The press in bay three has been running the same part for eleven years. It does not care what day it is. The controller bolted to the side of it runs software that stopped getting updates a long time ago, and the vendor who commissioned it was blunt: touch the operating system and support is over. So nobody touches it. That is not negligence. That is a rational call made by people who know exactly what a week of downtime costs.
Meanwhile the office runs on laptops, email, and an accounting package, all updated on a normal schedule. Two worlds, one building. The trouble starts when they share one flat network, because the risks that live in email do not politely stay in email. Here is a practical look at how a small or mid-sized manufacturer can keep the floor productive without leaving it wide open, and without picking a fight with the machine vendor.
Two Networks Doing Two Very Different Jobs
The industry calls this the divide between operational technology and information technology. Operational technology, usually shortened to OT, is anything whose job is to make a physical thing happen: programmable logic controllers, CNC controls, robot cells, the touchscreen panels operators use, and the box quietly logging production data. Information technology, IT, is the office side: email, file shares, the ERP system, laptops, printers. They are not the same animal, and treating them the same is where most shops get into trouble.
- IT tolerates change. A laptop reboots for an update, the user gets coffee, life goes on.
- OT tolerates almost none. A controller that reboots mid cycle can mean scrapped material, a jammed line, or a safety event.
- The lifespans are nothing alike. Office equipment turns over every few years. A machine tool earns its keep for decades.
- The people are different. Your controls integrator and your IT provider have often never spoken. That gap is where problems hide.
The Machines You Cannot Patch
You are not going to win the patching argument on a machine whose warranty depends on leaving it alone. So stop fighting it and protect the machine from the outside instead. In guidance on primary mitigations for operational technology, CISA, working with the FBI, EPA, and Department of Energy, tells owners to “remove OT connections to the public internet” and to “change default passwords immediately and use strong, unique passwords.” Neither requires opening the machine.
- Write down what you actually have. Announcing CISA’s asset inventory guidance for operational technology, Acting CISA Director Madhu Gottumukkala called visibility into OT assets “a critical first step in reducing risk and ensuring operational resilience.” You cannot protect a controller nobody remembers exists.
- Get it off the open internet. Plenty of machines went online years ago for a vendor’s convenience and never came back off.
- Change the defaults. Default logins on panels and controllers are published in manuals anyone can download.
- Ask the vendor a better question. Not “can I patch this,” which gets a no. Ask what they support and what they recommend you do around the machine. Most will happily discuss the network side.
Separating the Shop Floor From the Office
CISA describes network segmentation as “a physical or virtual architectural approach dividing a network into multiple segments, each acting as its own subnetwork providing additional security and control,” and recommends “creating boundaries between the operational technology (OT) and information technology (IT) networks,” noting that doing so reduces risks that originate on the IT side, including threats caused by phishing attacks. In plain terms, this does not mean two buildings. It means the floor gets its own network with a controlled gate between it and everything else.
- Start with what must cross. Usually production counts going out to ERP. Very little needs to come in.
- Default to deny. Allow the specific traffic you listed and block the rest, rather than blocking a list of bad things.
- Keep guest Wi-Fi far away. Visitor and break room wireless should never touch the same network as a controller.
- Separate the logins. An office account that gets phished should not be a working key to the floor.
Remote Vendor Access Without Leaving the Door Open
Your integrator dialing in at two in the morning to fix a fault is genuinely valuable. The problem is how that access usually gets set up: once, in a hurry, years ago, never reviewed. CISA and its partner agencies recommend securing remote access to OT networks using a VPN with strong passwords and phishing resistant multi-factor authentication, and applying least privilege.
- Off by default, on by appointment. Standing always on access is the single most common finding we see on a shop floor.
- Named accounts, never shared. “Vendor1” tells you nothing when you need to know who did what.
- Use strong second factors. Not all multi-factor is equal. We compared the options in YubiKey versus passkeys versus standard MFA.
- Scope it to one machine. A vendor supporting one cell does not need a path to the whole plant.
- Put it in the service agreement. Access method, notice, and who to call. A normal thing to ask for.
Ransomware in the Office, Silence on the Floor
Here is the part shops underestimate. Even if the machines keep spinning, an office hit stops the plant within a shift. Work orders live in the office. So do labels, packing lists, certificates of conformance, shipping systems, time clocks, and the ability to invoice what you already built. The machines run and the product piles up with nowhere to go.
CISA and its partner agencies recommend practicing and maintaining the ability to operate OT systems manually, supported by tested backup and recovery plans. Take that literally. Decide now what a paper day looks like: how you record what ran, how you ship, how you tell customers. It costs an afternoon to write down and it buys you a working plant on a bad week. For the wider business case, see why cybersecurity is no longer optional for mid-sized businesses.
Back Up the Programs That Run the Machines
Most shops back up the file server and the accounting data. Far fewer back up the ladder logic, the CNC programs, the panel configurations, the tool offsets, and the recipes. Those often exist in exactly two places: inside the machine, and on one laptop in a drawer. Lose both and you are waiting on a vendor and paying engineering time to recreate something you already owned.
- Inventory the programs. One row per machine: what runs it, where the master copy lives, who can restore it.
- Store copies somewhere else. Off the machine and off the floor network, so one bad event does not take both.
- Keep one copy offline. A copy nothing on the network can reach or encrypt.
- Keep versions. When a change causes scrap, you want last month’s known good program, not just last night’s.
- Test a restore. A backup you have never restored is a hope, not a plan.
The Bottom Line
You do not have to modernize every controller to be in decent shape. The wins are unglamorous: know what is on the floor, put a real boundary between the floor and the office, turn vendor access into something scheduled and named, back up the programs that make parts, and write down how you run on paper for a day. None of that voids a warranty. All of it is work you can schedule around production instead of around an incident.
We work with manufacturers across Denton County, and we are comfortable in a room with your controls integrator. If you want a straight assessment of where your shop floor and office meet, plus a plan you can phase in without stopping production, we are happy to walk the plant with you. Contact us today.
Sources:
Comments are closed