A Tuesday morning at a food processor in Saint-Hyacinthe. Overnight, ransomware encrypted the ERP and the file server. The PLCs and the packaging line controllers weren't touched. The plant is down anyway: no ERP means no production orders, no engineering workstation means no recipes to load, and the supervisory screen on the cooking line, sitting on the same network as the offices, now displays the ransom note.
It's the most common scenario in manufacturing: attackers go after business IT, and production pays the price. The Canadian Centre for Cyber Security calls ransomware the top cybercrime threat facing Canada's critical infrastructure, and notes that some actors opportunistically target internet-accessible industrial devices by exploiting insecure remote access software or default passwords.
The good news: you don't have to rebuild everything. Two references, the Purdue model and the IEC 62443 series of standards, give you a common language with your integrators and an action plan sized for a small or mid-sized plant.
TL;DR
- In a plant, ransomware that hits the office is often enough to stop production: separating business IT from operational technology (OT) is your first line of defence.
- Use the Purdue model to map your systems and IEC 62443 to set requirements, zone by zone.
- Remote access for integrators and equipment vendors is often the weakest point: centralize it, protect it with MFA and enable it only on request.
- Start with a passive inventory and a backup of your PLC programs before buying any tools.
Why the plant stops even when the attack targets the office
OT flips IT's priorities. In the office, confidentiality comes first. On the plant floor, availability and worker safety lead. A patch that needs a reboot can mean a line stoppage; an overly aggressive network scan can crash an old PLC.
So weaknesses pile up over the years:
- a flat network where office PCs can reach HMIs (human-machine interfaces) and PLCs (programmable logic controllers);
- HMIs and engineering workstations on old Windows versions that rarely get updated;
- remote access tools installed by different integrators, with shared passwords;
- USB sticks travelling between the office and the floor;
- direct links between the ERP, the manufacturing execution system (MES) and the machines.
The Purdue model in five minutes
Born from work at Purdue University, the model splits an industrial enterprise into levels. It isn't a standard, but it's the simplest tool for deciding where to draw boundaries.
| Level | What lives there | Example in a Canadian plant |
|---|---|---|
| 0 | Physical process: sensors, actuators, motors | Temperature probes in a cooking kettle |
| 1 | Basic control: PLCs, controllers | PLC running the filling machine |
| 2 | Supervisory control: HMI, SCADA, engineering workstations | Touchscreen on the packaging line |
| 3 | Site operations: MES, historian, production servers | MES server receiving production orders |
| 3.5 | Industrial DMZ | Remote access gateway, historian replica |
| 4 | Business network: ERP, email, office apps | ERP, accounting, email |
| 5 | Enterprise and cloud | Microsoft 365, customer portal |
Level 3.5 is a modern addition to the original model, and it's essential. The golden rule: no direct traffic between level 4 and levels 0 to 2. Everything goes through the industrial DMZ, and every flow has a documented reason.
IEC 62443 without the jargon
The ISA/IEC 62443 series covers the security of industrial automation and control systems. Its strength is that it splits responsibilities by role. The most useful parts for a smaller manufacturer:
- 62443-2-1: security program requirements for the asset owner, meaning you.
- 62443-2-4: requirements for service providers such as your integrators. Great material for contracts.
- 62443-3-2: risk assessment and the breakdown into zones and conduits.
- 62443-3-3: system security requirements and security levels (SL 1 to 4).
- 62443-4-1 and 4-2: requirements for equipment makers, covering secure development and components.
- TR 62443-2-3: a technical report on patch management in industrial environments.
A zone groups assets with the same security needs, for example all the PLCs on one line. A conduit is the controlled communication channel between two zones. The target security level runs from SL 1, protection against casual or accidental violation, to SL 4, protection against an attacker with extended resources and advanced industrial skills. For many smaller manufacturers, aiming for SL 1 or SL 2 across most zones is a realistic starting point.
Seven priority measures
- Take a passive inventory. PLCs, HMIs, firmware versions and, above all, who connects to them. Avoid unplanned active scans on the production network.
- Segment IT from OT. A firewall between the two, an industrial DMZ, zones by line or cell.
- Lock down remote access. One gateway in the DMZ, one account per technician, multi-factor authentication, on-request activation and logged sessions. Remove the remote-control tools left behind on HMIs.
- Change default passwords on PLCs, HMIs and industrial network gear.
- Back up what runs the plant. PLC programs, HMI configurations, recipes, licences, with a tested offline copy.
- Plan patching with operations. Use scheduled shutdowns, like the summer or holiday shutdown, and apply compensating controls when equipment can't be updated.
- Prepare your response. Who decides to stop a line? How do you run in manual mode? Where are the integrators' phone numbers at 2 a.m.?
Take a 60-person precision machine shop in Granby. Four different integrators had each installed their own remote access software. Consolidating them behind a single gateway with MFA closed most of the entry points without touching a single PLC.
Pressure is also coming from your customers
Large customers are paying more and more attention to their suppliers' cybersecurity. Aerospace and defence subcontractors need to prepare for CPCSC certification, now required in some defence contracts. Suppliers to the energy and transportation sectors should watch the phased rollout of the CCSPA under Bill C-8, which provides for supply chain risk management obligations.
To validate the IT/OT boundary, a well-scoped penetration test helps, starting with the office side and remote access: our article on external vs internal penetration testing explains the difference. Any test requires written authorization (Criminal Code, s. 342.1) and, in an industrial setting, close coordination with operations.
Your 90-day plan
- Days 1–30: passive inventory, a map of flows between office and plant, a list of every remote access path.
- Days 1–30: offline backup of PLC programs and HMI configurations.
- Days 31–60: IT/OT firewall, industrial DMZ, a single remote access gateway with MFA.
- Days 31–60: default passwords replaced.
- Days 61–90: an exercise to stop and restart a line after a simulated incident.
- Days 61–90: clauses inspired by 62443-2-4 added to integrator contracts.
Our team can start with a cybersecurity audit focused on the boundary between your office and production networks, then hand you a prioritized plan that respects your operating constraints.
Frequently asked questions
Does a small manufacturer need IEC 62443 certification?+
No. No Canadian law requires a small or mid-sized manufacturer to be certified to IEC 62443. The standard is mostly a shared framework for structuring your program and for writing requirements for integrators and equipment vendors. Some large customers may still borrow from it in their contract requirements.
Our PLCs aren't connected to the internet. Are we safe?+
Rarely as safe as people think. Truly isolated production networks are the exception: a USB stick, a technician's laptop, a forgotten remote-access modem or a link to the ERP is enough to create a path. The most useful first exercise is to map every data flow going into and out of the plant.
Who owns plant cybersecurity, IT or operations?+
Both, and that's exactly the challenge. IT understands security; operations understands process constraints and worker safety. Name a lead on each side, give them a joint mandate signed by leadership, and require both to approve any change to the production network.