Identify plant network zones
Separate administration PCs, engineering workstations, file servers, legacy systems and other operationally important resources according to their communication requirements.
How it works in Manufacturing
Enforce traffic policies
NexusShield applies firewall rules between zones and inspects traffic crossing those boundaries.
Limit unauthorised movement
A compromised office PC can reach only the destinations and services permitted by policy, rather than having unrestricted access to engineering systems and plant servers.
Why it matters
Benefits for manufacturers
Reduce lateral movement
Limit the routes an attacker can use to move from an office workstation to other plant systems.
Protect legacy infrastructure
Apply network-level controls to servers, printers and headless devices that cannot support endpoint agents.
Help protect engineering IP
Restrict access to CAD workstations, drawing servers and sensitive product-design resources.
Choose a deployment model
Deploy NexusShield as an appliance, virtual appliance, in a chosen cloud environment or as firewall as a service, subject to the supported deployment options.
Use cases
Three plant exposure problems. One segmentation model.
01
Phished PC in the Administration Block
Scenario
A purchasing executive opens a malicious attachment on a shared office PC. The workstation is connected to the same broad network as engineering systems and plant servers.
What the solution does
NexusShield applies firewall policies between the administration zone and engineering or server zones. Only explicitly permitted traffic can cross those boundaries, with intrusion prevention inspecting traffic as configured.
Outcome
The affected PC has fewer paths to plant systems, helping limit the potential impact of a compromise.
02
Protecting Legacy Servers That Cannot Run an Agent
Scenario
A plant relies on an older server for stores and dispatch records, along with networked printers in the quality lab. These devices cannot run endpoint agents, and some cannot be readily updated.
What the solution does
Place the legacy systems and printers in a NexusShield-protected zone and allow only required traffic from approved sources.
Outcome
The plant can apply network-level controls without modifying the protected devices, reducing unnecessary access from office workstations.
03
Protecting Engineering Designs and Intellectual Property
Scenario
CAD workstations and a drawing server store proprietary product designs on a network that also supports HR, finance and general office PCs.
What the solution does
Place engineering workstations and the drawing server in a dedicated zone, with defined access policies and application control for traffic entering that zone.
Outcome
Product designs are accessible through approved paths rather than being broadly exposed to the general office network.
Keep Exploring
Go Deeper
See how Next Generation firewall works
Inspect and control traffic across branches and data centres, blocking threats before they reach critical banking systems, with NexusShield NGFW.
Read the full solution →Energy Utilities
See how COSGrid provides solutions for Energy Utilities
Let’s see how COSGrid keeps remote branches and sites securely connected, with web filtering that protects critical infrastructure.
Explore the Industry →The Next Solution
See how Next Generation firewall works
Inspect and control traffic across branches and data centres, blocking threats before they reach critical banking systems, with NexusShield NGFW.
Read the full solution →How it works in Manufacturing
Identify suspicious activity
A workstation in the stores or dispatch office begins making unusual connections to file shares and other plant systems.
Apply network restrictions
NexusShield restricts the affected device’s traffic, or the traffic of its zone, according to the available enforcement workflow.
Contain while investigating
The affected device remains restricted while IT investigates, while other plant zones continue operating under their normal policies.
Why it matters
Benefits for manufacturers
Restrict affected devices centrally
Apply network-level controls without relying solely on someone finding the correct switch port at the site.
Contain devices without endpoint agents
Restrict legacy servers and other devices through firewall policies.
Reduce incident spread
Limit access from an affected workstation or zone while investigation takes place.
Support distributed plants
Enable central IT teams to apply restrictions at sites where local IT staff may not be available.
Use cases
Three incident response problems. One network-level containment model.
01
Suspicious Activity on a Stores PC
Scenario
A PC in the stores and dispatch office begins connecting to file shares across the manufacturing site in an unusual pattern.
What the solution does
NexusShield restricts traffic to and from the affected device at the network boundary, based on the configured enforcement policy.
Outcome
The workstation is restricted from reaching other plant systems beyond the paths that remain explicitly permitted while the incident is investigated.
02
A Security Alert During the Weekend
Scenario
A workstation alert is raised during the weekend at a plant where IT staff are not on site.
What the solution does
If the detection-to-firewall enforcement workflow is configured and validated, the relevant network restriction can be triggered through that workflow. Otherwise, a central operator can apply the restriction through the firewall management console.
Outcome
The affected device can be restricted without waiting for an on-site IT team to arrive.
03
Suspicious Traffic from a Legacy Server
Scenario
An older server in the plant’s server room begins generating unusual traffic but cannot run an endpoint agent.
What the solution does
NexusShield restricts traffic to and from the server, or its designated network zone, through firewall policy.
Outcome
The plant can apply network-level containment to a system that cannot be isolated through endpoint-agent controls.
Keep Exploring
Go Deeper
See how Next Generation firewall works
Inspect and control traffic across branches and data centres, blocking threats before they reach critical banking systems, with NexusShield NGFW.
Read the full solution →Energy Utilities
See how COSGrid provides solutions for Energy Utilities
Let’s see how COSGrid keeps remote branches and sites securely connected, with web filtering that protects critical infrastructure.
Explore the Industry →The Next Solution
See how Compliant Device Access Control
Check every laptop, workstation, and branch device against the bank’s security policy before it connects, using ZT-NAC.
Read the full solution →How it works in Manufacturing
Register approved devices
Plant IT registers the laptop that an OEM engineer or contractor will use during a scheduled visit.
Check device posture
ZT-NAC checks registration and configured security requirements, such as patch level, antivirus status and disk encryption, when the device connects.
Allow, deny or quarantine
Only devices that satisfy the admission policy receive the permitted access. Enforcement uses the endpoint’s host firewall, so no switch or VLAN changes are needed for agent-managed devices. Devices that cannot run the agent need separate controls, such as NexusShield segmentation.
Why it matters
Benefits for manufacturers
Control contractor access
Admit visiting OEM and contractor laptops only after registration and policy checks.
Identify non-compliant devices
Detect laptops that return to the plant with missing updates or disabled antivirus protection.
Apply consistent policies
Extend the same admission approach across multiple plants without requiring a switch or VLAN project for each agent-managed device.
Improve admission accountability
Associate admission, denial and quarantine actions with device and policy records.
Use cases
Three device admission problems. One deny-by-default policy.
01
Scheduled OEM Service Visit
Scenario
An OEM service engineer visits a manufacturing plant and needs a laptop to access the specific plant-office resources required for maintenance.
What the solution does
Plant IT pre-registers the engineer’s laptop. ZT-NAC checks the device against the configured admission and posture policies before permitting access.
Outcome
The approved laptop can connect according to policy, while an additional unregistered laptop brought to the site is denied.
02
An Unknown Laptop Connected to a Spare Port
Scenario
A contractor connects an unfamiliar laptop to an available network port in the plant’s maintenance office.
What the solution does
ZT-NAC denies the device by default because it has not been registered under the plant’s admission policy.
Outcome
The unknown laptop receives no permitted network access through the ZT-NAC controls until it is registered and satisfies the required checks.
03
A Supervisor’s Laptop Returns After Weeks Offline
Scenario
A shift supervisor returns to the plant with a laptop that has missed critical updates while away from the network.
What the solution does
ZT-NAC checks the laptop’s configured posture requirements and quarantines it through its host firewall if it fails the policy.
Outcome
The laptop remains restricted until the required remediation is completed, rather than joining the plant office network with unrestricted access.
Keep Exploring
Go Deeper
See how Compliant Device Access Control
Check every laptop, workstation, and branch device against the bank’s security policy before it connects, using ZT-NAC.
Read the full solution →Energy Utilities
See how COSGrid provides solutions for Energy Utilities
Let’s see how COSGrid keeps remote branches and sites securely connected, with web filtering that protects critical infrastructure.
Explore the Industry →The Next Solution
See how Next Generation firewall works
Inspect and control traffic across branches and data centres, blocking threats before they reach critical banking systems, with NexusShield NGFW.
Read the full solution →
