For a manufacturer, downtime has a price you can calculate by the hour: idle lines, missed shipments and customers who start looking at other suppliers. Attackers know this, and it is one reason manufacturers are a frequent ransomware target. A plant that cannot afford to stop is under more pressure to pay.
The good news is that a few basics take away most of that leverage.
The short version
- Keep the office network and the plant floor network apart.
- Know every connected device, including the old ones nobody wants to touch.
- Back up machine programs and configurations, not only office files, and test the restore.
Why plants are hard to protect
- Equipment outlives its software. A machine that runs well for twenty years may be controlled by a computer whose operating system stopped getting security updates long ago.
- Office and plant networks grew together. In many plants, a problem that starts with one email in the front office can reach the controllers on the floor.
- Vendors connect remotely. Equipment makers and integrators often have standing remote access for maintenance.
- There is never a good time to patch. Around-the-clock production leaves few maintenance windows.
- Shared logins. One username and password on every operator station makes it hard to see who did what.
Eight basics for manufacturers
- Separate office and plant networks. Put a firewall between them and allow only the traffic that production needs. This is the single most valuable step, and it starts with network design.
- Inventory everything that is connected. Controllers, operator stations, CNC machines, label printers, cameras and the computers that run them.
- Protect what you cannot patch. Isolate older systems, limit what can talk to them, and watch them closely.
- Control vendor remote access. Access should be switched on when needed, protected with multi-factor authentication, and logged.
- Back up the things that run production. Machine programs, configurations, recipes and your ERP data, with at least one copy kept offline. Then test the restore.
- Turn on multi-factor authentication for email, remote access and business systems.
- Plan for running without computers. Decide which lines come back first and what can be done by hand. Keep the plan on paper.
- Train the office and the floor. Phishing email is the usual way in, and unknown USB drives are still a real risk on the plant floor.
Customers and insurers are asking
Larger customers now send security questionnaires to their suppliers, and cyber insurers ask detailed questions before they renew a policy. If you supply the Department of Defense, the CMMC program sets specific requirements, and your contracting officer or prime contractor can tell you which level applies to you.
The federal StopRansomware site from CISA has free guidance that is worth a look.
Xceltek supports manufacturers with cybersecurity and system integration across the office and the plant.
Could one bad email reach your production line?
We can review how your office and plant networks connect and show you where to put the walls.
Common questions
Can we protect a machine that runs an old version of Windows?
Usually, yes. If it cannot be updated or replaced, isolate it on its own network segment, restrict what can connect to it, remove internet access, and keep a tested backup of its programs and settings.
Should the office and the plant share one network?
No. Keeping them separate, with only the necessary connections allowed between them, limits how far an attack can spread.
How often should we test our backups?
On a regular schedule and after any major change. A backup that has never been restored is a guess, and a production outage is a bad time to find out.
