OTVista
Book a demo

OT cybersecurity for manufacturing

Manufacturing environments change constantly: new lines, retooling, integrator projects and closer integration with business systems. Security has to keep pace without slowing production.

Industry sheet
Sector
Manufacturing and industrial automation
Representative systems
6
Typical challenges
5
Example
Illustrative

Industry context

Covers:

  • Discrete manufacturing
  • Batch and continuous production
  • Assembly and test facilities
  • Industrial equipment and electrical products

Production networks connect PLCs, robots, HMIs and line servers to MES and ERP systems. That integration delivers efficiency, and it also creates paths between business networks and the shop floor.

Many sites run equipment from several generations and vendors, commissioned by different integrators, with network designs that evolved line by line.

Reference architecture

Site C: Discrete manufacturing plant

MES and site services above production cells, each cell its own zone behind a cell firewall. Select a zone to see its role, key risks and recommended controls.

Site C Discrete manufacturing plantMES and site services above production cells, each cell its own zone behind a cell firewall.
Site C: Discrete manufacturing plant OT reference architecture (Manufacturing) L4 L3.5 L3 L1–L2 L0 Corporate WS, Enterprise IT Corporate WS ERP, Enterprise IT ERP PLM, Enterprise IT PLM Edge router, Enterprise IT Edge router MES replica, Industrial DMZ MES replica Remote access, Industrial DMZ Remote access Patch / AV, Industrial DMZ Patch / AV DMZ switch, Industrial DMZ DMZ switch MES server, Site operations MES server Historian, Site operations Historian Engineering WS, Site operations Engineering WS Backup, Site operations Backup Core switch, Site operations Core switch Cell HMI, Cell 1: Assembly Cell HMI Line PLC, Cell 1: Assembly Line PLC Robot ctrl, Cell 1: Assembly Robot ctrl Cell switch, Cell 1: Assembly Cell switch Test HMI, Cell 2: Test Test HMI Test PLC, Cell 2: Test Test PLC Test bench, Cell 2: Test Test bench Cell switch, Cell 2: Test Cell switch Robot arm, Machines and field devices Robot arm Conveyor, Machines and field devices Conveyor VFD drive, Machines and field devices VFD drive Vision camera, Machines and field devices Vision camera Remote I/O, Machines and field devices Remote I/O Enterprise ITIT Industrial DMZSL 2 Firewall: HTTPS, REST APIsHTTPS, REST APIs Site operationsSL 2 Firewall: OPC UA, MQTTOPC UA, MQTT Cell 1: AssemblySL 2 Firewall: OPC UA from MESOPC UA from MES Cell 2: TestSL 2 Firewall: OPC UA from MESOPC UA from MES Machines and field devicesSL 1 Assessment scope
Enterprise ITDMZOT operationsCritical controlField / safety

Tap a zone for its risks and controls, or a device for its security requirements.

Illustrative reference architectures, simplified for clarity. Security levels shown are example targets. Not live data.

Representative OT systems and dependencies

  • PLCs and controllersLogic controlling machines, cells and lines.
  • HMIs and SCADAOperator interfaces and supervisory systems for production areas.
  • Engineering workstationsSystems used to program controllers and robots.
  • Industrial networksFieldbus and industrial Ethernet networks, switches and wireless.
  • MES and line serversSystems connecting production to scheduling, quality and traceability.
  • Test and assembly systemsTest benches and stations that may connect to external equipment.

Common cybersecurity challenges

  • Flat production networksLines added over time without consistent segmentation.
  • Integrator and OEM accessMachine builders who need remote support for their equipment.
  • Maintenance windowsChanges restricted to planned stops and shift patterns.
  • Removable media and laptopsEngineering files moved between systems on portable devices.
  • IT/OT convergenceMES, cloud and analytics connections to the shop floor.

Relevant assessment areas

  • Cell and line segmentation
  • OEM and integrator remote access
  • Engineering workstation and removable media control
  • Controller program backup and change control
  • Asset inventory across lines and sites
  • MES and DMZ boundary design

Relevant OTVista services

Establishing a baseline across several plants

Illustrative example

Situation

A manufacturer with several plants wants a consistent picture of OT security, but each site has different equipment, documentation and local practices.

Result

Leadership gets comparable results across sites, and common gaps can be addressed with shared solutions rather than site-by-site projects.

Structured approach

  1. Agree a common control set and rating scale for all sites.
  2. Assess one pilot site and refine the approach.
  3. Apply the same method to remaining sites.
  4. Compare results and identify common improvements.

This scenario is a hypothetical example of a common situation in the sector, not a description of OTVista client work.

Questions from manufacturing and industrial automation teams

Where should a manufacturer start with OT security?

Usually with an asset inventory and a basic assessment of segmentation and remote access, because these shape almost every other decision.

How do we secure OEM remote access?

Route vendor access through a controlled, logged gateway, enable it only when needed, use individual accounts and limit what each vendor can reach.

From the blog

Latest OT security insights

All posts

Discuss OT cybersecurity for your operations

Tell us about your sites, systems and priorities, and we'll suggest a practical starting point.

Request a consultation