Addressing Data Security Concerns In Manufacturing Engineering

Industrial Cyber Security—Layer by Layer OT environments can't rely on repackaged IT security checklists. Frameworks like IEC 62443 and NIST SP 800-82 demand a defence-in-depth strategy tailored to physical processes, real-time constraints, and integrated safety systems. This layered defence model visualizes the approach, moving from the physical perimeter to the core data: ✏️ Perimeter Security: Starts with physical controls like site fencing and progresses to network gateways that enforce one-way data flow. ✏️ Network Security: Involves segmenting the network (per the Purdue model), using industrial firewalls, and securing all remote access points. ✏️ Endpoint Security: Focuses on locking down devices with application whitelisting, ensuring secure boot processes, and using anomaly detection to spot unusual behavior. ✏️ Application Security: Secures the software layer through code-signing for logic downloads and hardening engineering workstations. ✏️ Data Security: Protects information itself with encrypted backups, PKI certificates for authenticity, and integrity monitoring. This entire strategy rests on two pillars: 1. Prevention: Proactive measures like architecture reviews, role-based access control (RBAC), and disciplined patch management. 2. Monitoring & Response: OT-aware security operations, practiced incident response playbooks, and the ability to perform forensics on industrial controllers. Why it matters: The data is clear. Over 80% of recent OT incidents exploited weak segmentation or unmanaged assets. Conversely, plants with layered controls have cut their mean-time-to-detect threats by 60% (Dragos 2024). Which of these security rings do you see most neglected in real-world plants? #OTSecurity #IEC62443 #NIST80082 #DefenseInDepth #IndustrialCyber #CriticalInfrastructure #CyberResilience

On March 11, hackers wiped data from 200,000 systems at Stryker, a $25B medical giant with 56,000 employees. This wasn't a ransomware attack. It was a geopolitical strike that wiped 50 terabytes of data and shut down manufacturing. If a company of that size is vulnerable, what about a smaller company treating cybersecurity as a checkbox exercise? This is a wake-up call, especially now that the EU’s MDR/IVDR overhaul from late 2025 explicitly mandates cybersecurity as a core safety requirement. For founders and product managers, this means a few urgent truths: 1. Security architecture is a Week 1 decision. The choices you make at the concept stage determine if your product can ever meet standards like IEC 62443-4-1 or OWASP without a complete redesign. 2. Your auditor will ask for a threat model. Failing to document how you mitigate risks (per ISO 14971) creates regulatory debt you cannot ignore. It's the top reason for audit failure. 3. A CE mark isn’t the finish line. Post-market surveillance now includes continuous monitoring for new vulnerabilities. 4. Corporate IT and product security are the same frontline. The Stryker breach showed how an enterprise vulnerability can cascade into supply chain disruption and risk patient safety. Adding security later is rarely possible without starting over. Security has to be baked in from the beginning. Paying the price isn’t just about a failed audit—it’s damage to your reputation, business continuity, and ultimately, patient safety. How seriously do you think the industry is addressing cybersecurity today?

AI Won’t Save Your OT Security Program—And Here’s Why. The latest trend? AI for OT security. ~AI will detect every anomaly! ~AI will simplify asset management! ~AI will automate risk assessments! Sounds great—until you look under the hood. -AI can’t learn what isn’t documented. If your control network has 15 years of undocumented changes, AI is just guessing or hallucinating. -AI doesn’t understand the operational context. It might flag a spike in traffic but has no clue if it’s a normal startup sequence or an actual attack. -AI still needs a human in the loop. Risk decisions aren’t binary—context matters. A bad AI call in IT means a false positive. In OT, it could mean shutting down production. The problem isn’t AI. It’s the belief that technology alone can fix security. Vendors have sold “silver bullet” solutions for decades—firewalls, anomaly detection, and asset discovery. Now, AI is the latest magic fix. But no tool replaces strategy, process, and execution. Do you know what works? -Knowledge: Understanding OT systems, processes, and operational constraints. -Training: Engineers, operators, and security teams need the skills to make the right calls when it matters. -Planning: Security must be intentional—risk-based, documented, and aligned with business objectives. -Engineering Processes: Secure-by-design architectures, validated recovery plans, and risk-aware change management. - Business Impact-Based Countermeasures: Security that prioritizes resilience—because keeping operations running is the real goal. AI will undoubtedly help, but it’s not the 'Silver Bullet.' AI solutions must also be analyzed for additional risk introduction. OT security is an execution game, not a magic trick. What’s the most overhyped “AI for OT” claim you’ve seen? I'd love to hear the stories! #OTCybersecurity #ICSsecurity #ManufacturingSecurity #CyberRisk #CISOInsights #CriticalInfrastructure #IndustrialCyber #OperationalTechnology #RiskManagement #CyberResilience

Just dropped some serious intel on OT security that should have every manufacturing CISO paying attention right now. CISA just released ICSA-25-217-01 targeting a Windows Shortcut Following vulnerability in Mitsubishi Electric's ICONICS suite and the implications are way more serious than the medium CVSS score suggests. Here's what's got me concerned. We're talking about GENESIS64, GENESIS 11.00, and MC Works64 systems that are literally the nerve center of manufacturing operations. These aren't just random HMI systems, they're the primary operator interface for controlling industrial processes, storing decades of operational data, and serving as the bridge between IT and OT networks. The vulnerability CVE-2025-7376 allows attackers to create symbolic links that cause unauthorized writes to critical system files. In manufacturing environments this translates to potentially corrupted GENESIS configurations that could blind operators to critical process parameters during production runs. Think about it, an attacker gains local access and suddenly your operators are looking at false process conditions or missing critical alarms during an emergency scenario. What makes this particularly nasty for OT environments is that ICONICS systems typically have dual network connectivity spanning IT and OT domains. This makes them prime lateral movement targets where an initial IT compromise can pivot directly into process control networks. And since these systems often handle alarm management for safety critical notifications, tampering with configuration files could compromise industrial safety systems. The manufacturing sector impact is immediate. Production line visualization gets compromised, operators lose situational awareness, and process historian data integrity comes into question. For facilities running continuous processes or just in time manufacturing, corrupted HMI configurations requiring specialized knowledge to restore could extend downtime significantly. The fix exists for GENESIS systems, upgrade to version 11.01, but for MC Works64 we're looking at implementing strict administrator only access and enhanced network segmentation as primary defenses. Bottom line, this vulnerability sits at the human machine interface layer where compromising these systems directly threatens operators ability to safely monitor and control industrial processes. That medium CVSS score doesn't capture the business impact of production disruptions or potential safety incidents in heavy manufacturing. Are your ICONICS systems properly segmented and monitored?

Scaling manufacturing has long demanded tradeoffs between speed, cost, and security. As semiconductor production becomes more distributed, protecting sensitive IP while maintaining efficiency has become increasingly difficult.    Intel Corporation IT developed a confidential manufacturing infrastructure that enables outsourced assembly and test operations to scale securely and operate more cost-efficiently without compromising governance. The solution uses a standardized blueprint that allows capacity to expand quickly across external partners as demand evolves.    By enabling Intel to select assembly and test methods based on efficiency and competitiveness, this approach introduces greater flexibility in how production decisions are made. Rigorous security controls and InfoSec validation allow the environment to handle Intel Top Secret data, making outsourced manufacturing viable even for IP-intensive workloads.    This work demonstrates how disciplined infrastructure design can strengthen supply chain resilience. As manufacturing ecosystems grow more complex, approaches like this help organizations expand capacity without increasing risk. 

Are Operational Technology (OT) systems used in Manufacturing really “Air Gapped”? Not necessarily. While many organizations claim that their Operational Technology (OT) systems are air-gapped, in reality, true air-gapping is rare. Several factors undermine this assumption: 1. Remote Access & IT-OT Convergence – Many OT networks are connected to IT systems for monitoring, predictive maintenance, and analytics, creating potential attack pathways. 2. USBs & Removable Media – Malware like Stuxnet has proven that air-gapped networks can still be compromised through infected USB drives and removable media. 3. Third-Party Vendor Connections – Industrial control systems (ICS) often require updates, troubleshooting, and remote support, leading to temporary or permanent connections to external networks. 4. Wireless & IIoT Devices – The rise of Industrial IoT (IIoT) has introduced wireless communication, making traditional air-gapping impractical. 5. Human Factors – Engineers and operators might inadvertently bridge networks by connecting personal or corporate devices. A more accurate approach is to assume that OT networks are “logically” isolated but not truly air-gapped. Organizations must implement strict removable media controls, network segmentation, and anomaly detection to mitigate these risks. ##Cybersecurity #Manufacturing #OTSecurity #ICSecurity #IndustrialCybersecurity #SCADASecurity #CriticalInfrastructureSecurity #CyberPhysicalSecurity #IIoTSecurity

Is your Smart Factory actually secure, or just connected? 🛡️🏭 Our recent paper "Manufacturing Cybersecurity from Threat to Action: A Taxonomy-Guided Decision Support Framework" (JIM) takes a very hands-on an applied take on the complexity of protecting process, machines, and parts. This fruitful collaboration was led by Habibor Rahman with Rocco Cassandro, Mohammed Shafae, and Thorsten Wuest While the transition to #Industry40 and #Industry50 offers unparalleled efficiency, it also expands the "attack surface" of the modern factory. Most existing #cybersecurity models are either too abstract for the shop floor or too technical for strategic management. What makes this work different? Unlike traditional surveys, this paper provides a taxonomy-guided decision support framework. We didn't stop at listing the threats; we built a bridge from Threat Detection to Actionable Defense. Key Highlights:  ✅ Applied Taxonomy: A comprehensive classification of cyber-physical threats specific to manufacturing environments. ✅ Decision Support: A structured methodology for CTOs and Plant Managers to prioritize security investments based on risk. ✅ Resilience-First: Focusing not just on "stopping" attacks, but on maintaining operational continuity during an incident. As we move toward more decentralized, autonomous manufacturing networks, cybersecurity cannot be an afterthought—it must be the foundation and part of the decision making. Collaboration is key to securing our industrial future. I’d love to hear from colleagues in CyberSecurity, #SmartManufacturing, and #DigitalTwins—how are you addressing the 'human-in-the-loop' security challenge? #SmartManufacturing #Cybersecurity #Industry50 #ResearchImpact #USC #MCEC #DigitalTransformation #IIoT CESMII CyManII | Cybersecurity Manufacturing Innovation Institute National Science Foundation (NSF) Citation: Rahman, H., Cassandro, R., Wuest, T. & Shafae, M. (2025). Manufacturing Cybersecurity from Threat to Action: A Taxonomy-Guided Decision Support Framework. Journal of Intelligent Manufacturing,  DOI 10.1007/s10845-025-02719-w Link to full paper in the comments:

I get asked a lot about why I preach the fundamentals when it comes to OT network data and security in industry and manufacturing. In OT network security, strong basics are everything. Before diving into advanced measures like network monitoring tools (Claroty, Dragos, Nozomi, etc...), it’s vital to have the fundamentals locked down: VLANs, firewalls, and proper IP address planning. Why? Because these tools establish clear boundaries within your network. VLANs segment your network into smaller, controlled zones, so devices only interact with those they need to. Firewalls enforce strict access rules at these boundaries. Proper IP planning ensures every device and segment is known, organized, and manageable. Without this foundation, advanced security solutions face an uphill battle trying to spot threats in a chaotic environment. Segmentation slows down or stops threats from spreading, while good IP structure makes tracking and managing assets easier. This is just as important for OT wireless networks. Wireless connections can easily become a gateway for unauthorized access if not segmented and controlled properly. Applying the same principles to wireless VLANs and firewall rules ensures wireless devices have only the access they need and reduces the risk of lateral movement by attackers. Simply put, you need a strong house frame before decorating the interiors. Secure your network’s structure first, then add layers of monitoring for maximum protection. #engineeringsocially #industrialwireless #OTnetworking GPA

𝐓𝐡𝐞 𝐌𝐚𝐧𝐮𝐟𝐚𝐜𝐭𝐮𝐫𝐢𝐧𝐠 𝐈𝐓 𝐓𝐢𝐜𝐤𝐢𝐧𝐠 𝐂𝐥𝐨𝐜𝐤: 𝐓𝐡𝐞 𝐇𝐢𝐠𝐡 𝐂𝐨𝐬𝐭 𝐨𝐟 𝐔𝐧𝐩𝐚𝐭𝐜𝐡𝐞𝐝 𝐕𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐢𝐞𝐬 As we conclude Cybersecurity Awareness Month, it’s time to shift from general awareness to decisive action, especially in the high-stakes world of manufacturing. The data is clear: our industry’s greatest cyber vulnerability isn't a zero-day exploit - 𝐢𝐭’𝐬 𝐩𝐫𝐨𝐜𝐫𝐚𝐬𝐭𝐢𝐧𝐚𝐭𝐢𝐨𝐧. A staggering 60% 𝐨𝐟 𝐚𝐥𝐥 𝐝𝐚𝐭𝐚 𝐛𝐫𝐞𝐚𝐜𝐡𝐞𝐬are attributed to the exploitation of known vulnerabilities for which a patch was already available but was never applied. This is a solvable problem that requires operational discipline. 𝐓𝐡𝐞 𝐅𝐢𝐧𝐚𝐧𝐜𝐢𝐚𝐥 & 𝐎𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐓𝐡𝐫𝐞𝐚𝐭 📌𝐂𝐨𝐬𝐭𝐥𝐲 𝐃𝐨𝐰𝐧𝐭𝐢𝐦𝐞: The average cost of a data breach in the industrial sector hit $5.56 𝐦𝐢𝐥𝐥𝐢𝐨𝐧 in 2024, an 18% increase year-over-year. This spike is largely due to the high cost of operational downtime, which can account for 11% of annual revenue for major companies. 📌𝐓𝐡𝐞 102-𝐃𝐚𝐲 𝐋𝐚𝐠: While attackers often exploit new vulnerabilities within hours of their disclosure, the industry average time to patch a critical vulnerability remains an unacceptable 102 days. If your organization takes over three months to fix a severe flaw, you are operating with massive exposure. 𝐓𝐡𝐞 𝐈𝐓 𝐀𝐬𝐬𝐞𝐭 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭 (𝐈𝐓𝐀𝐌) 𝐈𝐦𝐩𝐞𝐫𝐚𝐭𝐢𝐯𝐞 You cannot protect what you cannot see. The single greatest barrier to timely patching is a lack of comprehensive ITAM. This is especially critical in manufacturing, where IT systems constantly converge with Operational Technology (OT) and rely heavily on 𝐭𝐡𝐢𝐫𝐝-𝐩𝐚𝐫𝐭𝐲 𝐯𝐞𝐧𝐝𝐨𝐫 𝐞𝐪𝐮𝐢𝐩𝐦𝐞: 📌𝐓𝐡𝐞 𝐁𝐥𝐢𝐧𝐝 𝐒𝐩𝐨𝐭: Unmanaged engineering workstations, vendor-supplied diagnostic laptops, and shadow IT assets are often completely missed by standard patching cycles. 📌𝐓𝐡𝐞 𝐕𝐞𝐧𝐝𝐨𝐫 𝐓𝐫𝐚𝐩: Third-party and supply chain compromises are now the second costliest attack vector at nearly $4.91 million per incident. If you don't track your vendor's endpoints with the same rigor as your own, they become your largest risk. 𝐀𝐜𝐭𝐢𝐨𝐧𝐚𝐛𝐥𝐞 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞 𝐒𝐭𝐞𝐩 To truly move from reactive cleanup to proactive defense, your priority must be full 𝐀𝐬𝐬𝐞𝐭 𝐕𝐢𝐬𝐢𝐛𝐢𝐥𝐢𝐭𝐲: 📌𝐌𝐚𝐧𝐝𝐚𝐭𝐞 𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐨𝐮𝐬 𝐃𝐢𝐬𝐜𝐨𝐯𝐞𝐫𝐲: Implement automated tools to achieve continuous, real-time discovery of every IT asset that connects to your network. This must include vendor-managed systems and shadow IT. 📌𝐏𝐫𝐢𝐨𝐫𝐢𝐭𝐢𝐳𝐞 𝐑𝐢𝐬𝐤: Shift to a risk-based patching program. Every discovered asset must be automatically factored into your vulnerability assessment and placed on a strict patching schedule based on its criticality to business operations. #ManufacturingIT #ITAM #ProactiveSecurity #PatchManagement #CybersecurityAwarenessMonth

If you are buying #cnc machined and/or fabricated parts for defence and security systems are you sure you know how your manufacturing partner is handling and processing your data❓ The rise of cloud based systems, and the recent addition of what is being called AI driven CAM systems is a compelling argument to move in that direction, and away from the traditional approach of "on-premise" software. With so much of our production at Geometric Manufacturing Ltd geared to serving customers working in the interests of National Security, all of our customer data is held exclusively on an air-gapped network, that is to say, it has no internet connectivity at all, so there is never a risk to the security of that data from an internet hack or data breach. Cloud-based CAM offers: ✅ scalability, ✅ accessibility, ✅ and cost-effectiveness. However, it introduces potential security risks, including: ❎ Data Breaches: Sensitive data, such as design files and manufacturing processes, could be compromised. ❎ Cyberattacks: Cloud environments are attractive targets for cybercriminals, who can exploit vulnerabilities to disrupt operations. ❎ Third-Party Risks: Reliance on cloud providers introduces risks associated with their security practices and potential data exposure. On-premise CAM, deployed on an air-gapped network, provides a more secure environment by: ✴️ Isolation: Physical and network isolation minimizes the risk of external attacks. ✴️ Controlled Access: Strict access controls limit who can interact with the system. ✴️ Enhanced Security. Earlier this year one of our UK Prime Contractor customers surveyed all of its suppliers to check that we do not use cloud based systems for quoting or CAM system work, so clearly the risks have been identified at the appropriate levels, but may not have cascaded down the supply chain so far. If you are in doubt about how your suppliers are handling your critical data it is worth asking for peace of mind. #cybersecurity #CAM #ukmanufacturing #nationalsecurity #cloudcomputing #onpremise