Modern factories are as much digital operations as physical ones. Production lines run on programmable logic controllers, plants are monitored through SCADA and historian systems, engineers connect remotely to maintain equipment, and ERP and MES platforms link the shop floor to customers and suppliers. That connectivity drives efficiency, but it also means a cyberattack can stop production, damage equipment, compromise product quality, or put workers at risk.
This article looks at cybersecurity in manufacturing: why the sector is targeted, the unique challenges of operational technology (OT), the most common attack paths, and a practical framework manufacturers can use to strengthen their defenses.
Why Manufacturers Are Targeted
- Low tolerance for downtime: every hour of stopped production has a measurable cost, which ransomware groups exploit.
- Valuable intellectual property: designs, formulas, and process know-how attract espionage.
- Supply chain leverage: manufacturers are links in larger chains, and an attack on one supplier can disrupt many customers.
- Legacy technology: industrial systems often run for decades and weren’t designed with modern security in mind.
- IT/OT convergence: connecting plant systems to corporate networks and the cloud creates new paths from email phishing to the factory floor.
A well-known example is the 2019 LockerGoga ransomware attack on aluminum producer Norsk Hydro, which forced several plants to switch to manual operations while systems were restored. The company’s decision to share details publicly made it a widely cited case study in operational resilience.
IT vs OT: Why Manufacturing Security Is Different
| Aspect | Corporate IT | Operational Technology (OT) |
|---|---|---|
| Top priority | Confidentiality of data | Safety and availability of physical processes |
| System lifespan | 3 to 5 years | 15 to 30 years or more |
| Patching | Frequent, often automated | Infrequent, requires vendor validation and planned downtime |
| Protocols | Modern, often encrypted | Industrial protocols, many without authentication |
| Impact of an incident | Data loss, business disruption | Production stoppage, equipment damage, safety hazards |
| Security tooling | Endpoint agents widely deployable | Agents often unsupported; passive monitoring preferred |
Our article on IT vs OT cybersecurity explores these differences further, and IoT vs OT security covers connected devices.
Key Cybersecurity Challenges in Manufacturing
1. Ransomware Spreading From IT to OT
Many manufacturing ransomware incidents begin in corporate IT, through phishing or exposed remote access, then reach OT through flat networks or shared credentials. Even when OT isn’t directly encrypted, plants are often shut down as a precaution because of dependencies on IT systems such as MES, scheduling, or shipping.
2. Flat Networks and Weak Segmentation
Plants that grew over decades frequently have flat networks where office PCs, engineering workstations, and controllers share connectivity. This lets attackers move easily from one to another.
3. Insecure Remote Access
Equipment vendors and integrators often need remote access for maintenance. Unmanaged remote desktop tools, shared accounts, and always-on connections create direct paths into production networks.
4. Default and Shared Credentials
Industrial devices are frequently deployed with default passwords that are never changed, and operators often share accounts for convenience. Our article on why default passwords must go in manufacturing covers this persistent problem.
5. Limited Asset Visibility
Many manufacturers lack a complete inventory of OT assets, firmware versions, and communication paths. You can’t protect or patch what you don’t know exists.
6. Unpatchable or Hard-to-Patch Systems
Controllers and HMIs may run end-of-life operating systems, and patching can require vendor approval and production downtime. Compensating controls become essential.
7. Supply Chain and Customer Requirements
Manufacturers increasingly face security requirements from customers, such as TISAX in the automotive sector, and must also manage risk from their own suppliers and software vendors.
8. Skills Gap Between IT and OT Teams
IT security teams may not understand industrial processes, while engineering teams may not be trained in cybersecurity. Effective programs need both perspectives.
Frameworks for Manufacturing Cybersecurity
- ISA/IEC 62443: the leading series of standards for industrial automation and control system security, covering zones and conduits, security levels, and requirements for asset owners, integrators, and product suppliers.
- NIST SP 800-82 Rev. 3: guidance on OT security, including architecture, risk management, and applying security controls to industrial environments.
- NIST Cybersecurity Framework 2.0: a governance-level framework that can integrate IT and OT risk management.
- ISO 27001: commonly used for the corporate side of manufacturing businesses and to demonstrate assurance to customers.
CISA’s industrial control systems resources also publish advisories and guidance relevant to manufacturers.
A Practical Manufacturing Cybersecurity Framework
1. Build an OT Asset Inventory
Use passive network monitoring and engineering documentation to identify controllers, HMIs, engineering workstations, historians, and network devices, along with firmware versions and communication flows.
2. Segment IT and OT
Create a clear boundary between corporate IT and plant networks, with an industrial demilitarized zone (DMZ) for data exchange. Within OT, apply zones and conduits per ISA/IEC 62443 so that a compromise in one area can’t easily spread to others. A network architecture review helps design and validate this structure.
3. Secure Remote Access
Route all vendor and engineer remote access through a controlled gateway with MFA, individual accounts, approval workflows, session recording, and time limits. Remove unmanaged remote access tools.
4. Fix Credentials and Access
Change default passwords, eliminate shared accounts where feasible, and apply least privilege to engineering workstations and controllers. Follow the principles in our privileged access management best practices.
5. Monitor OT Networks
Deploy OT-aware network monitoring that understands industrial protocols and can detect unusual commands, new devices, or unexpected communication. Integrate alerts with the security operations center so IT and OT incidents are correlated.
6. Manage Vulnerabilities Pragmatically
Prioritize vulnerabilities by exploitability and process impact. Where patching isn’t possible, use compensating controls such as segmentation, application allowlisting, and restricting communications.
7. Plan for Resilience
Maintain offline backups of controller logic, configurations, and engineering projects. Document manual operating procedures and test recovery. Securis360’s business continuity and disaster recovery planning services help build these capabilities.
8. Bring IT and OT Teams Together
Establish shared governance, joint incident response plans, and cross-training. Engineers should be involved in any security change that could affect production.
9. Manage Supply Chain Risk
Assess suppliers and integrators, set security requirements in contracts, and request software bills of materials where available.
10. Test Safely
Security testing in OT needs careful planning. Passive assessments, architecture reviews, and testing in staging or during planned downtime reduce operational risk. Securis360’s OT and IoT security services are designed with these constraints in mind.
Quick Wins for Manufacturers
- Enforce MFA on remote access and email.
- Inventory and lock down vendor remote access.
- Change default passwords on industrial devices.
- Separate office and plant networks with a firewall and DMZ.
- Back up controller logic and configurations offline.
- Run a tabletop exercise on a ransomware scenario that affects production.
Building the Business Case for OT Security
Manufacturing security investments compete with production priorities, so the business case needs to speak the language of operations and finance.
- Quantify downtime: estimate the cost of an hour or a day of lost production for each critical line or plant, including missed deliveries and contractual penalties.
- Link to safety: explain how unauthorized changes to control systems could affect worker safety and product quality, which resonates strongly with plant leadership.
- Show customer requirements: automotive, aerospace, defense, and pharmaceutical customers increasingly require evidence of security controls in supplier assessments and contracts.
- Connect to insurance: cyber insurers often ask about segmentation, remote access controls, and backups for OT environments.
- Start with quick, visible wins: securing vendor remote access and backing up controller configurations deliver clear risk reduction at modest cost.
Presenting OT security as a contributor to uptime, quality, and customer retention, rather than as an IT cost, helps secure sustained support from plant managers and executives alike.
Frequently Asked Questions
Why is cybersecurity important in manufacturing?
Because cyberattacks can stop production, damage equipment, affect product quality and worker safety, steal intellectual property, and disrupt supply chains, all with significant financial impact.
What is OT security?
OT security protects the hardware and software that monitor and control physical processes, such as PLCs, SCADA systems, and HMIs, with a focus on safety and availability.
What is ISA/IEC 62443?
It’s an international series of standards for securing industrial automation and control systems, covering requirements for asset owners, system integrators, and product suppliers, including concepts such as zones, conduits, and security levels.
How can manufacturers secure legacy industrial systems?
Through segmentation, restricted communications, secure remote access, monitoring, application allowlisting, and offline backups, since patching may not always be possible.
Can penetration testing be done safely in OT environments?
Yes, with careful scoping. Testers typically favor passive techniques, test in staging environments or during maintenance windows, and coordinate closely with engineering teams to avoid disrupting production.
Key Takeaways
- Manufacturers face high-impact threats because downtime, IP, and supply chain position are valuable to attackers.
- OT security prioritizes safety and availability and requires different approaches from IT.
- Asset visibility, IT/OT segmentation, secure remote access, and credential hygiene are foundational.
- Use ISA/IEC 62443 and NIST SP 800-82 to structure a program, and bring IT and engineering teams together.