In most industries, a ransomware event is a data problem. In manufacturing, it is a production problem — lines stop, orders slip, and the cost is measured per hour of lost output rather than per record exposed. That difference should drive how a plant approaches I.T.
The single highest-return project we see in manufacturing environments is also the least glamorous: separating the operational technology on the plant floor from the business network in the office.
Why Flat Networks Persist
Plant networks usually grow by accretion. A machine gets added with a vendor-supplied controller. A supervisor needs to see the production dashboard from the office, so the segments get bridged. An integrator needs remote access for support, so a remote tool gets installed on the HMI. None of these decisions is unreasonable on its own, and collectively they produce a network where a phishing click in accounting can reach a machine controller.
Compounding this: OT devices frequently cannot be patched on a normal cycle. Controllers run embedded operating systems validated against a specific software version, and vendors may not support updates at all. If the device cannot be hardened, the network around it has to be.
What Segmentation Actually Looks Like
- Separate the zones. Office, plant floor, guest, and building systems belong on distinct VLANs with firewall rules between them rather than open routing.
- Default deny between zones. Then explicitly permit only the traffic production genuinely needs — the historian, the MES connection, the specific ports the ERP integration uses.
- Broker vendor access. Integrators and machine builders get time-bound, monitored access through a jump host, not a standing remote tool on the HMI with a shared password.
- Inventory the OT assets. You cannot protect controllers, sensors, and gateways you have not written down. This inventory also becomes the basis for lifecycle and spares planning.
- Design for degraded operation. Determine what the line does if the network or an upstream cloud service is unavailable, and document the manual fallback.
The Rest of the Manufacturing Stack
Segmentation buys containment. Around it, a few other areas usually need attention:
ERP and MES availability. These systems now gate shipping and receiving, so they need the same redundancy and monitoring you would give a domain controller — plus a tested recovery plan with a defined recovery time objective.
Shop-floor connectivity. Warehouses and production areas are hostile to consumer wireless. Rack scanning, forklift terminals, and handheld devices need surveyed, industrial-grade coverage, which usually means proper cabling and access point placement rather than another extender.
Supply-chain security expectations. Customers in aerospace, defense, and automotive increasingly pass security requirements down to suppliers. Documented segmentation, MFA, and logging are the controls those questionnaires ask about most.
A Practical Sequence
Inventory first, then segment, then broker vendor access, then formalize backup and recovery for ERP and engineering data. Each step is independently useful, so the work does not require a plant shutdown or a single large capital request.
Trusted Cyber supports manufacturers across the United States with network design, segmentation, and managed security. See how we work with manufacturing organizations or explore structured cabling and network infrastructure.