Securing OT/IT Convergence on the Manufacturing Floor
OT/IT convergence security is the practice of protecting plant floor operational technology as it becomes connected to enterprise IT systems such as ERP, MES, and cloud analytics. The security problem is asymmetric: IT systems prioritize confidentiality and get patched monthly, while OT systems prioritize availability and safety, run for fifteen years, and cannot be rebooted during a shift. When a machine controller feeds production counts into Infor SyteLine or LN, those two worlds share a path. This guide covers segmentation, safe data flows, monitoring, and the standards that govern converged manufacturing networks.
Segmenting the Plant with the Purdue Model
The Purdue Enterprise Reference Architecture still provides the cleanest mental model: Level 0 sensors and actuators, Level 1 controllers, Level 2 supervisory HMI and SCADA, Level 3 site operations including MES and historians, and Levels 4 and 5 enterprise IT where ERP lives. The control that matters is a real boundary between Level 3 and Level 4, implemented as a demilitarized zone rather than a firewall rule permitting any traffic from the plant VLAN to the ERP server. IEC 62443 formalizes this as zones and conduits with defined security levels, which gives you a defensible way to justify why one cell is treated differently from another.
- Terminate all plant to enterprise traffic in an industrial DMZ; no direct Level 2 to Level 4 sessions
- Broker historian and MES data through a replicated instance in the DMZ rather than exposing the plant source
- Deny outbound internet access from Level 2 and below except through an inspected, allow-listed proxy
- Document zones, conduits, and target security levels per IEC 62443-3-2 so scope decisions survive audit
Securing the MES to ERP Data Flow
Production reporting, labor transactions, and material movements typically travel from MES or a shop floor data collection layer into SyteLine IDOs, LN business object documents, or M3 APIs, often through Infor ION or a middleware queue. The security failures here are boring and common: a shared integration account with far more ERP permissions than the interface needs, credentials stored in plaintext in a scheduled job, and no monitoring of message volume. Give each interface its own service identity, scope it to the specific IDOs or sessions it touches, store secrets in a vault, and alert on anomalies such as a posting job suddenly writing ten times its normal volume.
Legacy Assets, Patching, and Compensating Controls
Every plant has them: a CNC controller running an operating system that went out of support a decade ago, an HMI that the machine builder will not let you patch without voiding support, and an inspection station whose vendor is out of business. You are not going to patch these. You are going to wrap them. Put unpatchable assets in their own micro-segment with strictly allow-listed communication, remove USB and unnecessary services, use application allow-listing where the vendor permits it, and monitor them passively. NIST SP 800-82 Revision 3 explicitly endorses compensating controls for systems where patching is not feasible, which is the language your auditor and your insurer will recognize.
- Build an accurate asset inventory first using passive discovery; you cannot protect what nobody has listed
- Micro-segment unpatchable assets and allow-list only the protocols and peers they genuinely require
- Schedule the patching you can do against planned shutdowns and annual maintenance windows, not ad hoc
- Deploy passive OT monitoring such as Claroty, Nozomi, or Dragos rather than active scanning that can crash PLCs
Remote Access for Machine Builders and Integrators
The single most common intrusion path into a plant is vendor remote access. A machine builder needs to diagnose a fault at 2 a.m., so someone installs a cellular modem or a persistent remote desktop tool outside IT's visibility, and it stays there for years. Replace standing vendor access with brokered, time-boxed sessions through a jump host that enforces MFA, records the session, and is enabled only for the duration of the ticket. Contractually require the machine builder to use your access method rather than their own. This one change closes more real risk than most six-figure tooling purchases in a converged manufacturing environment.
How Netray Secures Converged Plant and ERP Environments
Netray sits at the intersection few consultancies cover: we know Infor ERP internals and plant floor integration. Our agents map every live data flow between shop floor systems and SyteLine, LN, or M3, identify integration accounts with excessive IDO or session privileges, and generate a least-privilege service identity per interface. We then design the Level 3 to Level 4 DMZ, right-size the interface permissions, and put anomaly alerting on transaction volumes so a compromised integration surfaces in minutes. Typical engagements reduce the number of accounts able to write directly to ERP production data from dozens to fewer than five.
Frequently Asked Questions
What is OT/IT convergence and why is it a security risk?
OT/IT convergence is the connection of plant floor control systems to enterprise IT networks and applications such as ERP, MES, and cloud analytics. It creates risk because operational technology was designed for isolated networks, uses protocols without authentication, and runs on systems that cannot be patched or rebooted freely. Connecting them without a segmented boundary lets an ordinary IT compromise reach equipment that controls physical processes.
How do you secure legacy machines that cannot be patched?
Use compensating controls rather than accepting the risk silently. Place the asset in its own micro-segment, allow-list only the specific protocols and peers it needs, disable removable media and unused services, apply application allow-listing if the vendor supports it, and monitor traffic passively. Document each control and the reason patching is infeasible, which is the approach NIST SP 800-82 Revision 3 endorses and auditors accept.
Which standards apply to manufacturing OT security?
IEC 62443 is the primary international standard for industrial automation and control system security and defines zones, conduits, and security levels. NIST SP 800-82 Revision 3 gives practical guidance for operational technology security. Defense manufacturers also apply NIST SP 800-171 and CMMC to systems handling controlled unclassified information, and many customers layer ISO 27001 or supplier-specific cyber requirements on top.
Key Takeaways
- 1Segmenting the Plant with the Purdue Model: The Purdue Enterprise Reference Architecture still provides the cleanest mental model: Level 0 sensors and actuators, Level 1 controllers, Level 2 supervisory HMI and SCADA, Level 3 site operations including MES and historians, and Levels 4 and 5 enterprise IT where ERP lives. The control that matters is a real boundary between Level 3 and Level 4, implemented as a demilitarized zone rather than a firewall rule permitting any traffic from the plant VLAN to the ERP server.
- 2Securing the MES to ERP Data Flow: Production reporting, labor transactions, and material movements typically travel from MES or a shop floor data collection layer into SyteLine IDOs, LN business object documents, or M3 APIs, often through Infor ION or a middleware queue. The security failures here are boring and common: a shared integration account with far more ERP permissions than the interface needs, credentials stored in plaintext in a scheduled job, and no monitoring of message volume.
- 3Legacy Assets, Patching, and Compensating Controls: Every plant has them: a CNC controller running an operating system that went out of support a decade ago, an HMI that the machine builder will not let you patch without voiding support, and an inspection station whose vendor is out of business. You are not going to patch these.
Put this into numbers
Free interactive tools for exactly this problem. No signup to use them.
Shop Floor Digitization Scorecard
A 10-question scorecard measuring how much of your shop floor still runs on paper - and which digitization gaps are costing you the most.
Free ToolCycle Time & Capacity Calculator
Translate cycle time, parallel stations, shift pattern, and realistic utilization into hourly, daily, and annual production capacity.
Free ToolManufacturing Downtime Cost Calculator
Combine lost contribution margin, idle labor, and absorbed overhead into a defensible monthly and annual downtime cost - with recovery effects modeled.
Terms used in this article
Map and secure every data flow between your plant floor and your Infor ERP before an OT incident becomes an ERP breach.
Related Resources
Zero Trust Architecture for Manufacturing IT
Zero trust architecture for manufacturing IT: apply NIST SP 800-207 to ERP and plant systems, replace VPN with ZTNA, and phase a realistic 18-month roadmap.
ERPRansomware Preparedness for Manufacturers
Ransomware preparedness for manufacturers: immutable backups, tested ERP restores, segmentation, incident response playbooks, and realistic recovery targets.
ERPERP Security Best Practices for Manufacturers
ERP security best practices for manufacturers: harden Infor SyteLine and LN with least privilege, MFA, patching, encryption, and audit-ready access controls.