Solution Builders team
Jump to a section
- Legacy machines cannot be fixed, only contained. Control what can reach the controller, block its internet access and keep a known good backup offline.
- A flat network turns a phishing email in accounting into a production outage. Segmenting with switches you already own closes that path in weekends.
- Tribal knowledge does not cause an attack, but it decides whether recovery takes four hours or four days. Write it down before you need it.
- All three gaps close in 90 days with zero machines replaced: see everything, build the walls, prove recovery.
Manufacturing IT security in Minneapolis has three gaps
None of the three things above is a security problem on its own. Together they are the reason manufacturing has been the most attacked industry in the world for three years running, according to IBM's X Force Threat Intelligence Index 2024. Manufacturing IT security in Minneapolis, from the machine shops along I-494 to the food processors in the northern suburbs, comes down to closing those three gaps.
Attackers look for the easiest path to the systems that stop production, because stopped production is what gets a ransom paid. In Solution Builders manufacturing assessments across the metro, the gaps show up in a consistent order.
- Legacy machines nobody can patch. The most common finding by far.
- A flat network from office to floor. One VLAN, one fault, one outage.
- Shared logins and vendor remote access. A standing VPN with one shared password.
- Knowledge held by one or two people. The HMI password, the PLC program, the vendor to call.
- No tested recovery for machine configurations. Backups of the office, nothing for the line.
This is a 90 day project, not a capital program
Closing all three gaps takes about one quarter, and almost none of it touches the machines themselves. You need a plan, a few weekends and someone who has done it before, not a new line or a shutdown.
Gap one: legacy equipment security when you cannot patch
A controller built in 2008 was never designed to sit on a network with the internet two hops away. The vendor may not exist anymore, the operating system stopped receiving updates years ago, and replacing it means replacing the machine it runs. So stop trying to fix the machine and start controlling what can reach it.
Try to fix the machine
- Wait for a vendor patch that never comes
- Install an endpoint agent the controller cannot run
- Plan a replacement nobody will fund
- Hope nothing finds it
Control what can reach it
- Only the engineering workstation and the historian can reach it
- Internet access blocked entirely
- Traffic mirrored to a monitoring tool
- Known good configuration backup kept offline
A legacy controller talks to the same two or three devices every day of its life, so the first unusual connection is an unmistakable signal. Then keep a known good backup of every program and configuration, offline, so a compromised controller is a one hour rebuild instead of a week of calling retired engineers. Our backup and disaster recovery team treats PLC programs and HMI projects as first class backup targets, which is still rare among IT providers in Minnesota.
Gap two: network segmentation for manufacturers without stopping production
When accounting, email, the warehouse scanners and the CNC line all share one network, a phishing email in the front office is a production problem. Ransomware spreads sideways, and a flat network gives it nowhere to stop. Segmentation puts walls between zones: office, plant, each production cell, vendor access. Traffic that crosses a wall has to be allowed on purpose.
Most plants can do this with the firewall and switches they already own, plus a few weekends of planned cutovers.
- Inventory and mapPassive discovery of every device on the plant network, grouped by what it talks to.
- Define zonesOffice, plant core, production cells, vendor access, cameras and building systems. Six zones cover almost every plant.
- Build the wallsVLANs and firewall policies between zones, starting with office to plant. Cut over on weekends, one zone at a time.
- Monitor the crossingsAlert on any new conversation between zones. That alert is your early warning system.
Segmentation also makes compliance easier. CMMC and customer questionnaires ask how you protect systems that handle controlled information, and "they are in their own zone" is a very good answer. For the practices around the walls, read our companion piece on cybersecurity best practices for manufacturing companies.
Gap three: the knowledge that lives in two heads
The third gap turns an incident into a crisis. Ask who knows the password to the HMI on line three, where the latest PLC program is saved, or which vendor to call when the packaging line faults. If the answer is a person instead of a document, you have found the gap. Closing it is unglamorous, and it is mostly a list.
- A credential vault for every machine, HMI and vendor portal login, instead of sticky notes.
- A runbook for each critical machine: how it starts and stops, where its program lives, who to call.
- A network diagram that matches reality, updated when the gap two walls go in.
- A cross trained backup for every key role on the floor and in IT.
- A vendor contact list that does not depend on one person's phone.
Documentation decides how long recovery takes
Documentation does not stop an attack. It decides whether recovery takes four hours or four days. In every manufacturing incident we have worked, the plants with current runbooks and offline configuration backups were back in production first.
This is where a co-managed IT partner earns its keep for a plant with one or two internal IT people. A partner cannot support what is undocumented, so documentation gets built as routine, and your IT lead stops being a single point of failure.
A 90 day plan to close all three gaps, zero machines replaced
Here is the plan we run with manufacturers from Bloomington to St. Cloud: visibility first, walls second, proof of recovery third.
| Phase | What gets done | What you can say afterward |
|---|---|---|
| Days 1 to 30: see everything | Asset inventory, network map, credential vault, MFA on every account that can reach the plant | We know what is on the floor and who can reach it |
| Days 31 to 60: build the walls | Office to plant segmentation, vendor access through a brokered jump host, internet blocked for controllers | A phishing email in accounting cannot reach a PLC |
| Days 61 to 90: prove recovery | Immutable backups of every machine configuration, one real restore test, runbooks for the top ten systems | We can rebuild any machine configuration in an hour |
| Ongoing | Managed detection on every Windows device, a 24/7 response team, a quarterly review of the three gaps | Someone is watching on Friday night |
The ongoing row is where most plants need help, which is why our cybersecurity services pair managed XDR on every Windows device with human analysts who can isolate a machine at 2 a.m.
Where IT support for Twin Cities manufacturers starts
Three moves this month, none requiring a purchase order.
- Ask the three questionsWho knows the HMI password on your most important line? Can a laptop in accounting ping a controller? When was a machine configuration last restored from backup?
- Pick the first wallOffice to plant is the first segment. Put it on the calendar for a weekend in the next 60 days and name the owner.
- Get an outside readA free 30 minute Security Readiness Snapshot with Solution Builders tells you which of the three gaps is open in your plant before an attacker finds out, whether or not you ever work with us.
You do not have to modernize the plant to secure it. You have to contain what is old, separate what is connected and write down what is in people's heads.Solution Builders Security Practice
Solution Builders has provided IT support for manufacturers across the Twin Cities and Greater Minnesota since 1995, from Bloomington. Our 50+ engineers and 24/7 security operations center serve plants with 25 to 500 employees, and the Secure pillar of our RISE framework is built around these three gaps.
Plant floor security for Twin Cities manufacturers
Solution Builders has worked on Minnesota plant floors since 1995. From Bloomington, our 50+ engineers and 24/7 security operations center support manufacturers with 25 to 500 employees across Minneapolis, St. Paul and Greater Minnesota, including defense suppliers, food processors and medical device makers with a plant outside the metro and an office inside it. Related services: Cybersecurity, Data Backup and Disaster Recovery, Co-Managed IT, CMMC Compliance. Contact us or book a 30 minute call.
