- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is in the middle of a historic expansion. The Production Linked Incentive (PLI) schemes across fourteen sectors — from semiconductors to pharmaceuticals, from specialty chemicals to auto components — are pulling billions of dollars of investment into greenfield factories. At the same time, the government’s push for Industry 4.0 and smart manufacturing is connecting plant-floor machinery to enterprise IT networks in ways that simply did not exist five years ago.
This convergence of operational technology (OT) and information technology (IT) is creating a cybersecurity exposure that most Indian manufacturers are not yet equipped to manage. This post explains the threat landscape, the specific vulnerabilities that attackers exploit in OT environments, and the layered defence architecture that protects both the plant floor and the enterprise network.
Operational technology — the hardware and software that monitors and controls physical processes — was designed for reliability and determinism, not security. A programmable logic controller (PLC) managing a chemical reactor, a SCADA system supervising a water treatment plant, or a distributed control system (DCS) running a refinery was engineered to run continuously for fifteen years. Security patching, strong authentication, and encrypted communications were afterthoughts — or not thought about at all.
Attackers understand this. When a ransomware group encrypts an Indian manufacturer’s enterprise IT systems, the company can rebuild from backups in days. When the same group crosses into the OT network and locks the SCADA historian or modifies ladder logic on a PLC, the company may face weeks of lost production, potential physical damage to equipment, and in extreme cases, safety risks to workers.
The 2021 attack on the Oldsmar water treatment facility in Florida — where an attacker remotely increased sodium hydroxide levels to dangerous concentrations — demonstrated that OT compromise is not theoretical. Indian manufacturers operating continuous-process industries (chemicals, pharmaceuticals, food processing) face similar exposure if OT access is not properly isolated and monitored.
Several threat categories are especially relevant to Indian manufacturers:
India’s strategic position and its growing defence and semiconductor manufacturing base make it a target for state-sponsored intrusion campaigns. CERT-In advisories have flagged persistent intrusion activity targeting critical infrastructure operators. The goal in many nation-state campaigns is not immediate disruption but long-term access and intelligence gathering — placing implants that can be activated during a geopolitical crisis.
Several major ransomware operations have developed modules specifically designed to identify and disrupt OT environments. Groups in this category scan for Siemens, Rockwell Automation, Schneider Electric, and GE protocols (such as Modbus, DNP3, and EtherNet/IP) on networks they have already compromised, then trigger disruption to maximise extortion pressure. Indian manufacturers that have connected their plant-floor networks to enterprise IT — often for remote monitoring or ERP integration — are reachable once the enterprise network is breached.
OT systems often receive updates, patches, and configuration changes from IT vendors. If a vendor’s laptop is compromised and connects directly to a historian server or engineering workstation via a VPN, the attacker has a path that bypasses the IT/OT boundary entirely. This supply-chain attack vector has affected energy companies and utilities globally, and it is fully applicable to Indian manufacturing.
A network assessment of a mid-market Indian manufacturer typically reveals several of the following exposures:
Securing an OT environment does not mean ripping out legacy equipment — that is typically impossible in a running factory. It means building a defensive architecture that compensates for the inherent weaknesses of OT devices without disrupting production.
The first priority is to establish clear network zones: an enterprise zone (IT), a DMZ (data historians, remote access jump servers, patch management servers), and a production zone (PLCs, HMIs, field devices). Each zone boundary is enforced by a next-generation firewall with deep-packet inspection. FortiGate’s Industrial Security service includes signatures for OT-specific protocols — Modbus, DNP3, EtherNet/IP, BACnet — allowing the firewall to inspect and filter protocol-level anomalies at the IT/OT boundary without breaking legitimate traffic.
All remote access to OT systems must be channelled through a jump server in the DMZ, with multi-factor authentication, session recording, and time-limited access grants. ZTNA applied at the access layer means that a vendor engineer connecting from outside the facility receives access only to the specific OT asset they need, only for the duration of the work order, and only from an approved device — not broad network access to the production zone.
Traditional SIEM tools do not understand OT protocols. A spike in Modbus read requests or an anomalous WRITE command to a PLC register looks like normal traffic to a tool that only understands TCP/IP. OT-aware monitoring captures and baselines OT traffic patterns, then alerts when process values change outside expected ranges or when protocol commands are issued from unexpected sources. This kind of monitoring requires passive sensors (spanning traffic from the OT network switches into a monitoring platform) rather than active scanning, which can crash legacy OT devices.
Legacy OT devices that cannot be patched should be isolated behind the firewall and monitored more aggressively. Where vendor-supported updates are available, a formal patch management process — test in lab, deploy in a maintenance window with rollback plan — reduces the attack surface over time. Engineering workstations that run vendor HMI software should be on a dedicated VLAN, not on the general enterprise domain, and should have application allowlisting enabled.
CERT-In’s 2022 directions on cybersecurity apply to organisations operating critical information infrastructure — which includes manufacturing organisations in sectors designated as critical by the government. The key requirements most relevant to OT environments are:
The core challenge in OT security is visibility. The enterprise SOC can see everything happening on the IT network. The OT network — often running in a separate building, monitored by a separate operations team — is a blind spot. When an attack crosses the IT/OT boundary, the two teams frequently discover this only after the fact, working from logs they cannot correlate in real time.
The platform we deploy and operate for clients, PrahiX Ora — a unified SecOps platform built by PrahiX Tech Pvt Ltd — is designed to close that visibility gap. Its four pillars work together to provide a single operations view across both IT and OT environments:
SIEM — bringing OT logs into enterprise correlation: PrahiX Ora’s SIEM ingests log and event streams from both enterprise IT sources (firewalls, endpoints, identity providers) and OT sources (SCADA historians, engineering workstation event logs, OT-aware network sensors). Correlation rules mapped to MITRE ATT&CK for ICS — a framework that covers attack techniques specific to industrial environments — fire when patterns such as reconnaissance against OT protocols, unauthorised engineering workstation logins, or unexpected PLC WRITE commands appear. Tiered hot/cold/archive retention ensures that 180 days of logs remain searchable on-platform, satisfying CERT-In’s in-country retention direction without requiring separate OT-specific log infrastructure.
NMS — unified observability across IT and OT network layers: PrahiX Ora’s NMS provides visibility across FortiGate firewalls at the IT/OT boundary, switches, wireless APs, and WAN links — the full IT network topology. LLDP/CDP discovery builds a live network map, so when a new device appears on a production VLAN without being in the asset inventory, it is flagged automatically. ML-based anomaly detection baselines traffic patterns between network zones; a sudden increase in traffic from the OT zone toward the enterprise core — the kind of pattern seen in OT-to-IT lateral movement — is surfaced as an anomaly without requiring a specific signature. For multi-site manufacturing estates where NOC visibility has historically been fragmented across plant-specific tools, this unified view replaces the gap-ridden dashboards that allowed anomalies to go undetected.
Video Surveillance (VMS) — physical access as part of the security picture: Physical security is especially important in OT environments. An attacker with physical access to a PLC panel or a network switch in the production zone can bypass every network-layer control. PrahiX Ora’s video surveillance (VMS) module manages ONVIF-compliant cameras from Hikvision, Dahua, and other vendors, and applies video analytics to detect unauthorised access to restricted plant areas — control rooms, server rooms, electrical substations. For manufacturing and multi-site estates, correlating a physical access anomaly with a network anomaly in the same operations view turns an alert into a confirmed incident.
SOAR — meeting the 6-hour window in an OT incident: When an OT incident is confirmed, the SOC faces an unusually complex containment decision: isolating the affected OT network segment may stop the attack but also stop production. Pre-built SOAR playbooks that handle OT incident scenarios allow the team to execute containment steps in a defined sequence — isolate at the firewall boundary, preserve forensic evidence, generate the structured CERT-In notification report — without improvising under pressure. Automated blocklist pushes to FortiGate at the IT/OT boundary can contain lateral movement while the team assesses whether production can be safely paused. This automation is what makes the 6-hour reporting window achievable for a team simultaneously managing an active incident and a production line.
If you operate a manufacturing facility in India and want to understand what an IT/OT security assessment and monitoring deployment looks like in practice, the PJ Networks team can walk through a site-specific architecture with your team.
If you are a CISO or plant IT manager wondering where to start, here is a prioritised action list:
India’s manufacturing sector is producing enormous economic value — and that makes it an increasingly attractive target for both financially motivated ransomware groups and state-sponsored actors. The IT/OT convergence that is enabling Industry 4.0 is simultaneously creating attack paths that did not exist in isolated plant-floor networks.
The good news is that the defence architecture is well understood, even if the implementation requires careful planning to avoid disrupting production. Network segmentation with OT-aware firewalls, secure remote access via ZTNA and jump servers, integrated SIEM/SOAR monitoring that spans both IT and OT environments, and a tested incident response playbook calibrated to CERT-In’s 6-hour reporting window — deployed together, these controls transform an exposed OT environment into one where attacks are detected early, contained quickly, and reported on time.
PJ Networks helps Indian manufacturers build and operate exactly this kind of converged IT/OT security architecture — from FortiGate at the network boundary to PrahiX Ora at the operations layer. If your team is beginning or accelerating an OT security programme, get in touch with us to discuss your environment.