A phishing email opened in the accounts office should never be able to stop a production line. In many South African plants it still can, because the corporate and operational technology (OT) networks grew together and nobody drew a line between them.
The IBM X-Force Threat Intelligence Index 2026 records manufacturing as the most attacked industry for the fifth consecutive year, with 27.7% of incidents among the top industries. Data theft was the most common impact, at 40%. The leading ways in were exploitation of public-facing applications (32%), valid accounts (16%) and external remote services (11%). None of those starts on a programmable logic controller (PLC). They start in IT and spread.
This checklist sets out the controls we apply at the IT/OT boundary for manufacturing customers.
Know what is on the plant network
Segmentation fails when the map is wrong. Before any firewall rule changes, build an inventory of every device that touches production:
- PLCs, human-machine interfaces (HMIs), SCADA servers and historians, with vendor, model and firmware version
- Engineering workstations, quality terminals and plant-floor PCs, with operating system and patch status
- Every path into the OT network: vendor remote support tools, 4G routers, USB ports, Wi-Fi access points and dual-homed machines
- The applications that cross the boundary, such as the ERP or manufacturing execution system (MES) pulling production counts
NIST SP 800-82 Revision 3, the Guide to Operational Technology Security, is the reference we use. It is explicit that OT has performance, reliability and safety requirements that ordinary IT controls must respect, so discovery on the plant side is done passively or with the vendor's agreement; a routine office port scan can crash an older controller.
Draw the zones and control the conduits
The aim is simple to state: traffic between the corporate network and the production network passes through a small number of controlled points, and nothing else.
- Place the OT network in its own zone, with sub-zones for cells or lines where a fault in one should not reach another.
- Put the systems that both sides need, such as the historian, the MES interface and patch repositories, in an industrial demilitarised zone (DMZ) between them. IT reads from the DMZ; the DMZ reads from OT. Nothing on the corporate side talks to a controller directly.
- Write firewall rules by application and direction, not by subnet: default deny both ways, then allow only the flows the inventory shows are needed.
- Remove dual-homed machines. A PC with one cable in each network bypasses every rule above.
NetScaler enforces this separation for the web-facing and application layers, including Web Application Firewall protection for any system that must be reachable from outside.
Fix remote access first
External remote services and valid accounts together account for more than a quarter of the initial access IBM observed. In manufacturing that usually means an OEM engineer's VPN, a vendor's support tool or a shared service account with a password nobody has changed in years.
- Give vendors named accounts with multi-factor authentication, time-limited access and a record of each session.
- Publish engineering and ERP applications through Citrix virtual apps and desktops rather than opening network paths. The user sees the application; the data and the controller network stay in the data centre.
- Disable remote access that is not in the inventory. If nobody can say who uses a path, close it.
Our zero trust guide covers the identity side in more depth.
Protect and watch the endpoints you can
A PLC should never run an agent. Windows-based HMIs, engineering stations and quality terminals can, and they are where ransomware actually executes.
- Protect: SentinelOne runs behaviourally on each supported device and keeps working without a connection to the console, which matters at sites with unreliable links. Rollback restores files on a device that was hit.
- Detect: N-able N-central gives one view of patch state, alerts and device health across plants, warehouses and offices. Unsupported operating systems that cannot be patched are flagged, isolated by the zoning above and scheduled for replacement rather than forgotten.
- Recover: Cove Data Protection backs up servers, workstations and Microsoft 365. N-able describes Cove backups as encrypted, immutable and isolated by default, with cloud storage in South Africa among its data centre locations. Include controller programs and HMI project files; they are often held only on one engineer's laptop.
Test the recovery, not just the backup. Our immutable backup article explains why a copy ransomware cannot alter is the one that gets a plant running again.
Keep the paperwork ready
A plant with a large workforce holds a lot of personal information, and the Protection of Personal Information Act (POPIA) applies to it. Condition 7 of the Act, sections 19 to 22, requires security safeguards and the notification of security compromises. Since April 2025 the Information Regulator directs organisations to report compromises through its eServices portal, and notification to the Regulator and to affected data subjects must happen as soon as reasonably possible.
Segmentation limits how far a compromise can spread, which limits what must be reported. The inventory, zone diagram and firewall rule set are also the evidence an OEM audit, a TISAX assessment or an ISO 27001 review will ask for. Our POPIA compliance article covers the notification duty in detail.
A realistic order of work
Most plants cannot stop to rebuild their network. A workable sequence:
- Inventory and diagram, including every remote path (two to four weeks).
- Remote access controls and vendor accounts, because they close the most common entry points quickly.
- The industrial DMZ and the first coarse IT/OT firewall rules.
- Endpoint protection and monitoring on every supported device.
- Backups of controller programs and plant systems, then a recovery test.
- Finer zoning between lines, done cell by cell at planned maintenance windows.
Each step reduces risk on its own, so the programme runs alongside production rather than waiting for a shutdown.
Sources
- IBM X-Force Threat Intelligence Index 2026: industry trends, accessed 4 November 2026.
- NIST SP 800-82 Revision 3, Guide to Operational Technology (OT) Security, published 28 September 2023 and accessed 4 November 2026.
- Information Regulator: POPIA Condition 7, security safeguards (sections 19 to 22), accessed 4 November 2026.
- Covington, South Africa introduces mandatory e-portal reporting for data breaches, published 15 April 2025 and accessed 4 November 2026.
- N-able Cove Data Protection product page, accessed 4 November 2026.
Need help separating your plant network from your office network? Talk to OAS about managed security for manufacturing.