How to Secure Shop-Floor (OT) Networks Without Stopping Production
A practical, step-by-step guide for small and mid-sized manufacturers to secure shop-floor OT networks without unplanned downtime.
It's 6:45 on a Monday morning, and the plant manager is not happy. Over the weekend, IT pushed Windows updates to "everything on the network," and the PC running the paint line's HMI rebooted in the middle of a shift change. Nobody was hurt, but the line sat idle for two hours while someone figured out why the screen said "Updating, do not turn off your computer."
If you run IT for a manufacturer, you've probably lived some version of this. You know shop-floor (OT) network security matters. Ransomware crews know that a stopped production line puts enormous pressure on a company to pay. But you also know that the fastest way to lose the trust of operations is to break something that makes money.
The good news is that securing an OT network doesn't have to mean shutting it down. Most of the work happens around the machines, not on them. Here's how I'd approach it, step by step, for a small or mid-sized plant.
In this guide
- Why OT networks need a different approach
- Step 1: Find out what's actually on the shop floor
- Step 2: Separate the plant floor from the office network
- Step 3: Lock down vendor remote access
- Step 4: Protect machines you can't patch
- Step 5: Monitor quietly, without touching production
- Step 6: Plan for the bad day
- How to roll out changes without stopping production
- Frequently asked questions
Why OT networks need a different approach
In office IT, the priority order is usually confidentiality first, then integrity, then availability. On the plant floor it's flipped. Availability and safety come first. A PLC that stops responding for 30 seconds can scrap a batch, damage equipment, or create a safety issue.
OT equipment also lives a lot longer than office equipment. It's normal to find a CNC controller, a vision system, or an HMI running an operating system that went out of support years ago. The machine still works perfectly, it costs six figures to replace, and the vendor may not support running it on anything newer.
That's why the usual IT playbook of "patch everything, scan everything, reboot on Sunday" can do real damage on the shop floor. Active vulnerability scans, for example, have been known to crash older PLCs and industrial devices that were never built to handle unexpected network traffic.
So the goal isn't to make the plant floor look like the office. The goal is to surround production with layers of protection so that a problem in one place can't spread to the machines that run the business.
Step 1: Find out what's actually on the shop floor
You can't protect what you don't know exists. And in most plants I've worked with, nobody has a complete list of what's connected to the production network.
Start with an inventory. For each device, try to capture:
- What it is (PLC, HMI, engineering workstation, historian, robot controller, camera, sensor gateway)
- Make, model, and firmware or operating system version
- IP address and which switch port or VLAN it lives on
- Who supports it: your team, the machine builder, or a third-party integrator
- Whether it needs to talk to anything outside its own cell or line
Use passive discovery, not active scanning
The safest way to build this list is passive. A passive monitoring tool listens to a copy of network traffic (from a SPAN or mirror port on a switch) and identifies devices by what they say on the wire. It never sends a packet to the machines themselves.
If you don't have a tool yet, a walk-through with a clipboard still works. Pair it with your switch MAC address tables and DHCP records. It's not glamorous, but an accurate spreadsheet beats a fancy dashboard nobody trusts.
Talk to the people who run the line
Your maintenance techs and controls engineers know things no tool will tell you. Ask them which machines get remote support from vendors, which ones use USB drives to load programs, and which ones are "don't touch, it's fragile." Those answers shape everything that follows.
Step 2: Separate the plant floor from the office network
If I could only do one thing in a plant, this would be it. Network segmentation means putting the shop floor on its own network zone, with a firewall controlling exactly what can cross between the office and production.
On a flat network, an employee who clicks a bad link in an email can give an attacker a path straight to the HMI on line 3. With proper segmentation, that infected laptop can't even see the production network.
A simple zone model for small plants
You'll often hear about the Purdue model, which describes layers from field devices up to the business network. You don't need to implement every layer on day one. For a small or mid-sized plant, a practical starting point looks like this:
- Office zone: email, ERP, file shares, user laptops.
- Industrial DMZ: a small zone in between, for things both sides need, such as a historian replica, a patch server, or a remote access jump host.
- Production zone: HMIs, engineering workstations, SCADA servers.
- Cell or line zones: where practical, separate lines or critical machines from each other, so one infected HMI can't reach every PLC in the building.
The rule of thumb: the office should never talk directly to production. Traffic stops in the DMZ, and the firewall only allows the specific connections you've documented in Step 1.
Build the rules from real traffic
This is where passive monitoring pays off. Watch the traffic for a few weeks before you tighten anything, so you know which connections production actually depends on. Then write firewall rules that allow those, log everything else, and only start blocking once you're confident nothing important is being caught.
If your plant also handles data for defense contracts, this kind of separation supports the same goals CMMC and NIST 800-171 are aiming for. It's worth reading our guide on cybersecurity for Roanoke small businesses for the broader checklist that sits around this.
Step 3: Lock down vendor remote access
Machine builders and integrators often need to connect remotely to troubleshoot equipment. Too often, that access is a remote desktop tool installed years ago, an always-on modem, or a shared password that a dozen technicians know.
Each of those is an open door into production. Here's how to close it without making your vendors' lives miserable:
- Route all vendor access through one place, such as a jump host or remote access gateway in the DMZ, never directly to a machine.
- Require multi-factor authentication for every remote session.
- Use named accounts, one per technician, not one shared login per vendor.
- Turn access on when it's needed, and off when the job is done. Many tools support time-limited or approval-based sessions.
- Record or log sessions so you can see who changed what, and when.
- Remove forgotten modems and cellular gateways you find during your inventory, or bring them under the same controls.
Most vendors are fine with this once you explain it. They don't want to be the reason a customer got hit with ransomware either.
Step 4: Protect machines you can't patch
Some shop-floor systems simply can't be updated. The vendor won't certify it, the operating system is out of support, or a reboot means scheduling a line shutdown weeks out. That's reality, and pretending otherwise doesn't help anyone.
When you can't patch, you add compensating controls around the machine instead:
- Isolate it. Put it in its own small zone and allow only the exact connections it needs.
- Use application allowlisting. Instead of trying to detect bad software, allow only the specific programs the machine needs to run. This works well on single-purpose systems like HMIs.
- Control USB and removable media. Many plant infections still arrive on a USB drive. Disable unused ports, and set up a scanning kiosk where files get checked before they go anywhere near production.
- Remove what isn't needed. Turn off unused services, remove email and web browsers from HMIs, and delete old local accounts.
- Choose endpoint protection carefully. Some modern EDR tools offer modes designed for industrial systems, but always check with the machine vendor and test on a non-critical system first.
And when you can patch, do it on purpose. Test updates on a spare or a less critical machine, apply them during planned maintenance, and have the vendor's blessing where support contracts require it.
Step 5: Monitor quietly, without touching production
Segmentation and hardening reduce risk, but you also need to know when something odd is happening. On the shop floor, that monitoring should be passive, just like your discovery.
An OT-aware monitoring tool, fed by a mirror port, can alert you when:
- A new device appears on the production network
- An engineering workstation starts talking to a PLC it never talked to before
- Someone uploads a new program to a controller outside a maintenance window
- A device starts reaching out to the internet
These alerts are only useful if someone looks at them. If your team is small, this is a good place to lean on a managed provider that can watch the alerts and call you when something actually matters. That's a big part of what we cover in our post on what to expect from managed IT services.
Step 6: Plan for the bad day
Even well-protected plants have incidents. What separates a bad week from a disaster is usually preparation.
Back up what production depends on
Office backups usually cover servers and file shares. On the plant floor, make sure you also have current copies of:
- PLC and robot programs
- HMI projects and configurations
- Switch and firewall configurations
- Engineering workstation images, where possible
- License files and installation media for critical software
Keep at least one copy offline or otherwise separated from the network, so ransomware can't encrypt it along with everything else. And test a restore. A backup of a PLC program from 2019 is not going to help you much in 2026.
Write down who does what
A one-page plan for the plant floor should answer a few simple questions. Who can authorize disconnecting production from the office network? Who calls the machine vendors? Can the line run safely in manual mode, and for how long? Where are the backups and who knows how to use them?
Decide this with operations, maintenance, and leadership now. Making those calls for the first time in the middle of an incident is how small problems turn into long shutdowns.
How to roll out changes without stopping production
None of the steps above should happen as a big-bang weekend project. Here's the rollout pattern that tends to keep operations on your side:
- Start with listening. Inventory and passive monitoring change nothing on the floor, so they're the safest first step.
- Fix the obvious gaps first. Shared vendor passwords, internet-facing remote desktop, and forgotten modems are quick wins with almost no production risk.
- Segment in stages. Put the firewall in place in "allow and log" mode first, review the logs with controls engineers, and only then start blocking.
- Use planned downtime. Line changeovers, scheduled maintenance, and holiday shutdowns are your windows for anything that needs a reboot.
- Have a rollback plan. For every change, know exactly how to undo it in minutes.
- Involve operations from day one. Bring the plant manager and maintenance lead into planning. When they help design the change, they'll defend it.
Taken together, this approach lets you raise the security of the plant floor steadily over a few months, with little or no unplanned downtime.
Frequently asked questions
What is the difference between IT and OT security?
IT security protects business systems like email, ERP, and file servers, where protecting data is usually the top priority. OT security protects the systems that control physical processes, such as PLCs, HMIs, and robots, where uptime and safety come first. That difference changes how you patch, scan, and monitor.
Can I run a vulnerability scan on my plant floor network?
Be very careful. Active scans send traffic that some older industrial devices don't handle well, and they have been known to cause controllers to crash or reboot. Passive monitoring is a much safer way to discover devices and weaknesses on a production network.
How do I secure old Windows machines on the shop floor that can't be upgraded?
Isolate them in their own network zone, allow only the connections they truly need, use application allowlisting, and control USB access. Remove anything unnecessary, such as web browsers and email clients. These compensating controls reduce risk significantly even when patching isn't possible.
Do small manufacturers really need OT security?
Yes. Attackers often target manufacturers because downtime is so expensive, and smaller plants tend to have fewer defenses. Many incidents also start in the office, through phishing, and spread to production because the networks aren't separated.
Where should a small plant start with OT security?
Start with a complete inventory of what's on the shop floor, then separate the production network from the office network with a firewall. Locking down vendor remote access is another fast, high-value step that rarely affects production.
Where to start
You don't need to solve all of this at once. If you take only three steps this quarter, make them these: build an accurate inventory, put a firewall between the office and the plant floor, and get vendor remote access under control. Those alone close many of the paths attackers use to reach production.
If you'd like help, SoftwarePac offers a free cybersecurity assessment for manufacturers. My partner Mukesh has spent 25 years in cybersecurity, and I've spent 15 years building and running networks. We'll look at how your office and plant floor are connected, where the gaps are, and what to fix first, in plain English and without touching production.
Book your free cybersecurity assessment
Related reading
- Cybersecurity for Roanoke Small Businesses: 10 Steps to Protect Your Company
- Managed IT Services in Roanoke, VA: What Local Businesses Should Expect
- IT Consulting: How to Choose the Right Technology for Your Business
Harsha is a co-founder of SoftwarePac Technologies in Roanoke, VA, and a network engineer with 15 years of experience.