Can a ransomware attack on office IT stop a production line?
Yes, and it is the most common way production stops in a cyber incident, even when the machines themselves are untouched. Lines depend on IT systems for orders, recipes, labels, shipping and quality records; when the ERP, the label server or the file shares are encrypted, many plants stop rather than produce without traceability. Others shut production down as a precaution while they find out how far the attacker got. So protecting production starts on the IT side: list the IT systems each line needs, plan how to run without them for a day, keep offline backups of those systems and test restoring them. NetSenX watches the IT-side steps that come before encryption, on every plan: beaconing, scanning, lateral movement and unusual outbound volume. From the Pro plan it shows OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. traffic in the same dashboard. It does not stop ransomware; it gives you time to act.
Read next
Related questions
- How do we control maintenance laptops that connect to our production network?
- Can we see which controllers a visiting technician's laptop talked to?
- How should remote access to OT by vendors and integrators be secured?
- Are vendor 4G routers in machine cabinets a security risk?
- How do I find hidden remote-access routers in our production network?
Terms used here
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.