A ransomware attack on your IT systems is a business problem. A ransomware attack on your OT network is a production floor problem — CNC machines stop, PLCs go dark, SCADA loses visibility, and physical operations halt. The Colonial Pipeline attack cost $4.4M in ransom. The Norsk Hydro attack cost $71M in remediation. The common thread: inadequate OT/IT separation.
Why Production Networks Are Fundamentally Different
IT security prioritizes Confidentiality → Integrity → Availability (CIA triad). OT security inverts this: Availability → Integrity → Confidentiality. A production PLC that goes offline for a security patch causes physical downtime and potential safety incidents. This fundamental conflict means you cannot treat OT devices like IT endpoints — you need a different architecture.
Legacy Devices
CNCs, PLCs, and SCADA systems often run Windows XP/7 or proprietary OS with no patch support. They cannot run endpoint security agents.
Real-time Requirements
Industrial control systems require deterministic, low-latency communication. Firewall inspection delays are not acceptable at the machine level.
Flat Networks (Legacy)
Most production floors built before 2015 have completely flat networks — every machine can see every other. One compromised device = full network access.
The Purdue Model (ISA-99/IEC 62443)
The Purdue Enterprise Reference Architecture defines five network levels for industrial environments. Strict separation between levels — with controlled, logged communication at every boundary — is the foundation of secure OT architecture.
Level 0 — Field Devices
Physical sensors, actuators, motors, valves. No network connectivity; communicate via fieldbus (Modbus RTU, PROFIBUS) to Level 1.
Level 1 — Process Controllers
PLCs and DCS controllers. Limited IP connectivity. These devices are the most critical and should never be directly internet-accessible.
Level 2 — Supervisory
SCADA, HMI workstations. Operator consoles. Isolated VLAN. No direct internet access. Communication to Level 3 via DMZ only.
Level 3 — Manufacturing Operations
MES, ERP interfaces, production historians (OSIsoft PI). The primary integration layer between OT and IT. Heavily monitored DMZ zone.
Levels 4–5 — Enterprise IT
Standard IT network: ERP, email, internet access. Separated from Level 3 by a full industrial firewall (Fortinet FortiGate, Palo Alto, Cisco Firepower).
VLAN Design for a Production Facility
VLANs (Virtual LANs) separate network traffic logically without requiring separate physical cabling. Every VLAN should have a dedicated purpose, restricted inter-VLAN routing, and all cross-VLAN traffic should pass through a firewall for inspection and logging.
Industrial Firewall Zones & DMZ Configuration
The DMZ (De-Militarized Zone) is a network segment that acts as a buffer between OT and IT. No direct connections should exist between the IT network and the OT network — all traffic must pass through the DMZ and be inspected. For industrial environments, a two-firewall DMZ architecture (inner firewall for OT, outer firewall for IT) provides defense-in-depth.
Key firewall rules: (1) Default DENY all inter-VLAN traffic, explicitly PERMIT only required flows. (2) All OT-to-IT communication must be initiated from the OT side and flow through a data diode or one-way replication service. (3) Remote access to OT systems must use a jump server (bastion host) inside the DMZ — never direct inbound connections to PLCs or SCADA. (4) All firewall logs must be forwarded to a SIEM and retained for 90+ days.
Industrial Protocols & Their Security Implications
| Area | Industry 4.0 | Industry 5.0 |
|---|---|---|
| Protocol | Used For | Security Consideration |
| Modbus TCP | PLC communication, legacy SCADA | No authentication. Deploy on isolated VLAN only. Use Modbus TCP firewall rules to restrict to known source IPs. |
| OPC-UA | Modern ICS data exchange | Supports authentication and encryption. Use security mode: Sign & Encrypt. Preferred protocol for OT/IT integration. |
| EtherNet/IP | Allen-Bradley PLCs, Rockwell systems | CIP security available in modern implementations. Segment onto dedicated VLAN. Monitor for unexpected device registrations. |
| PROFINET | Siemens PLCs, German automation | Isolate on dedicated VLAN. PROFINET-aware firewall rules required. Block external DCP broadcasts. |
| MQTT | IoT sensors, edge computing | Use TLS 1.2+, certificate authentication. Separate IoT broker in DMZ. No direct MQTT access to production VLAN. |
Monitoring & Incident Response for OT Environments
Passive monitoring (traffic mirroring to an IDS) is the safest approach for OT networks — active scanning can crash older PLCs. Tools like Claroty, Nozomi Networks, and Dragos provide passive OT-specific anomaly detection that understands industrial protocols natively.
The single most impactful action most production facilities can take today costs nothing: conduct a network audit and document every device, its IP address, its OS/firmware version, and what it communicates with. You cannot secure what you haven't mapped. In 13 years of shipyard IT, the floor always surprises you.