Zero Trust Architecture for Manufacturing IT and ERP

Zero Trust Principles Applied to ERP Access

In a traditional design, being on the corporate network is enough to reach the SyteLine or LN application server. Zero trust replaces that with per-session evaluation: who is the user, is the device managed and healthy, is the request consistent with normal behavior, and is the requested privilege minimal. Practically for ERP, that means federated identity through Infor Federation Services or Entra ID, phishing-resistant MFA such as FIDO2 security keys for finance and administrative roles, conditional access policies that block unmanaged devices from privileged functions, and just-in-time elevation instead of standing administrator rights.

The ERP becomes a protected application behind a policy enforcement point rather than an open server on a trusted VLAN.

• Federate all ERP authentication to one identity provider and eliminate local ERP passwords
• Require FIDO2 or certificate-based MFA for administrator, finance, and remote access to production ERP
• Apply conditional access rules for device compliance, location, and risk score before granting ERP sessions
• Replace standing privileged accounts with just-in-time elevation that expires automatically after each task

Replacing VPN with ZTNA Without Breaking the Plant

Full-tunnel VPN gives a contractor laptop the same network reach as an engineering workstation, which is the opposite of zero trust. Zero trust network access publishes specific applications to specific identities, so a machine builder reaches one HMI and nothing else. Migrate in a sequence: start with third-party and contractor access where the risk is highest and the user count is lowest, then remote employees, then site-to-site links.

m. will not tolerate an identity outage. Expect three to six months for a mid-size manufacturer to retire general-purpose VPN entirely.

Microsegmentation and the OT Boundary

Zero trust says never trust the network, but plant floor devices often cannot authenticate at all. The workable compromise is to treat operational technology zones as protected surfaces defined by IEC 62443 and enforce zero trust rigorously at their boundaries and for anyone accessing them. Every engineer, integrator, or application reaching into an OT zone is verified, authorized to a single asset, and recorded.

Inside the zone, protection comes from segmentation and allow-listing rather than per-device identity. Avoid vendor claims about zero trust on the shop floor that require agents on controllers; those projects stall and consume budget that segmentation would have used better.

• Define protected surfaces around production cells, the ERP, the historian, and engineering data repositories
• Verify identity and device posture for every human or application entering an OT zone, with session recording
• Use allow-listed east-west rules inside OT zones instead of attempting agent-based identity on controllers
• Instrument the boundary with passive monitoring so policy violations are detected, not just blocked

A Realistic Zero Trust Roadmap and What It Costs

Zero trust is a program, not a product, and any vendor selling it as a single purchase is selling something else. A workable 18 to 24 month sequence for a manufacturer is: consolidate identity and enforce MFA everywhere in months one to four, remove standing privilege and implement just-in-time elevation in months three to eight, deploy device compliance and endpoint detection in months six to twelve, move third-party and remote access to ZTNA in months nine to fifteen, then segment and instrument the OT boundary through month 24. Sequence by risk reduction per dollar.

Identity and privileged access consistently deliver the largest reduction for the smallest spend.

How Netray Delivers Zero Trust Around Infor ERP

Netray implements the parts of zero trust that touch the ERP, which is where generalist security firms lose momentum. We federate SyteLine, LN, or M3 authentication to your identity provider, design conditional access policies that match real manufacturing job roles including shift and shop floor kiosk usage, convert standing administrator access into just-in-time elevation, and scope every integration identity to the minimum IDOs or sessions it needs. Our AI agents then monitor for policy drift and privilege creep continuously.

A typical first phase reaches full MFA coverage and eliminates shared ERP administrator accounts within 90 days.