IT is worried about connecting the monitoring server to office and production LANs

[DataForge]

We're preparing to install a monitoring server (OEE and later SCADA) that reads data from PLCs on the production floor. Managers should be able to see dashboards from the office network.
Our IT department is not comfortable with a PC that has one network card on the production network and one on the office network. They say it creates a bridge between the two. On the other hand, the automation team says separating everything makes the system impossible to use. Is there a common, reasonable architecture for a small plant like ours (one IT person, about 40 PLCs)?

[Technical Support]

Your IT department's concern is valid, and there is a middle ground that works well for plants of your size.
1. Keep a clear boundary
Place a firewall between the production (OT) network and the office (IT) network, instead of a PC with two network cards. The firewall decides exactly which traffic is allowed, and it can be logged and reviewed.
2. Allow only what is needed, in one direction
- The monitoring server sits on the OT side, next to the PLCs.
- Office users reach only the web interface port of that server.
- Nothing from the office network should reach the PLCs directly.
In Proveris OEE, the web interface and the Proveris server can even run on different computers: the server stays on the production side and the web interface connects to it using the server key from the Server Status page, with only that one connection allowed through the firewall.
3. Basic hygiene
- Individual user accounts, no shared passwords, and limited admin/developer accounts.
- Restrict who can write to PLCs. In Proveris OEE, writing values to tags is limited to the Developer role and every write is logged.
- Keep the server OS patched on a schedule agreed with production.
- Backups of the project and database stored off the server.
4. Remote access
If vendors or your own team need remote access, use the company VPN with individual accounts and time-limited access. Avoid permanently installed remote desktop tools.
5. Write it down
A one-page network diagram with allowed connections is often the most valuable security document for a small plant.
More on the topic: https://greensoft.ai/blog/scada-cybe...ntrol-systems/ and https://greensoft.ai/blog/scada-comm...-architecture/