Ransomware in Manufacturing: Why Office and Plant Networks Must Be Separate
Picture a normal Tuesday: someone in accounts opens a fake invoice attachment. By lunchtime, the office file server is encrypted. By mid-afternoon, the PCs that run your CNC machines, label printers and shipping station are encrypted too, and production stops. The reason it spread is almost always the same: the office and the plant floor were on one flat network. This guide explains why network separation matters so much for manufacturers, and how to do it without disrupting production.
Why manufacturers are a target
- The Canadian Centre for Cyber Security describes ransomware as the top cybercrime threat facing Canada’s critical infrastructure (Cyber Centre).
- Manufacturers lose money for every hour the line is stopped, which attackers know increases the pressure to pay.
- Many machines rely on older computers that cannot easily be updated, which makes them easy targets once an attacker is inside.
Flat network vs segmented network
| Flat network | Segmented network | |
|---|---|---|
| How it works | Office PCs, servers, machines, Wi-Fi and cameras all on one network | Separate zones for office, production, guests and cameras, with a firewall in between |
| If one PC is infected | Ransomware can reach everything | The damage is contained to one zone |
| Old machine PCs | Exposed to everything on the network | Only allowed to talk to what they need |
| Recovery | Whole business down | Production can often keep running while the office is cleaned up |
A practical segmentation plan in 5 steps
- Map what you have. List every device: office PCs, servers, machine controllers and their PCs, scanners, printers, cameras, Wi-Fi. Note which ones talk to each other and why.
- Define zones. A typical small plant needs four: office, production, guest Wi-Fi, and building systems such as cameras and access control.
- Put a firewall between zones. Allow only the connections that are genuinely needed, for example the ERP server sending jobs to a specific machine PC, and block everything else by default. See our firewall management.
- Protect legacy machines. Machine PCs that cannot be upgraded stay in the production zone, with no email, no web browsing and no direct internet access. Our Windows 10 deadline guide covers what to do with older Windows systems.
- Change it during planned downtime. Segmentation is introduced zone by zone during a shutdown or between shifts, tested, and documented, so the line never stops unexpectedly.
Segmentation is one layer, not the whole answer
- ☐ MFA on email and remote access, the most common way attackers get in
- ☐ Endpoint protection on every office and server PC
- ☐ Remote access for machine vendors through a controlled, logged connection, never an always-on tool
- ☐ Backups that ransomware cannot reach, with a tested plan to restore ERP and production data. See disaster recovery.
- ☐ Staff awareness training, because most attacks still start with an email
These line up with the Canadian Centre for Cyber Security’s baseline security controls for small and medium organizations.
Frequently asked questions
Will segmentation slow down our network?
No. Properly designed segmentation with a business-grade firewall has no noticeable effect on everyday speed, and often improves reliability by reducing unnecessary traffic.
Our machine vendor needs remote access. Is that still possible?
Yes. Vendors connect through a controlled remote access method that you turn on when needed, with logging, instead of a permanent open connection.
How long does it take to segment a small plant?
Planning and mapping usually take a few days. The changes themselves are done in stages during planned downtime, often over one or two shutdown windows.
Is your shop floor one click away from a shutdown?
Book a free IT assessment. We will map your office and production networks and show you how to contain ransomware without disrupting production.
See how we support manufacturers on our IT services for manufacturing page, and explore our network security, cybersecurity and managed IT services.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
