How to Protect ERP and CNC Systems From Ransomware: A Guide for West Michigan Manufacturers
How to Protect ERP and CNC Systems From Ransomware: A Guide for West Michigan Manufacturers
Evolving Technology SolutionsThe short answer
Ransomware hits manufacturers through the office network, then spreads to the ERP server, file shares and any machine it can reach. Most small manufacturers can stop that spread with four controls: separate the shop floor network from office IT, keep an offline copy of ERP and CNC program files, require MFA on every remote login, and run endpoint detection and response on every Windows machine that can run it. Then test a full restore before you need one.
Why manufacturers get hit
- Downtime is expensive. Attackers know a stopped line costs output, overtime and missed shipments, so manufacturers pay.
- Flat networks. Many plants run office PCs, the ERP server, CNC controllers and cameras on one network. One infected laptop can reach everything.
- Old machines. CNC controllers and HMIs often run Windows versions that cannot be patched or run modern security tools.
- Vendor remote access. Machine builders and ERP vendors often keep always-on remote access tools that nobody monitors.
What to protect first
| System | Why it matters | Minimum protection |
|---|---|---|
| ERP database and server | Orders, scheduling, inventory and billing stop without it | Daily backup with an offline or immutable copy, restore tested quarterly |
| CAD/CAM vault and CNC programs | Years of engineering work and machine programs | Versioned backup kept off the main network |
| PLC and HMI configurations | Rebuilding by hand takes days | Export after every change and store offline |
| Domain controllers and Microsoft 365 | Attackers use admin accounts to spread | MFA, separate admin accounts, alerting on new admins |
| Shop floor PCs and controllers | Often unpatchable | Isolated network segment with tight firewall rules |
How to protect ERP and CNC systems from ransomware
- Inventory every device on the shop floor, including CNC controllers, PLCs, HMIs, CMMs, cameras and the PCs that send programs to machines.
- Separate the shop floor onto its own network segment and allow only the specific connections production needs, such as the program server to the machines.
- Move vendor remote access behind a gateway that requires MFA and is turned on only when the vendor is working.
- Require MFA on email, VPN, remote desktop and every admin account, and give IT staff separate admin accounts.
- Run endpoint detection and response with 24/7 monitoring on every server and PC that supports it, and use application allowlisting on machines that cannot run EDR.
- Back up the ERP database, CAD vault, CNC programs and PLC configurations daily, with at least one copy offline or immutable.
- Restore the ERP server and a sample of CNC programs from backup every quarter and record how long it took.
- Write a one-page production-down plan: who to call, which machines can run without ERP, and how orders get tracked by hand.
- Train office staff to spot phishing and invoice fraud, since most attacks start in someone's inbox.
What it costs
For a manufacturer with 20 to 100 users, network segmentation is usually a one-time project of $5,000 to $25,000 depending on plant size and existing switches and firewalls. Ongoing managed IT and security with EDR, monitoring, email security and backup typically runs $100 to $200 per user per month. Evolv's managed IT and security starts at $95 per user per month, and clients average about $150.
Questions to ask your IT provider
- Can an infected office PC reach our CNC machines or PLCs today?
- When did we last restore the ERP server from backup, and how long did it take?
- Is any copy of our backups offline or immutable?
- Which vendors have remote access to our machines, and is it always on?
- What is your response time if production is down, and is it in the contract?
Frequently asked questions
How do I protect CNC machines from ransomware? Put CNC machines and controllers on a separate network segment with firewall rules that allow only the connections production needs, keep offline backups of every CNC program, and lock down vendor remote access with MFA. Machines that cannot be patched should never be reachable from office PCs or the internet.
How should a manufacturer back up its ERP system? Back up the ERP database and server daily, keep at least one copy offline or immutable so ransomware cannot encrypt it, and restore the full system on a test schedule, at least quarterly. A backup that has never been restored is not a recovery plan.
What is OT network segmentation? OT segmentation separates operational technology, such as CNC machines, PLCs, HMIs and plant cameras, from office IT using VLANs and firewall rules. It stops an infection on an office laptop from spreading to production equipment.
Does cyber insurance require network segmentation for manufacturers? Most carriers now ask about MFA, endpoint detection and response, offline backups and how production systems are separated. Segmentation and tested backups often improve renewal terms.
Who helps West Michigan manufacturers protect production systems? Evolving Technology Solutions (Evolv), based in Grand Rapids, segments shop floor networks, runs EDR with 24/7 monitoring, backs up ERP and CAD systems with quarterly recovery tests, and commits to a 1-hour response for production-down issues.
Talk to Evolv
Book a 20-minute call or call (616) 243-2234. See our shop floor network security, backup and disaster recovery and manufacturing cybersecurity programs.