Designing a Shop Floor Network That Doesn't Stop Production
A factory network is not an office network with more dust. The devices on it have different constraints, different lifespans and different consequences when something goes wrong.
The machine controlling a production line may run an operating system that went out of support a decade ago, cannot be patched because the vendor certified a specific configuration, cannot be rebooted during a shift, and was connected to the network years after it was designed — originally to make data collection easier.
That machine cannot be secured the way a laptop is secured. It can be surrounded properly, and that is the whole discipline.
Start with an inventory you have actually verified
You cannot protect what you have not found, and shop floor inventories are reliably incomplete. Typical discoveries:
- machines with network interfaces nobody knew were connected
- vendor remote-access tools installed during commissioning and never removed
- a cellular modem fitted by a service engineer for diagnostics
- an unmanaged switch in a cabinet, added to connect one more device
- wireless bridges spanning areas where cable was inconvenient
Passive discovery is the right tool. Active scanning can disrupt industrial devices — some older controllers fault on unexpected traffic — so use monitoring that observes rather than probes, and coordinate anything active with production.
For each device record: what it is, what it controls, what it talks to, what it runs, who supports it, and what happens if it stops.
That last field is what prioritises everything else.
Segment by consequence, not by convenience
The useful model separates the network into zones with controlled traffic between them:
Enterprise. Ordinary business IT — email, ERP, laptops.
Industrial DMZ. Where the two worlds meet. Data historians, patch servers, jump hosts, remote access brokers. Nothing passes directly between enterprise and control; it goes through here.
Supervisory. HMIs, SCADA servers, engineering workstations.
Control. PLCs, controllers, drives — the devices that actually run the process.
Safety. Safety instrumented systems, isolated by design and governed separately.
The rule that matters: traffic between zones is explicit and inspected, and nothing from the enterprise zone reaches the control zone directly. A compromised laptop in accounts should have no network path to a PLC.
Make it work without stopping production
The main objection to segmentation is that the business cannot afford to find out what breaks. Fair — so do not find out that way.
Monitor first, enforce later. Deploy the segmentation with rules in a permissive, logging mode. Observe for weeks. You now have the real traffic map rather than the documented one, and the list of flows you were about to break.
Enforce one boundary at a time, starting with the least risky — enterprise to industrial DMZ before supervisory to control.
Schedule around production. Changes during planned downtime, with a tested rollback and the people who know the process present.
Expect undocumented flows. There will be a dependency nobody knew about. The monitoring phase is what turns that from an outage into a rule.
Remote access is the control that pays most
Vendor remote access is both operationally necessary and the most common serious exposure. A support engineer needs to reach a machine; the usual arrangement is a permanent tool with standing access and a shared credential.
A better pattern:
- access through a broker in the industrial DMZ, never directly
- disabled by default, enabled per request for a time window
- individual named accounts, with MFA
- sessions recorded
- access scoped to the specific machine
- all of it in the contract, so the vendor cannot claim it blocks support
This is the single change that most reduces risk, and it is contractual and procedural more than technical.
Controls for devices you cannot patch
For the machines that will never be updated:
- Isolate tightly. Only the specific flows they need, to the specific hosts they need
- No internet access. Not for updates, not for telemetry, not for anything
- Control removable media. USB is a primary infection route in industrial environments, often via engineer laptops
- Monitor behaviour. Industrial protocols are predictable; a controller suddenly talking to something new is a strong signal
- Protect the engineering workstation. It is frequently the weakest link and has legitimate access to everything
- Document the accepted risk, with an owner and a review date tied to the machine's replacement
Resilience is not the same as security
Production networks also need to keep running:
- Redundant paths for critical segments, with a loop prevention protocol configured deliberately
- Managed switches, not whatever was in the cabinet
- Environmental hardening — temperature, vibration, dust ratings appropriate to the floor
- Clean power on network equipment, with UPS protection
- Spares on site for the switches whose failure stops a line. The lead time on a replacement is production downtime
- Configuration backups for every network device, so a failed switch is a swap rather than a rebuild
Where to start
- Passive inventory. Find everything.
- For each device, record what stops if it stops.
- Map actual traffic in monitoring mode.
- Fix vendor remote access — highest value, lowest production risk.
- Establish the industrial DMZ.
- Enforce boundaries one at a time, around production schedules.
- Add behavioural monitoring on the control zone.
- Document accepted risks for unpatched machines, with review dates.
The order matters. Organisations that start by enforcing segmentation discover their traffic map by breaking production, which ends the programme. Organisations that start by watching get the same information for free.
