in Review naming remote access as one of the most exploited entry points in OT environments, and lays out a crawl-walk-run architecture of enterprise systems, two DMZ layers, six OT environments, and crown jewels classified on top rather than in their own zone.
Why it matters: The post states that persistent vendor remote access is unacceptable and that every remote access pathway into OT should run through a dedicated jump host or broker, logged and time-limited - a standard most maritime operators have not met. It also warns that an untested backup is not a recovery capability but a false sense of security.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026