Separating the Machine Network From the Office

Factory networks are usually built on one principle: plug everything into the same switch and get it working. Office PCs, printers, cameras, the server and the computers beside the machines all sit side by side. It is quick to install and causes no trouble at first.

The trouble shows up the day someone in accounts opens an attachment. The malware scans the network shares and finds the weakest link: a machine PC running an old version of Windows, with no updates available and no antivirus it can run. Office PCs are rebuilt in a few hours. Bringing the machine back takes days, because what lives on it is not just an operating system but a vendor-specific installation.

What separation actually means

Separation does not mean cutting cables. The machines sit in their own segment, and traffic between segments follows rules:

• Machines and operator PCs move into their own network segment (VLAN).
• Only the traffic that is genuinely needed crosses from the office side; the "everything reaches everything" rule goes away.
• Direct internet access from the machine side is switched off, and opened deliberately and temporarily when required.
• Wireless is split: guest, office and production devices such as handheld terminals do not share one network.
• A written rule covers USB media, which is how a large share of infections reach machine PCs.

So how does the data get out?

The objection we hear most is that separation will hide the production report from the office. It will not. The right design lets data flow one way: production and downtime figures are collected on the machine side, handed to a collector at the boundary, and read as a report on the office side. The office user reads a report instead of connecting to a machine.

The same logic covers vendor support: a remote session reaches the machine segment only, never the office.

Moving there from a flat network

This is not an overnight job, but it is not a major project either. The order that works:

• Inventory. Which device is where, on which port, talking to what. Skip this and something will break after the split.
• Grouping. Office, production, cameras, guest and servers — five groups cover most plants.
• Address plan. Each group gets its own range, so anyone looking at an address later knows what kind of device it is.
• Migration. Group by group, during planned downtime. Cables are not moved while a line is running.
• Rules and testing. Write the crossing rules, then test them one by one: is the report visible, does the printer work, does the handheld connect.

If the existing switch does not support segmentation, hardware may need replacing — usually a single device in a workshop-sized plant.

For an unpatchable machine, isolation is the patch

Most machine PCs cannot be updated: the vendor supports that version, and moving to a newer one risks stopping the machine. The way to secure them is not to patch them but to put them out of reach. A machine on a separated segment sits outside the range of the automated attacks that arrive from the internet.

How Yamanlar Bilişim helps

Our part is the device inventory, the groups and the address plan, migrations during planned downtime, and testing that production data still flows. We do not touch the machines' programs. The network side sits in network infrastructure, security and monitoring in enterprise cyber security, and production-specific work on the manufacturing and workshops page.

Frequently asked questions