Industrial Cybersecurity: 5 Safeguards for North Texas Plants

Industrial cybersecurity protects the PLCs and engineering workstations that run a plant. For a plant with 20 to 50 users, five network controls do most of that work: segmentation, reduced admin rights on engineering workstations, fast endpoint isolation, offline backups of PLC logic, and vendor access that is off by default.

A plant manager in Garland reads about record ransomware numbers and quietly asks whether the office email system and the machines on the floor are one network in practice. The honest answer is that they often are, through a chain of small exceptions nobody wrote down. The chain is breakable, and it starts with understanding what it is.

This article walks through why plants are being hit now, how an office email becomes a stopped line, where air gaps leak, and the five safeguards that close those paths at a scale a 30-person shop can actually run. It ends with a Q4 review you can start before the December change freeze.

Why Are Manufacturing Plants Being Targeted So Hard in 2026?

Ransomware activity reached a 2026 high in August, with more than 1,000 incidents recorded in a single month. The industrial sector took 31% of those attacks, and the Qilin group was the most active. Plants and distribution operations are attractive for a simple reason: they pay the most when they stop.

A cyber incident only becomes an operational problem when it changes something on the floor. That means production stops, quality drops, or a customer commitment gets missed. Manufacturing Today put it plainly in August: the incident becomes operational when production stops or customer commitments cannot be met. An attacker who knows a plant cannot afford two days offline has leverage that a bank or a law firm does not have in the same way.

For North Texas, the exposure is concentrated along the industrial and distribution corridors around Garland and Fort Worth, where shops run continuous schedules to meet national supply commitments. A plant that loses its engineering workstations on a Monday morning does not lose a day of email. It loses a day of output, and possibly a customer.

How an Office Email Becomes a Line Stop

The office breach is rarely the damage itself. The damage comes later, and the stolen credential is what opens the path. Here is the sequence we see described most often, with the mistake at each stage.

1. A mailbox is compromised. A convincing phishing email gets a password or a session token from someone in accounting or purchasing. The mistake here is a mailbox without multi-factor authentication, so a password alone is enough.
2. The credential is reused for remote access. The same password, or a session tied to it, opens the VPN or remote-access gateway that an outside maintenance vendor also uses. The mistake is shared or standing access that nobody reviews.
3. The gateway leads to the engineering network. Engineering workstations sit one hop away because the network was never split into zones. The mistake is a flat network where office and floor can talk freely.
4. An engineering workstation is used as a lever. The attacker finds a logged-in engineer or an admin account with standing rights. Those workstations hold the logic files and the software that can write to controllers, so this is where the attacker gains the ability to change or lock the process.
5. Controllers and HMIs are encrypted or manipulated. Ransomware that reaches an HMI or a historian halts the line. Targeted changes to PLC logic or setpoints can degrade quality, damage equipment or trip safety systems.

Each stage has a control that interrupts it. Multi-factor authentication stops the first step from being useful. Named vendor accounts stop the second. Segmentation is what stops the third step, and privilege reduction stops the fourth. Offline backups and isolation limit the fifth. You do not need all of them to be perfect, but you do need the chain to break somewhere before it reaches the controller.

Where the Air Gap Actually Leaks

Many plant managers believe their floor is air-gapped from the office. In practice, an air gap is rarely one wall. It is a set of exceptions, and each exception is a door that someone opened for a good reason.

Walk the plant and list every exception before you trust the gap. Look for:

• A laptop that moves between the office network and the floor, carried by an engineer or a contractor
• A vendor tunnel or remote session that stays open after the job is finished
• A USB stick used to move logic files or software updates between machines
• An IP camera wired to both sides of the boundary for convenience
• A rogue wireless bridge someone installed to reach a machine without running cable
• A virtual machine or remote desktop session that connects both networks

Ransomware operators have been seen compromising IP cameras to get around other protections, so peripherals belong in the inventory alongside the controllers. If an asset can reach the floor, it is part of the floor's attack surface, whatever its purpose.

How Do You Split a Plant Into Zones Without Rebuilding It?

The industrial standard for this is ISA/IEC 62443, which organizes control systems into zones and conduits. You do not need to memorize the standard to use the idea. In plain terms, you group equipment by what it does, then control every pathway between the groups. Most of the work is knowing what talks to what.

An air gap nobody has tested is a hope, not a control. Zoning gives you something you can check.

Draw the Map Before You Buy Anything

1. List every device on the floor. Controllers, HMIs, historians, engineering workstations, drives, cameras, printers, and any device with an IP address. Include the ones nobody remembers installing.
2. Group them by function. Machines that run the same process and talk to the same controllers belong together. Engineering workstations and historians usually form their own group. Office systems stay separate.
3. Trace every connection. For each group, note what it sends to and receives from. Use a passive monitoring tool or a careful review of switch and firewall configurations, not active scanning.
4. Mark the pathways. Each line between two groups is a conduit. Decide which conduits are needed, which can be closed, and which need a controlled point where traffic is inspected.
5. Test the result. Once the map exists, verify it by trying the connections you expect to be blocked. A zone you have not tested is a guess.

Put a Controlled Buffer Between the Office and the Floor

Most plants can start with one buffer rather than a full rebuild. Place a controlled zone between the office network and the production network, sometimes called an industrial demilitarized zone. Traffic from the office only reaches that zone, and traffic from the floor only reaches the buffer for the few services the plant truly needs, such as shared historian data or patch staging.

The buffer can run on equipment many plants already own, if the rules are written and enforced. Start with a short list of allowed connections, deny everything else, and log what is blocked. Expand only when a real business need appears. This is a much smaller project than replacing the control network, and it removes the most common route from the office to the floor.

Remove Standing Admin Rights From Engineering Workstations

Engineering workstations are the high-value target on a plant floor. They hold the logic files and the software that can write to controllers. An attacker who gets admin rights on one of them has a direct route into the process.

The fix is structural. Give each engineer a separate, named login for engineering work. Keep daily-use accounts, the ones used for email and browsing, free of admin rights. When an engineer needs to make a change, they elevate for that task and log out after. Shared accounts should not exist on engineering machines at all.

October is Cybersecurity Awareness Month, and the programming at UT Dallas this year centers on the same routines: multi-factor authentication, user permission audits and social-engineering training. Those are the right habits to pair with this control, because a stolen password is much less dangerous when it cannot change a controller.

Expert note for the plant: when you audit permissions, look first at who can write to controllers, then at who can log into engineering machines remotely, then at which accounts have standing admin rights. Those three lists are short in most plants, and the work to clean them up is one afternoon, not one quarter. The general checks for least privilege across the whole network are covered in our cybersecurity audit guide, so use that for the office side and this section for the floor.

Watch the Plant Passively and Isolate Only the Affected Segment

You need visibility into the floor, but you cannot get it the way you would on an office network. IT security tools often assume you can scan aggressively, patch on demand and reboot at will. On a production network, those assumptions can stall an old controller or stop a line. OT-appropriate monitoring starts from the opposite premise: watch the traffic without touching the process.

Passive Monitoring Comes First

Passive monitoring observes network traffic and flags unusual behavior, such as a controller talking to an address it has never used, an engineering workstation sending data at an unusual hour, or a new device appearing on a segment. It does not send probes to the controllers. Before you let any provider connect a tool to the floor, ask them what it does there. If the answer involves active scans or automatic patching of controllers, get a different answer or a different tool.

Monitoring the office side and the floor side are separate scopes. A managed detection service that watches office endpoints around the clock may not cover your controllers at all. Ask directly which network segments are in scope and what happens when an alert fires on the floor.

If You Find Encryption on an HMI

If you find encrypted files on an HMI, a controller talking to an unknown address, or an unexplained login from a vendor account, the instinct is to shut everything down. Hold off on that, because shutting down erases the evidence you need.

1. Isolate only the affected segment. Disconnect it from the rest of the network without powering down the machines.
2. Preserve the logs, both on the affected devices and on the firewall and switches that carried the traffic.
3. Call a specialist before anyone powers anything down or restores anything.
4. Keep the line running in a degraded or manual mode if the process allows it, and record what you do and when.

This is where a managed detection and response service earns its place: it can contain the affected segment quickly and keep the record intact. For what that looks like in practice, see what MDR does.

Back Up the Logic, Not Just the File Share

Generic backup advice does not solve the plant problem. The thing you need back after an attack is a ladder logic file, an HMI screen image and a historian configuration, not a folder of documents. A backup that lives on a file share ransomware can reach is not a backup, because the attacker can encrypt it along with everything else.

What to Copy Offline

Keep at least one copy of each of the following offline or in immutable storage that cannot be altered for a set period:

• PLC logic and project files for every controller, with the version and date
• HMI images and screen configurations
• Historian configuration and the settings needed to rebuild it
• Engineering workstation software images, so a replacement machine can be built quickly
• Network device configurations for switches, firewalls and the buffer zone

Store the offline copy somewhere that is not connected to the production network. Label it, keep an index, and record when each copy was last verified.

Prove the Restore Once a Year

A backup you have never restored is a hypothesis. At least once a year, time a real restore: take a logic file and an HMI image, load them onto a spare machine, and confirm the controller or simulator behaves as expected. Write down how long it took and what was missing. That number is the honest answer to how long a production line would be down after an incident. Our guide on data backup and disaster recovery covers how to engineer testing into the routine for the office systems, and the same discipline applies on the floor.

Keep Vendor Remote Access Off by Default

Vendor remote access is the most common door into small plants. Maintenance contractors need access to controllers and software, and that access is often set up once and never reviewed. Industry guidance names shared accounts, persistent VPN tunnels and unmanaged vendor access as recurring entry points, and the classes of weakness are consistent: shared credentials, standing access, sessions nobody watches, and maintenance laptops that nobody manages.

Vendor access should be off until it is needed, on for the job, and off again afterward. A workable process looks like this:

• Named accounts for each vendor technician, with multi-factor authentication
• No shared passwords, ever, including for the vendor's own staff
• A scheduled access window tied to a work order, opened for that window and closed after
• Every session logged, with the logs reviewed by someone at the plant
• Maintenance laptops that the vendor manages and that are kept off the plant network except during the job
• A written list of which systems the vendor can reach, reviewed each quarter

Questions to ask any maintenance contractor: Who holds the password to our equipment? When did your technicians last log into our systems? How is each session recorded and who reviews it? What happens to your access when a technician leaves your company? If the answers are vague, the access is too broad.

Plan the Q4 Review Before the December Change Freeze

Most plants have a short window before year-end when changes are still possible. Use it to run a Q4 review that turns the five controls into work you can finish. Three principles should shape it.

First, decide patching by reachability, not by severity score alone. Only about 2% of OT-relevant vulnerabilities in a given year genuinely needed immediate action, and about a quarter of published advisories had incorrect severity scores. Check whether a flaw can be reached from where an attacker would actually stand before you take a line down for it.

Second, book changes into windows you can actually hold. A segmentation project that needs a maintenance window should be scheduled against the production calendar and the November to December change freeze, not against an optimistic plan. A change that gets postponed twice is worse than no change, because the plant ends up with a half-finished network.

Third, plan for the plant to keep running without connectivity. The September attack on AT&T network infrastructure, which an Iranian hacking group claimed responsibility for, caused widespread internet outages across North Texas (FOX 4 News), and winter grid events can do the same. The line should have a documented manual or degraded mode, the people who know how to run it, and a paper or local copy of the procedures they need.

Here is a sequence a plant manager can run this quarter:

1. Confirm the map. Verify the zone diagram and the list of exceptions from the earlier sections, and note what has changed since it was drawn.
2. Audit the privilege lists. Who can write to controllers, who has admin on engineering machines, and which vendor accounts are active.
3. Review vendor access. Close any standing access, confirm named accounts, and check the last session logs.
4. Test one restore. Load a logic file and an HMI image onto a spare machine and time it.
5. Set the patch and change calendar. Decide which patches matter now, book the windows, and drop everything before the December freeze.
6. Write the degraded-mode procedure. Name the people, the steps and the copies on paper.

Your insurer or counsel may raise Texas SB 2610 safe-harbor benchmarks during renewal. That is a legal and insurance conversation, and the details of what it requires are set out in our Texas SB 2610 compliance guide. The controls above are the kind of evidence those benchmarks ask about, so documenting them now serves both purposes.

How Total 360 Technology Supports DFW Manufacturing and Distribution Sites

Total 360 Technology provides security-controlled IT operations for Dallas-Fort Worth businesses with 10 to 50 users. Our approach is built on enforced safeguards rather than reactive ticket queues. For manufacturing and distribution sites, that means administrative privilege reduction, 24x7 managed detection and response, backup verification and recovery testing, and patch and vulnerability management, run as one program rather than as separate projects.

We are not an industrial control specialist, and we will not claim to be one. If your plant runs specialized control systems, the controllers themselves may need a vendor or engineer who knows those machines in depth. What we can do is manage the office side, the network boundary, the access controls, the backups and the monitoring, so the floor is not left exposed by the systems around it. Hardware is provided at cost plus 5%, and pricing is flat-rate, so there is no surprise hourly billing when something goes wrong.

If you want to know where your plant stands, the next step is a security assessment. You can schedule a 30-minute security discussion, or see how we run operations for production sites on our manufacturing and distribution page and security-controlled IT operations overview. Bring your floor map and your vendor list, and we will tell you plainly which of the five safeguards you already have and which to start with.

Frequently asked questions

What is industrial control system security?

It is the protection of the PLCs, SCADA systems, distributed control systems, HMIs and historians that run a plant. Availability and correct control rank above secrecy, because people, equipment and the environment depend on consistent control. The work combines network zoning, access control, monitoring that does not disturb the process, and tested backups.

Does an air gap protect a plant from ransomware?

An air gap alone rarely protects a plant. Laptops that move between networks, vendor tunnels, USB sticks, cameras and wireless bridges are common exceptions. List them, close what you can, and test the gap so you know it holds.

Do we have to replace old controllers to be secure?

Usually no. Controllers that have run for 20 or 30 years can be protected with zoning, restricted pathways and monitoring of the network they sit on. Replacement is a planning decision for later, not a precondition for protection today.

Should we patch every vulnerability as soon as it is published?

Not automatically. About 2% of OT-relevant vulnerabilities in a year needed immediate action, and many published severity scores are wrong. Check whether a flaw can be reached from where an attacker would stand before taking a line down for it.

What should we do if we find encrypted files on an HMI?

Isolate that segment only, preserve the logs, and call a specialist before anyone powers anything down. Shutting everything off erases the evidence you need to understand what happened and to recover correctly.