Operational technology engineers were given isolated workspaces on their corporate laptops, removing the second-device problem and shrinking the OT-to-IT attack surface.

The problem

Engineers who work across operational technology and corporate IT face a constraint most office users never encounter: the two environments must not touch, but the same person needs both, often within the same hour.

The conventional answer is two physical machines. It works, and engineers dislike it enough that they route around it — forwarding files to personal mail, using one device for both, or keeping the “secure” laptop in a drawer. The second-device policy creates the behaviour it was written to prevent.

In oil and gas the stakes are specific: OT networks control physical plant, and a path from a corporate mailbox to a control system is the scenario every security team is trying to eliminate.

What we deployed

Isolated workspaces running on the engineers’ existing corporate laptops. Rather than separating environments by hardware, the two environments run on one device with an enforced boundary between them — the OT workspace is isolated from the corporate operating system, its network path, and its file system.

The practical effect is that the isolation stops depending on user discipline. Engineers carry one laptop, and the boundary holds whether or not anyone is thinking about it.

Outcome

  • Second-device requirement removed for OT engineering staff
  • OT-to-IT attack surface reduced
  • Isolation enforced technically rather than by policy

Why it matters beyond this deployment

Security controls that depend on inconvenient user behaviour tend to decay. The durable version of a control is one where the secure path is also the convenient one — and isolation on a single device is a good example, because the engineer has no reason to work around it.

The same principle drives our approach to identity and access, and to endpoints that store nothing: make the safe route the easy route.

For privileged-access and workspace isolation scoping, start with a free EUC assessment.