Photo by Daniel Smyth / Pexels
The most common mistake I see on a shop floor is not a missing firewall. It is treating production equipment like another office computer. A CNC machine, a controller, a camera system, a vendor appliance, and somebody's laptop should not all automatically be able to communicate with each other. Once a piece of production equipment is connected, I want to know exactly what it needs to talk to, and block everything else. CISA specifically recommends segmentation between industrial systems and the corporate network for exactly that reason.
That is the principle. The questions below are what I would actually walk through with a plant before anything new gets plugged in.
Why this plays out differently in a small Rhode Island shop
The security principles here are not Rhode Island specific. What is different is who is available to do the work and what the building looks like.
Most manufacturers in this state are small shops. There is no controls engineer down the hall and no operational-technology security team. The owner is often also the plant manager, the purchasing department, and the person who decides whether a machine goes on the network. The machine vendor is usually out of state, sometimes overseas, which means the vendor's answer to every support question is remote access, because sending a tech to Rhode Island is not realistic for them.
The other local reality is the buildings. Plenty of shops here operate out of mill space older than anything in it, with network cable added in layers over twenty years by whoever happened to be on site. Nobody has an accurate drawing of what is connected to what. You cannot segment a network you have not mapped, and in a building like that the only honest way to find out is for someone to walk the floor with the cabinet doors open and trace it. That is one of the few parts of this job where being able to physically show up genuinely matters.
What does this machine actually need to talk to?
Start from nothing allowed, then add what the equipment requires. For most machines the honest list is short:
- A specific PC or server that holds the programs and the files it pulls
- A specific person or station that loads jobs to it
- One defined path for vendor support, if the vendor truly needs one
- Nothing else
What is usually not on that list: the open internet, the office file server, the guest wireless, the accounting workstation, and the other eleven machines. If nobody at the plant can answer what a machine needs to reach, that is the first thing to fix, not a reason to put off the conversation.
Vendor remote access: fine, but not permanently open
I do not have a problem with a machine vendor having remote access if they legitimately need it. I have a problem with permanent, uncontrolled access that nobody at the plant monitors. There is a real difference between those two things, and the second one is usually what is in place.
Vendor access should be restricted to the equipment they support, authenticated properly, logged, and ideally enabled only when it is needed. CISA specifically recommends against persistent vendor connections into control networks, and recommends monitoring remote connections. In practice, ask the vendor what they actually require. A lot of them are fine with a connection that gets opened for a service call and closed afterward. The standing always-on tunnel is frequently just what got set up on install day and never revisited.
What is the plan for the controller we cannot patch?
I am actually pretty pragmatic about old manufacturing equipment. If a $300,000 machine works perfectly but its controller requires an old version of Windows, telling the owner to replace the machine is not a serious answer. Nobody scraps a working machine over an operating system, and an IT provider who leads with that is not going to be taken seriously on the shop floor.
The line gets crossed when everyone knows the system cannot be patched and it is left sitting on the same network with unrestricted internet and office access anyway. That is not pragmatism, that is pretending the risk is not there. Managing it instead looks like four things:
- Isolate it from the rest of the network
- Restrict what it is allowed to communicate with, in both directions
- Control and monitor vendor access to it
- Make sure you can actually recover it, including the controller image, the configuration, and the machine programs
That last one gets skipped the most. On a machine this old, the recovery question is not just whether a backup exists. It is whether anyone knows how to get that controller back to a running state, how long it would take, and whether the vendor still supports the process at all. That is worth finding out on a quiet week rather than during a shutdown.
Who owns this - you, the machine vendor, or your IT provider?
Ultimately, the manufacturer owns the risk. The machine vendor understands the equipment and the IT provider understands the network and the security around it, but neither one should independently decide what is acceptable for the business. Only the owner can make that call, because only the owner carries the cost of being wrong.
Almost every problem I see in this area comes from the same place: everyone assumed somebody else handled it. The fix is unglamorous. For every production system that matters, the plant should be able to name who is responsible for patching, remote access, backups, network security, and recovery. If any of those five has no name next to it, that is your answer about whether it is covered.
If you have budget for exactly one improvement this year
Separate the production network from the regular office network. That is where I would put the money.
For a small Rhode Island manufacturer, this does not need to become an enormous industrial-security project with a six-figure price tag. A properly designed firewall and a few sensible network segments can make a huge difference. The goal is simple: if an office computer gets compromised, I do not want the attacker automatically having a path to the machines that actually make the company's product. Office problems should stay office problems.
If you are about to connect new equipment, or you already know there is a machine out there nobody wants to touch, the useful first step is just getting an accurate picture of what is connected and who is responsible for each piece of it. We do that work for manufacturers around Rhode Island, and we are happy to come walk the floor and tell you what we find.
