Keeping the Plant Off the Office LAN: A Manufacturer's Separation Plan

The office ransomware outbreak was contained by Friday. The plant stood idle until Wednesday, because the same network that carried email also carried the scheduling system, the label printers, and the historian the line cannot run without. The attack never touched the machinery; it did not have to.

Most mid-market manufacturers grew their networks organically: the office LAN was there, so the plant systems joined it. The result is that a phishing email in accounting can idle a production line, and the blast radius of every office incident includes the revenue engine.

Separation does not mean air-gapping the plant into the stone age. It means a boundary with a short, explicit list of what crosses it, so the office can have its incident without the plant joining in.

Key takeaways

• If the office and the plant share one network, every office incident is a plant incident.

• Draw the boundary, then list explicitly what crosses it and why.

• The plant's critical systems keep running when the office network is down or cut off.

• Vendor remote access to plant systems goes through a controlled, monitored path.

• Test the separation by simulating the office outage, not by reading the diagram.

Step 1: Map what the plant actually needs

Start on the plant floor, not in the network diagram. List what the line cannot run without: the scheduling feed, the historian, the label printers, the quality system. Then trace where each lives and what it talks to. The list is usually shorter and more surprising than expected.

This fictional example shows a cross-boundary list for one plant. It is an illustration, not a prescription.

Plant need	Talks to	Direction	Rule
Scheduling system	ERP in the office	Pull only, hourly	Allowed, logged
Historian	Cloud dashboard	Push only	Allowed
Vendor maintenance	Vendor support center	On request, timed	Manually enabled
Everything else	Anything else	-	Denied

Step 2: Build the boundary with default-deny

The boundary is a firewall rule set with a simple posture: nothing crosses unless it is on the list. Office systems cannot initiate connections to the plant; plant systems reach only the specific office services they need, in the direction they need them.

The practical effect: office ransomware finds no path to the line, and the plant keeps producing while the office has its bad week. The architectural pattern is the same one zero trust guidance describes for high-value resources: policy enforced close to the asset, access granted specifically.

Step 3: Move vendor access to a controlled path

Every manufacturer has the vendor who remotes into the line's controllers, usually through a tool installed years ago and always on. That permanent path is the most likely way trouble crosses the boundary.

Replace it with an enable-on-request path: the vendor's access is off by default, turned on for a maintenance window, logged, and turned off after. Vendors adapt to this quickly when the alternative is explaining their always-on access to your insurer.

Step 4: Prove it with the office-down test

Once a year, run the test that matters: simulate the office network being down or hostile, and confirm the plant runs its normal schedule without it. Not on paper - actually cut the boundary in a maintenance window and watch.

The test finds the real dependencies: the engineer who prints travelers from an office share, the time server everyone forgot, the cloud dashboard that the morning meeting needs. Each finding is a fix made in calm conditions instead of during an incident.

The resilience framing in operational resilience versus business continuity is the right lens for reporting this test upward.

The related discussion of operational resilience is worth your time alongside this one. The related discussion of legacy system replacement is worth your time alongside this one.

Frequently asked questions

Does separation mean the plant loses cloud and data access?

No. The plant keeps every connection it needs, through defined, monitored paths. What it loses is the accidental connections, which are the ones that carry incidents.

We are small. Is this overkill?

The smaller the company, the more a stopped line hurts, and separation at small scale is a firewall change, not a program. The exercise scales with you.

What about the ERP that both sides need?

Keep the ERP on the office side and let the plant pull from it on a schedule. If the office goes down, the plant runs from the last pull. Decoupling the timing is what buys the plant its independence.

A Defensible Next Step

Ask your plant manager and your IT lead one question together: if the office network went down tonight, what happens on the floor tomorrow morning? If the answer involves the word 'probably,' the separation plan is this quarter's project. Book a Decision-Clarity Call if you want the boundary designed.