Why your PLCs shouldn't be on the office network
Here's a setup we see constantly in small and medium plants: at some point, someone needed a machine on the network — for programming, for data collection, or because a vendor asked. So it got plugged into the nearest switch. It worked, everyone moved on, and five years later the PLCs, the HMIs, the office PCs, the printers, the security cameras, and the guest Wi-Fi are all one big happy network.
This is called a flat network, and it means everything can reach everything.
Why that's a bigger deal for machines than for PCs
Office computers get security updates monthly and run antivirus. Your PLCs and HMIs don't — and mostly can't. Industrial equipment is built to run for 15–20 years, and the Windows XP or 7 machine running your HMI software may be un-patchable without breaking vendor support. That's normal in OT. But it means those devices depend entirely on the network around them for protection.
On a flat network, that protection is zero. One employee clicking one phishing link puts malware two hops from the PLC running your line. Ransomware crews figured this out years ago: encrypting your files hurts, but stopping your production line gets invoices paid. And it doesn't take an attacker — a chatty misconfigured device or a virus scan hammering the network has knocked over sensitive industrial gear plenty of times by accident.
The fix: zones and a checkpoint
The answer isn't buying a second building's worth of cabling. Modern managed switches can split one physical network into isolated zones called VLANs, with a firewall acting as the checkpoint between them:
The office zone carries email, cloud apps and PCs. The production zone carries PLCs, HMIs and SCADA. Guests get their own zone with no path to anything internal. Between office and production sits a firewall whose rule list is short enough to read aloud: the ERP server may talk to the SCADA server on one specific port; the maintenance laptop may reach the PLCs when needed; everything else is denied.
Now the phishing click stays an office problem. The infected laptop can't even see the PLCs, let alone reach them.
What it takes (less than you'd think)
For a typical SMB plant, segmentation is usually: a business-grade firewall, managed switches (which you may already own), a plan for which devices belong in which zone, and a switchover that's mostly scheduling careful downtime windows. It's typically a project measured in days, not months — and it's the single highest-value security step a small manufacturer can take.
Two honest caveats. First, the planning matters more than the hardware: machines and their HMIs need to end up in the right zones together, or things break in confusing ways. Second, segmentation isn't a silver bullet — you still want backups, and remote access still needs to be done properly (we cover that in a separate article).
Serlixer designs and implements OT network segmentation for small and medium plants — including the firewall rules, the VLAN plan, and the careful cutover. Contact us to talk about your network.