Secure IT + OT Network Design
Network Segmentation for Manufacturers
Learn how manufacturers can separate office IT, production equipment, IoT devices, vendors, and other systems to improve security, reliability, and control.Serving Chicagoland manufacturers since 2001.
What Is Network Segmentation in Manufacturing?
Network segmentation divides a manufacturer's technology environment into separate networks or security zones rather than allowing every device to communicate freely with every other device.
For example, office computers, servers, CNC machines, PLCs, industrial IoT devices, security cameras, guest Wi-Fi, and third-party vendors may each have different security and communication requirements.
A properly designed segmented network allows the communication the business needs while restricting communication it doesn't need.
For manufacturers, this is particularly important because office IT and production OT often have very different security, reliability, lifecycle, and vendor-support requirements.
The goal of segmentation isn't to prevent systems from communicating. It's to control which systems can communicate, how they communicate, and why.
Why Manufacturing Networks Are Different
Information Technology - IT
Business systems used to operate the company
- Desktop computers
- Laptops
- Microsoft 365
- File servers
- ERP systems
- Accounting applications
- Business Wi-Fi
- Internet access
Operational Technology - OT
Technology used to operate or support production
- CNC machines
- PLCs
- HMIs
- Robotics
- SCADA/industrial control systems
- Industrial IoT
- Vision systems
- Quality-control equipment
- Machine programming workstations
Different technology. Different risks. Different security requirements.
The Problem With a Flat Network vs A Properly Segmented Network
On a flat network, a compromised device may have unnecessary network access to many other systems.
That can increase the potential impact of:
- Ransomware
- Malware
- Compromised credentials
- Unauthorized vendor access
- Misconfigured devices
- Legacy equipment vulnerabilities
- Human error
Segmentation helps turn one large security boundary into multiple controlled security zones.
How Communication Between Networks Should Work
Segmentation Doesn't Mean Isolation
Manufacturing systems frequently need to communicate across network boundaries.
ERP → Production
An ERP system may need to exchange information with a production application.
Engineering → CNC
An engineering workstation may need to transfer approved files to production equipment.
Monitoring → OT
Authorized monitoring systems may need visibility into production infrastructure.
Vendor → Machine
A machine vendor may occasionally need remote access for troubleshooting.
The objective isn't to block those legitimate business processes.
Instead, firewalls and access-control policies can determine:
- Which device can communicate
- With which destination
- Over which service or protocol
- Under what conditions
- Whether remote authentication is required
- Whether activity should be logged
Securing Legacy Manufacturing Equipment
When security cannot be installed on the device, security can often be built around the device.
Network Isolation
Place vulnerable equipment into an appropriate restricted network segment.
Firewall Rules
Limit which systems are permitted to communicate with it.
Restricted Internet Access
Prevent unnecessary Internet connectivity.
Controlled Administrative Access
Limit who can reach management interfaces and programming systems.
Vendor Access Controls
Provide controlled access rather than permanently exposing equipment.
Monitoring
Monitor the surrounding network for unexpected activity where appropriate.
Machine Vendor Remote Access
Your Machine Vendor Needs Access.
That Doesn't Mean They Need Access to Everything.
Machine Vendor Remote Access
Isn't Creating VLANs Enough?
Not necessarily.
VLANs are commonly used to separate network devices logically, but creating VLANs alone does not automatically create an effective security architecture.
The important question is:
What is allowed to communicate between those networks?
Effective segmentation also requires properly designed:
Firewall Policies
Access Control Rules
Routing
Administrative Access
Remote Access
Documentation
Monitoring
Creating separate networks is only the first step.
Controlling traffic between them is what makes segmentation meaningful.
Document the Environment
If You Can't See the Network, You Can't Manage It Well
- Network diagrams
- VLAN/network assignments
- IP addressing
- Firewall rules
- Switch locations
- Production equipment connectivity
- Vendor access requirements
- Internet connections
- Wireless networks
- Critical dependencies
Why Segmentation Matters for Cyber Insurance Readiness
Why Segmentation Matters for Cyber Insurance Readiness
Cyber insurance applications may ask about network segmentation and other cybersecurity controls.
Before answering an insurance questionnaire, your organization should understand:
- What networks exist
- What systems reside on them
- How traffic between them is controlled
- Whether production systems are separated appropriately
- How vendors access equipment
- Whether the implemented controls match what is being represented to the insurer
For a broader look at the controls insurers commonly evaluate and how manufacturers can prepare before renewal, see our Manufacturing Cyber Insurance Guide.
Segmentation Benefits More Than Security
Reduced Broadcast Traffic
Appropriate segmentation can reduce unnecessary network traffic.
Easier Troubleshooting
Clear network boundaries make it easier to determine where problems are occurring.
Better Vendor Control
Vendor-connected equipment can be separated from unrelated systems.
Improved Change Management
Changes can be implemented with clearer understanding of which systems may be affected.
Reduced Blast Radius
Technical or cybersecurity problems may be contained to a smaller portion of the environment.
Better Documentation
Network design becomes more intentional and understandable.
Common Manufacturing Segmentation Mistakes
Everything Is on One Network
Office users and production equipment share the same unrestricted environment.
VLANs Exist, but Everything Is Allowed Between Them
The network looks segmented on paper but provides little meaningful isolation.
Guest Wi-Fi Can Reach Internal Systems
Visitor devices should not have unnecessary access to business or production systems.
Machine Vendors Have Permanent, Broad Access
Remote vendor connectivity extends beyond the equipment being supported.
Legacy Machines Have Internet Access
Older equipment has unnecessary exposure despite limited security capabilities.
Shared Vendor Credentials
Multiple outside companies or technicians use the same credentials.
Nobody Knows Why a Firewall Rule Exists
Old rules accumulate and cannot safely be removed because their purpose isn't documented.
No Current Network Diagram
The organization cannot clearly identify where critical systems reside or how they communicate.
How TR Technologies Helps
Assess The Existing Network
Understand how systems are currently connected.
Design Appropriate Segmentation
Create logical zones based on business and production needs.
Configure Network Controls
Implement firewall policies, VLANs, routing, and access restrictions.
Protect Legacy Equipment
Use surrounding network controls to reduce exposure where modern endpoint security isn't possible.
Coordinate Machine Vendors
Work with third-party vendors to accommodate necessary technical requirements without giving them unnecessary network access.
Document the Environment
Maintain network information that supports troubleshooting, planning, security, and vendor coordination.
Monitor & Manage
Help ensure the network continues to operate as intended as the manufacturing environment changes.
When a technical issue crosses the boundary between office IT, the network, production equipment, and an outside vendor, TR Technologies can serve as the single point of coordination.
Network segmentation should also remain part of the manufacturer's broader technology roadmap as equipment, facilities, vendors, and cybersecurity requirements change. Our Manufacturing vCIO Guide explains how those infrastructure and security priorities can be incorporated into ongoing strategic IT planning.
Frequently Asked Questions
Will network segmentation disrupt our production equipment?
Properly designed segmentation should preserve the communications required for production while restricting unnecessary access.
Before implementing changes, the communication requirements of production systems should be understood so that required traffic can continue.
The objective is not to isolate equipment arbitrarily—it is to create controlled communication between systems.
Do we need to replace old CNC machines to secure our network?
Not necessarily.
Many legacy manufacturing systems cannot run modern endpoint-security software or current operating systems. In those situations, network segmentation, firewall controls, restricted Internet access, controlled vendor access, and other safeguards can help reduce risk around the equipment.
When aging technology eventually does need to be replaced, our Hardware Lifecycle Planner for Manufacturers can help identify upcoming replacement needs before they become operational emergencies.
Are VLANs the same thing as network segmentation?
VLANs can be an important component of network segmentation, but they are not the entire solution.
Effective segmentation also considers how traffic moves between networks and uses firewall policies and access controls to restrict communication appropriately.
Should our production network have Internet access?
Only where there is a legitimate requirement.
Production devices should not automatically receive unrestricted Internet access simply because they are connected to the network. Internet connectivity should be evaluated based on the equipment's actual operational and vendor requirements.
How should machine vendors remotely access our equipment?
Remote access should be controlled and limited to the systems the vendor is authorized to support.
Depending on the equipment and environment, appropriate controls may include secure remote access, unique credentials, MFA where supported, restricted network access, and logging.
Does network segmentation help protect against ransomware?
Segmentation can help limit the ability of ransomware or another threat to move between different parts of the network.
It does not prevent every cybersecurity incident, but it can reduce unnecessary pathways between systems and help limit the potential impact of a compromised device.
Does network segmentation help with cyber insurance?
Cyber insurance applications may ask whether an organization uses network segmentation.
The exact requirements vary by insurer and policy, so manufacturers should verify what is actually implemented before answering the questionnaire.
TR Technologies can help document the technical environment so responses are based on the actual network configuration.
How do we know if our manufacturing network is properly segmented?
A network assessment can identify the systems and networks currently in use, evaluate how they communicate, review firewall and access-control policies, examine vendor connectivity, and identify unnecessary exposure.
The result should provide a clear picture of the current environment and recommendations for improving segmentation where appropriate.
Related Resources
Cyber Insurance Guide
Understand common cybersecurity controls and prepare for insurance questionnaires.
Managed IT Pricing Guide
Understand how TR Technologies structures managed IT services for manufacturers.
vCIO Guide
Learn how strategic IT planning helps prioritize infrastructure and cybersecurity improvements.
Hardware Lifecycle Planner
Plan technology replacements before aging infrastructure becomes an operational risk.
Is Your Production Network Properly Separated From Your Business Network?
A manufacturing network assessment can help identify unnecessary communication, legacy-equipment exposure, vendor-access risks, and opportunities to improve security and reliability.
or call (630) 405-0749
Serving Chicagoland manufacturers since 2001.