An Increasingly Relevant Risk
Cybersecurity has traditionally been treated as an information technology concern, separate from the operational technology running production equipment on a manufacturing floor. That separation is becoming increasingly difficult to maintain. Modern PLC and HMI systems are frequently networked, whether for remote monitoring, integration with production data systems, or simple convenience of access, and this connectivity introduces genuine cybersecurity risk to equipment that was never originally designed with security in mind. For FMCG plant managers, understanding the basics of industrial control system cybersecurity is no longer optional, even without becoming a specialist in the field.
Why Industrial Control Systems Are Different From IT Networks
Standard information technology security practices do not translate directly to industrial control environments. A PLC controlling a glycol refrigeration system or a hot water rinse process cannot simply be patched and rebooted on a routine schedule the way an office computer might be, since doing so risks interrupting a live production process, and in some cases risks safety critical functions. Many industrial control systems, particularly older installations, run on legacy hardware and software versions that vendors no longer actively support with security updates, because replacing them would require significant capital investment and production downtime that is difficult to justify purely for cybersecurity reasons.
This creates a genuine tension: the equipment running much of FMCG production is often less inherently secure than a typical office IT environment, while the consequences of a security incident, ranging from production downtime to safety system compromise, can be significantly more serious.
Common Vulnerabilities on FMCG Production Sites
Several patterns show up repeatedly when reviewing industrial control system security on manufacturing sites. Default or weak passwords on PLCs, HMIs, and network switches remain common, often unchanged since original commissioning years earlier. Flat network architecture, where production control systems sit on the same network as general office systems without meaningful segmentation, means a compromise anywhere on the network can potentially reach critical control equipment. Remote access solutions, often set up for convenient vendor support or engineer access, are sometimes configured without adequate authentication controls, creating an accessible entry point for anyone who discovers it.
None of these vulnerabilities are exotic or difficult to understand, which is part of why they remain so common. Addressing them does not require deep cybersecurity specialisation, but it does require a deliberate, structured review, since these gaps rarely get identified through normal day to day operation of a production line.
Practical Steps That Make a Genuine Difference
Network segmentation is one of the most effective practical measures available. Separating production control networks from general office and internet connected networks, using firewalls or managed switches to control what traffic can pass between them, significantly reduces the risk that a compromise elsewhere in an organisation’s broader IT environment can reach critical control systems. This does not need to be an all or nothing architectural overhaul, it can be implemented progressively, starting with the most critical control systems.
Reviewing and updating default credentials on PLCs, HMIs, and network infrastructure is a simple but frequently overlooked step, particularly on equipment that has been in service for years without a formal security review. Similarly, auditing remote access arrangements, understanding exactly who has remote access to production control systems and how that access is authenticated and logged, closes a common and easily exploited gap.
Maintaining an accurate inventory of control system hardware and software versions is also genuinely valuable, not just for security purposes but for general engineering management. Knowing which PLCs are running unsupported firmware versions, and which network devices have known vulnerabilities, allows a manufacturer to make informed, risk based decisions about where to prioritise upgrades, rather than discovering these gaps only after an incident.
Balancing Security With Operational Reality
The goal of industrial control system cybersecurity is not to apply generic IT security practices wholesale to a production environment, but to apply security thinking in a way that respects the operational realities of running live manufacturing equipment. Changes need to be planned around production schedules, tested carefully before implementation, and weighed against the genuine risk they address, rather than pursued as a compliance exercise disconnected from actual risk. An engineering partner with genuine understanding of both the control systems involved and the practical constraints of a live production environment is better placed to strike this balance than a generic IT security provider working from outside the operational technology context.
Where to Start
For most FMCG manufacturers, a sensible starting point is a structured review of existing control system network architecture and access arrangements, identifying the most significant and most easily addressed gaps first. This is typically far more valuable than attempting a comprehensive security overhaul immediately, both because it delivers meaningful risk reduction sooner, and because it allows changes to be tested and validated incrementally rather than all at once across critical production infrastructure.
The Role of Staff Awareness
Technical controls such as network segmentation and credential management address only part of the risk. Many industrial control system security incidents originate not from sophisticated external attacks, but from simple human factors: a USB drive used to transfer a file between an infected office computer and a production control system, a shared password that has been passed between so many staff over the years that nobody can say who currently has access, or a vendor technician granted remote access for a single support task whose access was never subsequently revoked. Building basic security awareness among production and maintenance staff, without requiring them to become cybersecurity specialists, closes many of these gaps more effectively than technical controls alone.
This does not require an elaborate training programme. Straightforward guidance on safe handling of removable media around control systems, a clear process for granting and revoking vendor remote access, and a simple, well understood policy on credential sharing address a meaningful proportion of the human factor risk present on most production sites.
Working With External Vendors and Support Providers
Most FMCG production sites rely on multiple external vendors for equipment support, from PLC manufacturers to specific machine OEMs, each of whom may require occasional remote or on site access to control systems. Establishing clear, consistent expectations for how this access is granted, authenticated, and time limited, rather than allowing each vendor relationship to develop its own informal arrangement, is a practical way to reduce the accumulated risk that builds up over years of ad hoc vendor access arrangements.
Building Security Into Engineering Practice
As BevTech continues to deliver control system upgrades and new automation projects across Allen Bradley and Siemens platforms for FMCG clients, cybersecurity considerations, appropriate network segmentation, credential management, and access control, are increasingly built into project scope from the outset, rather than treated as an afterthought once a system is already commissioned. For manufacturers wanting to understand their current exposure or plan a practical, prioritised approach to control system security, contact BevTech at 25 Silvio St, Richlands QLD 4077, or admin@bevtech.com.au.