PLC and Network Audit for a Manufacturing Plant
A manufacturing company has the PLCs and OT network of its three lines audited ahead of a modernization program. Data collected during normal operation, intrusive checks confined to planned shutdowns: without touching process availability.
[ Context ]
The operator is a manufacturing production company. The site runs three shifts a day, five days a week, with three production lines, two of which run continuously during peak season. The shop floor has around sixty PLCs, twelve HMIs, several SCADA supervision stations, and a historian that feeds production indicators. A gateway connects the OT network to the group's ERP for manufacturing orders and production reporting.
The installation was built line by line over roughly fifteen years, at the pace of investment cycles. Each extension was connected to the existing network without revisiting the overall architecture. Maintenance is handled in-house on two lines and by an outside integrator on the third, with remote access opened over the course of successive interventions. Technical management requested an assessment before launching line modernization, with one constraint set from the first conversation: no unplanned shutdown during the assignment.
The Challenge
The site's OT network is flat. The three lines, supervision, the historian, and the ERP gateway share the same addressing plan, with no filtering between them. Nothing limits an incident from spreading from one line to the other two, or from the programming workstation to the PLCs. The available network diagrams dated back to the commissioning of the second line and no longer matched the actual installation: neither the equipment added since, nor the remote access opened for contractors, appeared on them.
Add to that legacy operating practices: shared maintenance accounts, removable media used interchangeably between the offices and the shop floor, PLC program backups stored on a single workstation.
Flat OT network, with no segmentation between lines and supervision
Shared maintenance accounts, with no traceability of connections
Programming workstation shared with the office network
Our Approach
The assignment was scheduled around the production calendar: data collected during normal operation on all three lines, intrusive checks reserved for planned shutdown windows. No interruption to production, no operational downtime. The work was done with the operations teams, not alongside them.
Line-by-line survey with the maintenance and automation teams. OT asset inventory: PLCs, HMIs, supervision stations, network equipment, remote access. Each piece of equipment is tied to a line, a production function, and an identified owner.
Passive observation of network traffic, no injection into the production network. Three weeks of capture at the concentration points of the three lines, to identify the industrial protocols in use, the exchanges between lines, the data feeding the historian, and the outbound flows to the ERP gateway.
Reconstruction of the actual addressing plan and comparison against the existing diagrams. Zone and conduit segmentation under IEC 62443, with a matrix of legitimate flows between each zone. This matrix then serves as the reference for the filtering rules to be put in place.
Intrusive checks confined to the shutdown windows communicated by operations: PLC configuration and hardening, supervision accounts and permissions, state of the programming workstation, the integrator's remote access paths, use of removable media. Each check is validated with the line manager before it's carried out.
For each point: criticality, remediation effort, action owner. Remediation plan prioritized across three horizons: immediate, 6 months, 18 months. Two presentations: one technical, with operations, the other for management.
[ Results ]
Complete OT asset inventory across the 3 lines: 62 PLCs, 12 HMIs, and 9 network devices recorded.
Mapping of the actual industrial flows between lines, historian, and ERP gateway, now the site's reference document.
Target architecture in 5 IEC 62443 zones and a three-stage roadmap, covering 34 prioritized findings.
Named accounts, offsite backups, a dedicated workstation: fixes applied during the assignment, report and diagrams reusable in-house.
The audit ran without stopping the lines, that was our starting condition and it was honored. Our maintenance teams took part in every survey, they understood the findings and made them their own. The report and flow diagrams now serve as our internal working basis for modernizing the lines.
Discover other industrial cybersecurity missions carried out by Leviotec, in France and internationally
.svg)
.svg)