Cyber Security for Manufacturing and Engineering Firms

The machine that cannot be touched

Nearly every manufacturer we assess has at least one critical machine driven by a controller running an operating system that stopped receiving updates a decade ago. The vendor will not support an upgrade, replacement costs six figures, and the machine works. Telling the business to patch it is not advice, it is an evasion.

The answer is containment. The machine goes onto its own network segment with no internet route, access restricted to the specific engineering workstations that need it, removable media controlled, and monitoring at the boundary so unusual traffic is visible. The risk is not eliminated, but it is bounded and documented — which is also what an auditor or insurer wants to see.

• ✓Dedicated network segment for OT with a controlled boundary
• ✓No direct internet access from the production network
• ✓Access limited to named engineering workstations and accounts
• ✓USB and removable media control on machine controllers
• ✓Documented accepted risk with compensating controls recorded

Vendor remote access

Machinery suppliers frequently require remote access for diagnostics and support, and that access is often permanent, shared between engineers, and unmonitored. It is a standing route into the production network held by a third party whose own security you have never assessed.

We replace always-on vendor access with access that is requested, time-limited, individually attributable, multi-factor authenticated and logged. Vendors reasonably need access; they do not need it at three in the morning on a Sunday without anyone knowing.

• ✓Time-limited, request-based vendor access rather than standing connections
• ✓Individual named accounts, never shared vendor logins
• ✓MFA and session logging on all third-party access
• ✓Access scoped to specific machines, not the whole network

Supply chain questionnaires

For many manufacturers the immediate driver is commercial rather than technical: a large customer has sent a security questionnaire, and continued business depends on answering it credibly. These questionnaires are increasingly detailed and increasingly verified.

We help answer accurately, identify which gaps genuinely need closing before the answer is truthful, and — where the customer will accept it — substitute a Cyber Essentials certificate, which satisfies many questionnaires outright and saves repeating the exercise for every customer.