Secure Industrial IoT Networks and Factory Equipment

Updated 8 November 2026 · Standard formula, shown below

Securing connected factory equipment reduces the chance that a compromised device or remote connection will disrupt production, expose operational data, or provide a route into business systems. Start with operations, engineering, and IT working together: changes to industrial control systems can affect safety and availability, so agree on approvals, maintenance windows, and rollback plans before changing configurations.

What You’ll Need

An inventory of operational technology (OT), industrial IoT (IIoT), and information technology (IT) assets, including owners, locations, software or firmware versions, and network connections.
Current network diagrams, system backups, vendor support contacts, and documented production and safety requirements.
People authorized to approve and carry out changes, including operations, control-system engineering, IT security, and safety staff as appropriate.
A secure workstation for administration, approved management tools, and a test environment or maintenance window for changes that could affect production.
A way to record configuration changes, access approvals, incidents, and recovery actions.

Step-by-Step

Set the scope and safety constraints. Identify the factory sites, production lines, remote access paths, and connected systems covered by the work. Ask process owners which services must remain available and what could cause unsafe operation or product loss. Establish who can authorize a change, how to contact the control room, and how to restore the previous configuration. Do not scan, reboot, patch, or disconnect live controllers without an approved plan.
Build and verify an asset inventory. Record controllers, human-machine interfaces (HMIs), engineering workstations, sensors, gateways, servers, wireless access points, and vendor-maintained equipment. Include device identity, operating system or firmware where known, network zone, owner, purpose, and support status. Compare passive network observations with engineering records and vendor documentation. Treat unknown devices as items to investigate—not as equipment to block automatically.
Map communications and dependencies. Document which devices communicate, why they communicate, and whether the path is local, site-to-site, or remote. Identify protocols, required ports, DNS, time services, update sources, and connections to enterprise systems. Work with control engineers and equipment suppliers to confirm requirements; industrial protocols may have operational dependencies that a generic IT rule will miss.
Separate networks by function. Use managed firewalls, industrial demilitarized zones (DMZs), and carefully designed network segments to separate corporate IT, production cells, safety-related systems, and guest or building networks as appropriate. Permit only documented, necessary traffic between zones. Put shared services such as historians or remote-access gateways in suitable intermediary zones rather than giving enterprise computers direct access to controllers. Test rules during an approved window and keep a rollback method ready.
Control remote access. Remove unused remote-access services and accounts. Require named accounts, multifactor authentication where supported, and approval for vendor or employee sessions. Route access through a managed gateway or jump host; restrict users to the systems and times they need, and record session activity where practical. Use a separate, secured channel for emergency access, with controlled credentials and review after use. Never expose a controller or HMI directly to the public internet.
Strengthen accounts and endpoints. Replace default passwords with unique credentials and disable default or shared accounts when this can be done safely. Use role-based access so operators, engineers, and administrators receive only the permissions their work requires. Secure engineering workstations and servers with supported software, host firewalls where compatible, application controls where feasible, and removable-media procedures. Store credentials in an approved protected system, not in drawings or shared documents.
Reduce device exposure and maintain configurations. Disable unused services, ports, wireless features, and accounts only after confirming they are not needed by a process or supplier. Keep approved configuration backups and record the current firmware and software. Apply security updates through a risk-based process: check vendor guidance and dependencies, test where possible, obtain operations approval, back up, patch during a suitable window, and verify function afterward. If a device cannot be patched, limit its network access and document compensating controls and review dates.
Monitor for changes and suspicious activity. Collect relevant firewall, gateway, server, and remote-access logs in a protected location. Use passive monitoring where possible to identify new devices, unexpected communications, repeated authentication failures, or unusual access times without disrupting control traffic. Set an owner to review alerts and define who is contacted. Protect monitoring systems too: restrict access, synchronize clocks through approved services, and retain records according to operational needs.
Prepare response and recovery. Write an incident plan that names decision-makers, operations and safety contacts, technical responders, and vendor contacts. Define how to isolate an affected segment without creating a process hazard, how to preserve evidence, and how to restore known-good configurations. Keep offline or otherwise protected backups and periodically verify they can be restored. Exercise scenarios such as a compromised remote account or unavailable engineering workstation with the people who would actually respond.
Review and improve. Recheck inventory, access lists, firewall rules, vendor connections, backups, and exceptions on a schedule and after major changes. Remove access when roles or contracts end. Track unresolved risks with an owner and deadline, and confirm that controls still work without interfering with production. Feed lessons from incidents, maintenance, and exercises into the next review.

Common Mistakes

Applying office IT changes directly to production. Aggressive scans, automatic updates, or blanket firewall rules can disrupt equipment. Validate compatibility and use an approved change window.
Assuming a network is safe because it is isolated. Maintenance laptops, removable media, wireless links, and vendor tunnels can bridge networks. Map and control these paths.
Blocking traffic before understanding it. A rule may break monitoring, time synchronization, or a production dependency. Confirm each flow with system owners and test carefully.
Leaving remote access permanently enabled. An unused vendor account or exposed gateway can become an entry point. Require approval, strong authentication, limited scope, and timely removal.
Making a backup without testing recovery. A file may be incomplete, outdated, or unusable. Verify backups and restoration procedures safely and regularly.

Tips

Begin with the highest-impact risks: internet exposure, uncontrolled remote access, unsupported critical systems, and flat networks.
Use passive discovery first on sensitive networks. Coordinate any active testing with control engineers and equipment suppliers.
Keep a change log that records the reason, approver, affected assets, test results, and rollback steps.
Make security ownership explicit. Every asset, exception, alert, and recovery task should have a responsible person or team.
When a legacy device cannot support modern controls, isolate it, restrict who and what can reach it, monitor its connections, and plan a safe replacement or mitigation.

Troubleshooting

Production communication stops after a firewall change: Follow the approved rollback procedure if needed to restore safe operation. Check firewall logs and the documented traffic map with control engineers; add only the verified required flow, then test it in a controlled window.
A device is missing from the inventory: Do not disconnect it based only on an unfamiliar address. Check switch records, passive monitoring, cabinet labels, and vendor or maintenance documentation; identify its owner and purpose before changing access.
A patch fails or causes unexpected behavior: Stop further rollout, follow the recovery plan, and involve the vendor and process owner. Restore the approved configuration if necessary, record the issue, and use network restrictions or other compensating controls while assessing next steps.
Remote support cannot connect: Confirm the request is authorized, the user has an active account and required authentication, and the managed gateway and approved route are available. Review logs for the specific failure; do not bypass controls by opening a direct internet path.
An alert may indicate compromise: Notify the incident lead and operations team. Preserve relevant logs and observations, and isolate only as directed by the response plan so containment does not create a safety or production hazard.

Frequently Asked Questions

Should factory equipment be connected directly to the internet?
No. Use controlled, authenticated access through a managed gateway and appropriate network boundaries; do not expose controllers or HMIs directly.

Can we use ordinary IT security tools on an OT network?
Some tools may be suitable, but their scans or agents can affect fragile or time-critical equipment. Check compatibility, consult system owners, and test before deployment.

How often should industrial devices be patched?
There is no safe universal interval. Assess severity, exposure, vendor guidance, operational dependencies, and testing needs; schedule approved changes and use compensating controls when patching must wait.

What if a controller cannot use multifactor authentication?
Apply stronger authentication at the remote-access gateway or jump host, limit routes and privileges, and monitor sessions. Keep direct access restricted and document the exception.

How can we secure equipment that is no longer supported?
Reduce its reachable network paths, restrict administrative access, monitor activity, protect backups, and plan a risk-based replacement or other vendor-reviewed mitigation.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.