IT and OT security in manufacturing: how to protect your production line

In a manufacturing company, downtime is the most expensive failure there is. Yet machines and production systems are increasingly connected to the office network, the cloud and suppliers who look in remotely. Every connection opens a door.

In this guide, we set out how to make the bridge between IT and OT secure, based on the projects we run with our clients.

OT stands for operational technology: the systems that control your production, such as PLCs, HMIs, SCADA and DCS systems. OT security protects those systems against cyberattacks and disruptions, so your production keeps running safely and without interruption.

OT differs from office IT. Machines often run the same software for years, updates can disrupt production and availability comes first. That is why OT needs its own approach, with the IEC 62443 standard as the international reference framework.

In many factories, IT and OT have grown together over the years, without a clear separation. A supplier logs in remotely through an outdated connection. A laptop on the shop floor runs an operating system that has not received updates for years. And who is responsible for securing the machines, IT or production, is often unclear.

On top of that comes NIS2: manufacturing companies in sectors such as food, chemicals, medical devices, machinery and vehicles fall under the new law above a certain size.

Make an overview of all systems, both in the office and on the shop floor. Which machines are connected, to which network and with whom? Which suppliers have remote access? Without that overview, you do not know what you are protecting.

Network segmentation is the most important measure. By shielding your OT network from your office network, an attack on a laptop or mailbox stays limited to the office environment. Define per zone which traffic is allowed, and block the rest.

Suppliers and technicians sometimes need remote access to your machines. Let that run through a single secure access point, with multi-factor authentication, only when needed and with a log of who did what.

Most attacks start in office IT, with a phishing email or an unpatched device. Manage your laptops and servers centrally, roll out updates in a planned way and make sure you have backups that protect you against ransomware and that you have actually tested.

A production line does not stop at five o'clock, and neither does an attacker. A Security Operations Center (SOC) follows up alerts 24/7 and intervenes before an incident turns into downtime.

A secure connection between IT and OT also opens up opportunities. With data from your production, you can monitor and adjust processes, and with AI you can check quality on the line. That is how a manufacturing SME uses computer vision to pull defective bags off the line before they go into the container.

• Does the partner understand that availability comes first in production?

• Can the partner segment your networks and secure remote access?

• Is there a SOC that monitors your environment 24/7?

• Does the partner know NIS2 and the IEC 62443 framework?

• Can the partner build further with data and AI for your production?

Xylos is a Belgian family-owned tech company headquartered in Antwerp, with forty years of experience and more than 150 certified experts. Xylos is ISO 27001 certified and a Microsoft Solutions Partner for Security.

Xylos works with Palo Alto Networks for network security, HPE for secure infrastructure and Cohesity for data protection and ransomware recovery. Managed Security monitors your environment 24/7 with our SOC, together with Eye Security. With the NIS2 Quickscan, you quickly map where you stand. Through Data & AI, Xylos helps manufacturing companies put their data and AI to work on the shop floor. Xylos works for Kaneka and Neuhaus, among others.

Curious how secure the bridge between your office and your shop floor is? Plan a conversation with our experts or take the NIS2 Quickscan.