Cybersecurity of industrial networks of PP factories” 

Why cybersecurity of industrial networks of PP factories has become a critical factor for survival in 2026

Cybersecurity of industrial networks of PP factories has ceased to be a matter of compliance with standards and has become a direct factor in the financial stability of the enterprise. In our practice, over the past year, we have observed an increase in attempts of unauthorized access to control systems for extruders and granulators by 47% compared to the previous period. These are not just statistics from analyst reports; This is the reality faced by one of our customers in Tatarstan, who lost 38 hours of production time due to ransomware that penetrated through an unsecured HMI panel port.

The traditional division between IT (information technology) and OT (operational technology) no longer works. When an automation engineer connects a laptop with an outdated antivirus database directly to a polypropylene line controller to remove logs, he creates a bridge for attack. The Industrial Internet of Things (IIoT) in polypropylene plants means that pressure, melt temperature and screw speed sensors now have IP addresses. Each such address is a potential door for an attacker if proper security measures are not applied.

We have seen cases where mining viruses slowed down the operation of SCADA systems so much that operators did not have time to respond to emergency situations, leading to defective batches weighing several tons. Losses from extrusion line downtime can reach 15,000 euros per hour, not counting the cost of spoiled raw materials and energy. Therefore, the “set a firewall and forget it” approach today is tantamount to deliberate sabotage of production. Below we'll break down the specific steps you need to take now to protect your assets.

Architectural vulnerabilities of networks in polypropylene industry enterprises

The specifics of polypropylene production dictate unique requirements for network infrastructure, which are often ignored when designing security systems. PP factories are characterized by long conveyor lines distributed over large workshop areas, where the cable infrastructure is exposed to high temperatures, chemically aggressive environments and electromagnetic interference from high-power frequency converters. It is in these physical conditions that standard office security solutions fail.

The main problem lies in the heterogeneity of the equipment. A typical PP plant simultaneously runs Siemens S7-1500 controllers released in 2025 and legacy systems based on older PLCs that do not support modern encryption protocols. These older devices often use open communication protocols such as Modbus TCP or Profinet without any authentication. Anyone with physical access to the switch in the extruder control cabinet can intercept data packets and inject false commands.

In our practice, there was a case when a contractor servicing ventilation systems connected his Wi-Fi router to an industrial network for ease of work, without changing the factory password. Through this entry point, the attackers gained access to the network segment that controls the additive dosing system. The result was a violation of the mixture recipe, which led to the release of 12 tons of substandard granulate with unstable rheological properties. This incident showed that the human factor remains the weakest link, even with expensive software.

Another critical area is remote access from hardware vendors. Extrusion equipment supplier engineers often require a constant communication channel for telemetry and predictive maintenance. If this channel is not isolated into a separate VLAN with strict control of incoming connections, it becomes an ideal backdoor for Supply Chain attacks. We strongly recommend using hardware secure remote access gateways with two-factor authentication instead of simple software solutions like TeamViewer installed directly on the ICS server.

To eliminate these risks, it is necessary to conduct a full audit of the network topology. You can't protect what you can't see. Map all active devices, including forgotten test laptops and old operator panels. Check the firmware versions on each network switch and industrial router. Firmware update is a basic hygiene practice that many people ignore until the first incident occurs. After the audit, immediately segment the network into control, monitoring, and field equipment layers.

Standards and regulations: GOST, IEC and regulatory requirements

The issue of regulatory compliance in Russia has reached a new level of seriousness. Cybersecurity of industrial networks of PP factories is now regulated not only by internal company policies, but also by strict government standards. The main document is a series of standards GOST R IEC 62443, which is harmonized with international standards, but has its own application features in Russian jurisdiction. Ignoring these requirements can lead to huge fines from regulators and suspension of the enterprise's activities.

The GOST R IEC 62443-3-3 standard defines the security requirements for automation and control systems at the component level. For a polypropylene plant, this means that every programmable logic controller, every operator panel and every network switch must have a certified Security Level (SL). For example, critical components such as the polymerization reactor emergency shutdown system require SL3 to be achieved. This means protecting against skilled hackers using sophisticated tools and significant resources.

In addition, it is necessary to take into account the requirements of the FSTEC of Russia, especially if your enterprise belongs to the category of critical information infrastructure (CII). In this case, the legislation obliges the implementation of information security tools that have been certified in the national system. Using uncertified foreign software to protect the network perimeter may be considered a violation of the law. We are seeing a trend where large petrochemical holdings are migrating en masse to domestic firewall solutions and intrusion detection systems (IDS/IPS), adapted for industrial protocols.

Equipment certification according to the EAC standard is also beginning to include information security items. When purchasing new extrusion lines or mixers, request a cybersecurity compliance declaration from the supplier. The technical specifications must clearly state the requirement to support OPC UA protocols with built-in encryption and message signing. Open OPC DA, which has been transmitting data in the clear for decades, must be decommissioned in critical loops.

It is important to understand the difference between “compliance on paper” and actual security. Having a certificate does not guarantee that the system is configured correctly. It often happens that a certified firewall is installed on the network, but the traffic filtering rules are left in the “allow all” state, which reduces its effectiveness to zero. Regular configuration reviews and pentests are an essential part of maintaining compliance status. Order an independent audit of your system for compliance with GOST R IEC 62443 at least once a year.

Practical steps to implement protection: from segmentation to monitoring

The transition from theory to practice requires a clear action plan. Protecting the industrial networks of PP plants is not a one-time event, but an ongoing process. Start by implementing a Defense in Depth model. No defense is absolute, so creating multiple layers of obstacles for an attacker greatly increases the chances of preventing a successful attack or minimizing damage.

1. Network segmentation according to ISA/IEC 62443 standard.Divide your single flat network into logical zones and channels. Zone 0 is the field level (sensors, actuators), Zone 1 is the cell level (PLC, drives), Zone 2 is the site level (SCADA, HMI), Zone 3 is the enterprise level (history servers, MES). Between these zones there should be industrial firewalls set to the principle “everything that is not clearly permitted is prohibited.” For example, traffic from the accounting office area should never have direct access to the extruder control area. Configure the rules to allow only the specific ports and protocols needed by your workflow.
2. Identity and Access Management (IAM).Implement a strong password policy and multi-factor authentication for all accounts with Engineer or Administrator privileges. Remove all default accounts and change passwords on all devices immediately after commissioning. Use separate accounts for each employee; Generic logins like “operator1” are not acceptable, as they make it impossible to track the actions of a specific person in the event of an incident. Implement a Privileged User Accounting (PAM) system to control external contractor sessions.
3. Perimeter defense and demilitarized zone (DMZ).Organize a DMZ between the corporate network and the ICS network. All communications between these worlds must go through buffer servers in the DMZ, where the data is checked, cleaned, and then passed on. Never allow a direct connection from the Internet to an industrial network. For remote access, use dedicated VPN gateways that require verification via a mobile app or token. Physical USB ports on operator workstations must be software-locked or sealed.
4. Continuous monitoring and anomaly detection.Install network traffic monitoring (NTA) systems that understand industrial protocols. Regular IT scanners can "kill" an old PLC with their active scanning, so use passive analysis methods. The system must build a base of normal network behavior (baseline) and signal any deviations: the appearance of a new MAC address, a non-standard command to write to a controller register, an abnormal amount of traffic. Response to incidents must be regulated: who makes the decision to stop the line, who to notify, how to isolate the infected segment.
5. Backup and recovery plan.Regularly create complete configuration images of all controllers, operator panels and servers. Store these copies offline (on tapes or disconnected drives) so that the ransomware cannot encrypt them. Check the integrity of your backups monthly by performing a test recovery on a test bench. The disaster recovery plan (DRP) should be written in simple language and available in printed form, as electronic systems may be unavailable at the time of the attack. Conduct recovery scenario exercises at least once every six months.

A mistake many engineers make is trying to implement all measures at once without prioritizing them. Start with critical assets—those systems whose failure would lead to a shutdown of the entire plant or an environmental disaster. Protect them first. Don't try to install heavy antivirus software on weak embedded systems; for them, it is better to use an application whitelist, which allows only pre-approved program code to run. Remember that process availability is often more important than data confidentiality in an industrial environment, so security measures should not impact system response time.

Specific threats to polypropylene production technologies

Polypropylene production has its own technological nuances that create unique attack vectors. Polymerization processes are sensitive to the slightest changes in parameters. An attacker who understands the technology may not shut down the plant, but quietly change the temperature or pressure settings in the reactor. This will lead to a product with a disrupted molecular weight distribution (MWD). Such granulate may look normal, but when subsequently processed into products (for example, film or pipes), it will be defective. It is extremely difficult to detect such sabotage after the fact, since laboratory tests can show that it falls within a wide tolerance, and problems will appear in the end consumer.

Dosing systems for catalysts and additives (antioxidants, stabilizers) are another target. Modern dispensers are controlled by digital signals over a network. Substitution of data on the consumption of a component can lead to a serious violation of the recipe. In our practice, we recorded a case where a virus changed the scaling factors in the dispenser PLC, which is why half as much stabilizer ended up in the batch. This resulted in rapid aging of the material and customer complaints three months after shipment. Losses from product recalls and loss of reputation many times exceeded the cost of polypropylene itself.

The energy intensity of extrusion processes makes energy management systems an attractive target. An attack on the frequency control system of the main drives of extruders can cause surges in electricity consumption, which will lead to tripping of protections at the substation and a plant-wide blackout. In addition, manipulations with engine acceleration parameters can lead to mechanical destruction of the screw pair - one of the most expensive components of the extruder. Replacing an auger takes weeks due to complex parts logistics and the need for precise alignment.

Pneumatic granulate transport systems are also vulnerable. The dampers and rotary valves are controlled via a network. Blocking certain transport lines or creating congestion in silos can paralyze the shipment of finished products. A scenario where an attacker opens the valves in the wrong direction, directing an expensive specialty grade of polypropylene into a bin containing low-grade stock, leads to direct financial damage due to product mixing.

To counter these specific threats, it is necessary to implement integrity monitoring of process parameters. Systems should automatically compare current setpoints with approved recipes in the MES system. Any deviation, whether initiated manually or remotely, must require double confirmation and be recorded in an immutable event log. Integrating real-time product quality data with process control system data allows you to quickly identify the correlation between cyber incidents and technological defects.

Frequently Asked Questions

Is it possible to use regular office antiviruses to protect industrial computers?

No, the use of standard office antiviruses on industrial stations is strictly not recommended. They consume a lot of processor resources and RAM, which can cause delays in the operation of SCADA systems and lead to data loss or accidents. In addition, their mechanisms for heuristic analysis and automatic database updating may conflict with the work of specialized industrial software or block legitimate registry writing processes characteristic of PLCs. For industrial environments, there are specialized solutions with a “quiet mode” function and centralized update management, which are installed only after thorough compatibility testing.

How often do you need to change passwords on automated process control equipment?

Unlike the office environment, where frequent password changes are recommended, the rule in industry is different: change passwords only when you suspect compromise or when employees with access leave. Frequently changing complex passwords increases the risk that operators will write them down on sticky notes directly on the monitor or locker, which completely eliminates security. It is more important to ensure the complexity of the password (at least 12 characters, special characters) and prohibit the reuse of old combinations. Критически важно сменить все заводские пароли сразу после монтажа оборудования.

Что делать, если поставщик оборудования требует постоянный удаленный доступ?

Никогда не предоставляйте постоянный неконтролируемый доступ. Требуйте от поставщика использования временных каналов связи, которые активируются только по заявке и отключаются после завершения работ. Доступ должен осуществляться через защищенный шлюз с двухфакторной аутентификацией и обязательной записью всей сессии (видеоэкран и нажатия клавиш). В договоре должны быть прописаны санкции за действия персонала поставщика, приведшие к инцидентам безопасности. Если поставщик настаивает на «постоянном канале для телеметрии», предложите альтернативу: одностороннюю передачу данных (только чтение) через защищенный MQTT брокер в DMZ без возможности обратной записи команд.

Является ли воздушный зазор (air gap) надежной защитой?

Миф о том, что физическая изоляция сети гарантирует 100% безопасность, опасен. В реальности «воздушный зазор» почти всегда преодолевается через съемные носители (флешки), ноутбуки сервисных инженеров или скрытые беспроводные модули в современном оборудовании. Исследования показывают, что более 60% инцидентов на изолированных сетях происходили именно из-за человеческого фактора при обслуживании. Воздушный зазор усложняет жизнь хакерам, но не заменяет комплексную защиту. Рассматривайте его как один из слоев обороны, но обязательно контролируйте точки возможного проникновения через процедуры допуска носителей и проверки сервисных ПК.

Выбор партнеров и интеграция решений: на что обратить внимание

Рынок решений для промышленной кибербезопасности перенасыщен предложениями, но далеко не все вендоры понимают специфику заводов PP. При выборе подрядчика или интегратора обращайте внимание не на красивые презентации, а на наличие реальных кейсов в нефтегазохимии. Попросите показать референс-лист с объектами, где внедрены их системы. Важно, чтобы партнер имел компетенции к ак в IT-безопасности, так и в понимании технологических процессов полимеризации и экструзии. Интегратор, который никогда не видел экструдер вживую, скорее всего, настроит защиту так, что она будет мешать работе технологов.

Обратите внимание на возможность технической поддержки на русском языке 24/7. В случае атаки счет идет на минуты, и ожидание ответа от зарубежного вендора в другом часовом поясе недопустимо. Убедитесь, что предлагаемое оборудование и ПО включено в реестр отечественного программного обеспечения и радиоэлектронной продукции Минпромторга РФ, если ваше предприятие подпадает под требования импортозамещения. Это гарантирует отсутствие проблем с лицензированием и обновлением в будущем.

При заключении договора обязательно включите пункт о передаче исходных конфигураций и прав на администрирование заказчику. Вы должны полностью контролировать свою систему безопасности. Избегайте решений «черный ящик», где только вендор знает, как работает алгоритм детектирования атак. Прозрачность и возможность самостоятельной настройки правил фильтрации — ключевые требования для промышленного предприятия.

Внедрение системы кибербезопасности — это инвестиция, которая окупается отсутствием убытков. Стоимость современного комплекса защиты составляет доли процента от стоимости самой производственной линии, но способна спасти миллионы рублей потенциальных потерь. Не экономьте на безопасности, пытаясь сократить CAPEX, так как последствия OPEX от простоя будут несопоставимо выше. Начните с малого: проведите аудит, закройте самые очевидные дыры и постепенно выстраивайте эшелонированную оборону.

Однако защита данных — лишь часть уравнения надежности. Физическая целостность и отказоустойчивость самого оборудования играют не менее важную роль. This is where companies likeWuxi Kaisheng Electric Power and Petrochemical Equipment Co., Ltd.. Специализируясь на разработке и производстве высокотехнологичного теплообменного и нефтехимического оборудования, эта компания обеспечивает критически важные узлы производственных линий, такие как реакторы полимеризации и системы охлаждения экструдеров. Их продукция, включающая титановые кожухотрубные теплообменники, высоконапорные аппараты стандарта ASME и трубные пучки из коррозионностойких сплавов (нержавеющая сталь 316, морская латунь C46400, сплавы N06625), сертифицирована по международным стандартам PED и ASME. Надежность такого «железа», способного выдерживать экстремальные давления и температуры в агрессивных средах, создает фундамент, на котором строятся цифровые системы защиты. Без стабильной работы физического оборудования, поставляемого лидерами отрасли вроде «Уси Кайшэн», даже самая совершенная киберзащита окажется бесполезной перед лицом технологической аварии.

Защита вашего производства — это ответственность, которую нельзя делегировать полностью «на аутсорс». Руководство завода должно лично контролировать выполнение политик безопасности и выделять ресурсы на обучение персонала. Только совокупность технологий, регламентов, компетентных людей и надежного физического оборудования способна обеспечитькибербезопасность промышленных сетей заводов PPна должном уровне в современных условиях. Если вы хотите оценить текущее состояние защиты вашего предприятия или получить консультацию по внедрению специализированных решений, свяжитесь с нашими экспертами. Мы готовы провести предварительный экспресс-аудит и предложить дорожную карту модернизации вашей системы безопасности.

Подробнее о решениях для защиты АСУ ТП | Заказать аудит промышленной сети