Operational technology (OT) runs the physical side of a business: production lines, PLCs, HVAC controls, packaging equipment, and building systems. For years these systems sat on isolated networks and were rarely targeted. That has changed. As plants connect machines to business systems for reporting, remote support, and efficiency, OT has become a direct path for attackers to stop production.
Securing OT is different from securing office IT. Uptime and safety come first, equipment can be decades old, and you often cannot patch or reboot whenever you want. These best practices are built around those realities.
1. Build A Complete Asset Inventory
You cannot protect what you do not know exists. Start with a full list of OT devices: controllers, HMIs, engineering workstations, sensors, and any vendor-installed remote access tools. Record firmware versions, network connections, and who is responsible for each system. Passive network monitoring tools can discover devices without disrupting production.
2. Segment OT From IT
Network segmentation is the single most important control for OT security. Production systems should not sit on the same flat network as email and office PCs. Use firewalls and VLANs to create zones, and only allow the specific traffic that is required between them. A common approach is a demilitarized zone (DMZ) between IT and OT where data historians and remote access servers live.
3. Control Remote Access
Equipment vendors often need remote access for support. Uncontrolled remote access tools are one of the most common ways attackers reach OT networks. Require all remote connections to go through a single, monitored gateway with multi-factor authentication, and enable vendor access only when needed. Our network security services help plants put these controls in place without slowing down support.
4. Monitor For Unusual Activity
OT networks are usually predictable. The same devices talk to each other in the same way every day. That makes anomalies easier to spot. Continuous monitoring can alert you when a new device appears, a controller receives an unexpected command, or an engineering workstation reaches out to the internet.
5. Harden Engineering Workstations
Engineering workstations and HMIs are often the weak point because they run standard operating systems and connect to both worlds. Remove unnecessary software, restrict USB use, apply application allowlisting, and protect them with endpoint security that is tested to be compatible with your control software.
6. Patch Strategically
Patching OT can require planned downtime and vendor approval. Prioritize based on risk: internet-facing systems, remote access gateways, and engineering workstations first. When a device cannot be patched, use segmentation and monitoring as compensating controls, and document the decision.
7. Back Up Configurations And Recovery Images
Keep current backups of PLC programs, HMI projects, and workstation images. Store copies offline or in immutable storage so ransomware cannot encrypt them. Test that you can actually restore a controller program or rebuild a workstation within your production recovery window.
8. Plan For Incidents Before They Happen
Build an incident response plan specific to OT. Decide in advance who can authorize shutting down a line, how to switch to manual operations, and how IT, operations, and vendors will coordinate. Run a tabletop exercise with plant leadership at least once a year.
9. Train Plant And IT Staff Together
IT teams need to understand production priorities, and operations teams need to understand cyber risks. Joint training builds trust and helps both sides make better decisions when something goes wrong.
Start With The Biggest Risks
You do not have to fix everything at once. For most manufacturers, the highest-impact first steps are an asset inventory, segmentation between IT and OT, and locking down remote access. Those three changes dramatically reduce the chance that a phishing email in the office turns into a production shutdown.
CTS Companies works with Michigan manufacturers to secure both their business and production networks. Learn more about our cybersecurity services for manufacturing, or talk to an expert about an OT security assessment.