How to secure a plant network when you move to Sonora

When a manufacturing plant lands in Sonora under a nearshoring model, the network usually goes up against the clock: produce first, organize later. The catch is that the improvised setup —unconfigured switches, one flat WiFi for everything, remote access left open “for now”— sticks around for years and becomes the way in for an incident that stops the line.

This guide walks through, in priority order, what has to be right so your operation’s network isn’t the weak link. It isn’t a shopping list of products: it’s the engineering judgment we apply at every go-live.

1. Separate what shouldn’t see each other

The most common mistake is a flat network: offices, plant floor, cameras, guests and servers all on the same segment. Infect one device and it reaches everything.

The baseline is to segment by VLAN according to function and risk:

• Corporate IT (workstations, ERP, email).
• OT / plant floor (PLCs, HMIs, control systems) — the most sensitive segment, and the one that tolerates reboots the worst.
• Cameras and CCTV, which almost never need to talk to the office network.
• Guests / contractors, fully isolated.

Between segments, traffic passes through the firewall under explicit rules: only what needs to communicate does. Everything else is denied by default.

In OT environments, segmenting badly can take production down. Any network change touching the plant floor is done within a maintenance window and with a rollback plan.

2. Close remote access before someone else finds it

A corporate HQ in the United States needs visibility into the Mexican operation, and that’s legitimate. What isn’t legitimate is solving it with an RDP port open to the internet or a shared VPN behind a single password half the team knows.

The minimum:

• No RDP/SSH exposed directly to the internet. Remote access comes in through a VPN (IPsec/SSL) or a zero-trust access solution.
• MFA required on every remote and administrative login. A stolen credential should not be enough.
• Named accounts, not generic ones: if five people share “admin,” there’s no way to audit who did what.

Done right, remote access doesn’t get in HQ’s way; it gives them visibility without leaving the front door open.

3. Patch what you can, isolate what you can’t

Manufacturing mixes modern gear with machines running on systems the vendor stopped supporting years ago. You can’t always update a machine’s controller without voiding the supplier’s warranty.

The strategy is twofold:

• Patch with discipline everything that does take updates: servers, workstations, firewall, network equipment. A monthly patch cycle, tested first, prevents most opportunistic incidents.
• Isolate what can’t be patched. If an HMI runs on an unsupported operating system, you don’t leave it on the internet or on the office segment: you box it into its own VLAN with tightly controlled access.

Any figure like “X% of industrial devices are unsupported” or a specific CVE reference must be verified against the vendor’s official source before citing it. [a validar]

4. If you don’t monitor it, you find out too late

The gap between a scare and a three-day outage is usually detection time. A network can sit compromised for weeks before anything shows up in production.

What we recommend operating, not just installing:

• Centralized logs from the firewall, servers and domain controllers, retained long enough to actually investigate.
• Alerts on what matters: administrative logins outside business hours, anomalous outbound traffic, brute-force attempts.
• Regular review, not a dashboard nobody looks at. Monitoring with no one to respond is decoration.

5. Have a way back

No set of controls stops 100% of incidents. What separates an orderly recovery from a crisis is the backup:

• Backups following the 3-2-1 principle (three copies, two media, one offsite), with at least one immutable or offline copy that ransomware can’t encrypt.
• Real, periodic restore tests. A backup you’ve never restored is a hypothesis, not a backup.

In short

Securing a new plant’s network isn’t buying a magic box: it’s segmenting, closing access, patching with discipline, monitoring for real and being able to roll back. In that order. Each point shrinks your attack surface and, above all, shrinks the time an incident can keep production down.

That’s exactly the logic behind our assessments. If you want to know where your operation stands today across these five fronts —and which gaps to close first— ask us for an assessment: we review your infrastructure and your security and hand you findings prioritized P1/P2/P3, free and with no fine print.