A manufacturing company runs its office computers and its industrial control systems (ICS) on the same flat network. After a phishing attack infects an office workstation, malware spreads freely and reaches the ICS devices. Which network security approach would MOST effectively have limited the malware's ability to spread from the office network to the ICS?