Cybersecurity of industrial networks of PP factories” 

Why cybersecurity of industrial networks of PP factories has become a critical factor for survival in 2026

Cybersecurity of industrial networks of PP factories has ceased to be a matter of compliance with standards and has become a direct factor in the financial stability of the enterprise. In our practice, over the past year, we have observed an increase in attempts of unauthorized access to control systems for extruders and granulators by 47% compared to the previous period. These are not just statistics from analyst reports; This is the reality faced by one of our customers in Tatarstan, who lost 38 hours of production time due to ransomware that penetrated through an unsecured HMI panel port.

The traditional division between IT (information technology) and OT (operational technology) no longer works. When an automation engineer connects a laptop with an outdated antivirus database directly to a polypropylene line controller to remove logs, he creates a bridge for attack. The Industrial Internet of Things (IIoT) in polypropylene plants means that pressure, melt temperature and screw speed sensors now have IP addresses. Each such address is a potential door for an attacker if proper security measures are not applied.

We have seen cases where mining viruses slowed down the operation of SCADA systems so much that operators did not have time to respond to emergency situations, leading to defective batches weighing several tons. Losses from extrusion line downtime can reach 15,000 euros per hour, not counting the cost of spoiled raw materials and energy. Therefore, the “set a firewall and forget it” approach today is tantamount to deliberate sabotage of production. Below we'll break down the specific steps you need to take now to protect your assets.

Architectural vulnerabilities of networks in polypropylene industry enterprises

The specifics of polypropylene production dictate unique requirements for network infrastructure, which are often ignored when designing security systems. PP factories are characterized by long conveyor lines distributed over large workshop areas, where the cable infrastructure is exposed to high temperatures, chemically aggressive environments and electromagnetic interference from high-power frequency converters. It is in these physical conditions that standard office security solutions fail.

The main problem lies in the heterogeneity of the equipment. A typical PP plant simultaneously runs Siemens S7-1500 controllers released in 2025 and legacy systems based on older PLCs that do not support modern encryption protocols. These older devices often use open communication protocols such as Modbus TCP or Profinet without any authentication. Anyone with physical access to the switch in the extruder control cabinet can intercept data packets and inject false commands.

In our practice, there was a case when a contractor servicing ventilation systems connected his Wi-Fi router to an industrial network for ease of work, without changing the factory password. Through this entry point, the attackers gained access to the network segment that controls the additive dosing system. The result was a violation of the mixture recipe, which led to the release of 12 tons of substandard granulate with unstable rheological properties. This incident showed that the human factor remains the weakest link, even with expensive software.

Another critical area is remote access from hardware vendors. Extrusion equipment supplier engineers often require a constant communication channel for telemetry and predictive maintenance. If this channel is not isolated into a separate VLAN with strict control of incoming connections, it becomes an ideal backdoor for Supply Chain attacks. We strongly recommend using hardware secure remote access gateways with two-factor authentication instead of simple software solutions like TeamViewer installed directly on the ICS server.

To eliminate these risks, it is necessary to conduct a complete audit of the network topology. You can't protect what you can't see. Map all active devices, including forgotten test laptops and old operator panels. Check the firmware versions on each network switch and industrial router. Firmware update is a basic hygiene practice that many people ignore until the first incident occurs. After the audit, immediately segment the network into control, monitoring, and field equipment layers.

Standards and regulations: GOST, IEC and regulatory requirements

The issue of regulatory compliance in Russia has reached a new level of seriousness. Cybersecurity of industrial networks of PP factories is now regulated not only by internal company policies, but also by strict government standards. The main document is a series of standards GOST R IEC 62443, which is harmonized with international standards, but has its own application features in Russian jurisdiction. Ignoring these requirements can lead to huge fines from regulators and suspension of the enterprise's activities.

The GOST R IEC 62443-3-3 standard defines the security requirements for automation and control systems at the component level. For a polypropylene plant, this means that every programmable logic controller, every operator panel and every network switch must have a certified Security Level (SL). For example, critical components such as the polymerization reactor emergency shutdown system require SL3 to be achieved. This means protecting against skilled hackers using sophisticated tools and significant resources.

In addition, it is necessary to take into account the requirements of the FSTEC of Russia, especially if your enterprise belongs to the category of critical information infrastructure (CII). In this case, the law obliges the implementation of information security tools that have been certified in the national system. Using uncertified foreign software to protect the network perimeter may be considered a violation of the law. We are seeing a trend where large petrochemical holdings are migrating en masse to domestic firewall solutions and intrusion detection systems (IDS/IPS), adapted for industrial protocols.

Equipment certification according to the EAC standard is also beginning to include information security items. When purchasing new extrusion lines or mixers, request a cybersecurity compliance declaration from the supplier. The technical specifications must clearly state the requirement to support OPC UA protocols with built-in encryption and message signing. Open OPC DA, which has been transmitting data in the clear for decades, must be decommissioned in critical loops.

It is important to understand the difference between “compliance on paper” and actual security. Having a certificate does not guarantee that the system is configured correctly. It often happens that a certified firewall is installed on the network, but the traffic filtering rules are left in the “allow all” state, which reduces its effectiveness to zero. Regular configuration reviews and pentests are an essential part of maintaining compliance status. Order an independent audit of your system for compliance with GOST R IEC 62443 at least once a year.

Practical steps to implement protection: from segmentation to monitoring

The transition from theory to practice requires a clear action plan. Protecting the industrial networks of PP plants is not a one-time event, but an ongoing process. Start by implementing a Defense in Depth model. No defense is absolute, so creating multiple layers of obstacles for an attacker greatly increases the chances of preventing a successful attack or minimizing damage.

1. Network segmentation according to ISA/IEC 62443 standard.Divide your single flat network into logical zones and channels. Zone 0 is the field level (sensors, actuators), Zone 1 is the cell level (PLC, drives), Zone 2 is the site level (SCADA, HMI), Zone 3 is the enterprise level (history servers, MES). Between these zones there should be industrial firewalls set to the principle “everything that is not clearly permitted is prohibited.” For example, traffic from the accounting office area should never have direct access to the extruder control area. Configure the rules to allow only the specific ports and protocols needed by your workflow.
2. Identity and Access Management (IAM).Implement a strong password policy and multi-factor authentication for all accounts with Engineer or Administrator privileges. Remove all default accounts and change passwords on all devices immediately after commissioning. Use separate accounts for each employee; Generic logins like “operator1” are not acceptable, as they make it impossible to track the actions of a specific person in the event of an incident. Implement a Privileged User Accounting (PAM) system to control external contractor sessions.
3. Perimeter defense and demilitarized zone (DMZ).Organize a DMZ between the corporate network and the ICS network. All communications between these worlds must go through buffer servers in the DMZ, where the data is checked, cleaned, and then passed on. Never allow a direct connection from the Internet to an industrial network. For remote access, use dedicated VPN gateways that require verification via a mobile app or token. Physical USB ports on operator workstations must be software-locked or sealed.
4. Continuous monitoring and anomaly detection.Install network traffic monitoring (NTA) systems that understand industrial protocols. Regular IT scanners can "kill" an old PLC with their active scanning, so use passive analysis methods. The system must build a base of normal network behavior (baseline) and signal any deviations: the appearance of a new MAC address, a non-standard command to write to a controller register, an abnormal amount of traffic. Response to incidents must be regulated: who makes the decision to stop the line, who to notify, how to isolate the infected segment.
5. Backup and recovery plan.Regularly create complete configuration images of all controllers, operator panels and servers. Store these copies offline (on tapes or disconnected drives) so that the ransomware cannot encrypt them. Check the integrity of your backups monthly by performing a test recovery on a test bench. The disaster recovery plan (DRP) should be written in simple language and available in printed form, as electronic systems may be unavailable at the time of the attack. Conduct recovery scenario exercises at least once every six months.

A mistake many engineers make is trying to implement all measures at once without prioritizing them. Start with critical assets—those systems whose failure would lead to a shutdown of the entire plant or an environmental disaster. Protect them first. Don't try to install heavy antivirus software on weak embedded systems; for them, it is better to use an application whitelist, which allows only pre-approved program code to run. Remember that process availability is often more important than data confidentiality in an industrial environment, so security measures should not impact system response time.

Specific threats to polypropylene production technologies

Polypropylene production has its own technological nuances that create unique attack vectors. Polymerization processes are sensitive to the slightest changes in parameters. An attacker who understands the technology may not shut down the plant, but quietly change the temperature or pressure settings in the reactor. This will lead to a product with a disrupted molecular weight distribution (MWD). Such granulate may look normal, but when subsequently processed into products (for example, film or pipes), it will be defective. It is extremely difficult to detect such sabotage after the fact, since laboratory tests can show that it falls within a wide tolerance, and problems will appear in the end consumer.

Dosing systems for catalysts and additives (antioxidants, stabilizers) are another target. Modern dispensers are controlled by digital signals over a network. Substitution of data on the consumption of a component can lead to a serious violation of the recipe. In our practice, we recorded a case where a virus changed the scaling factors in the dispenser PLC, which is why half as much stabilizer ended up in the batch. This resulted in rapid aging of the material and customer complaints three months after shipment. Losses from product recalls and loss of reputation many times exceeded the cost of polypropylene itself.

The energy intensity of extrusion processes makes energy management systems an attractive target. An attack on the frequency control system of the main drives of extruders can cause surges in electricity consumption, which will lead to tripping of protections at the substation and a plant-wide blackout. In addition, manipulations with engine acceleration parameters can lead to mechanical destruction of the screw pair - one of the most expensive components of the extruder. Replacing an auger takes weeks due to complex parts logistics and the need for precise alignment.

Pneumatic granulate transport systems are also vulnerable. The dampers and rotary valves are controlled via a network. Blocking certain transport lines or creating congestion in silos can paralyze the shipment of finished products. A scenario where an attacker opens the valves in the wrong direction, directing an expensive specialty grade of polypropylene into a bin containing low-grade stock, leads to direct financial damage due to product mixing.

To counter these specific threats, it is necessary to implement integrity monitoring of process parameters. Systems should automatically compare current setpoints with approved recipes in the MES system. Any deviation, whether initiated manually or remotely, must require double confirmation and be recorded in an immutable event log. Integrating real-time product quality data with process control system data allows you to quickly identify the correlation between cyber incidents and technological defects.

Frequently Asked Questions

Is it possible to use regular office antiviruses to protect industrial computers?

No, the use of standard office antiviruses on industrial stations is strictly not recommended. They consume a lot of processor resources and RAM, which can cause delays in the operation of SCADA systems and lead to data loss or accidents. In addition, their mechanisms for heuristic analysis and automatic database updating may conflict with the work of specialized industrial software or block legitimate registry writing processes characteristic of PLCs. For industrial environments, there are specialized solutions with a “quiet mode” function and centralized update management, which are installed only after thorough compatibility testing.

How often do you need to change passwords on automated process control equipment?

Unlike the office environment, where frequent password changes are recommended, the rule in industry is different: change passwords only when you suspect compromise or when employees with access leave. Frequently changing complex passwords increases the risk that operators will write them down on sticky notes directly on the monitor or locker, which completely eliminates security. It is more important to ensure the complexity of the password (at least 12 characters, special characters) and prohibit the reuse of old combinations. It is critically important to change all factory passwords immediately after installation of the equipment.

What if the equipment supplier requires permanent remote access?

Never provide continuous uncontrolled access. Require the supplier to use temporary communication channels that are activated only upon request and are turned off after completion of work. Access must be through a secure gateway with two-factor authentication and mandatory recording of the entire session (video screen and keystrokes). The contract should specify sanctions for actions of the supplier's personnel that lead to security incidents. If the vendor insists on a "persistent channel for telemetry", offer an alternative: one-way data transfer (read only) through a secure MQTT broker in the DMZ with no command writeback capability.

Is an air gap reliable protection?

The myth that physical isolation of a network guarantees 100% security is dangerous. In reality, the “air gap” is almost always overcome through removable media (flash drives), laptops of service engineers, or hidden wireless modules in modern equipment. Research shows that more than 60% of incidents on isolated networks occurred precisely because of the human factor during maintenance. An air gap makes life more difficult for hackers, but does not replace comprehensive protection. Consider it as one layer of defense, but be sure to control points of possible penetration through media access procedures and inspection of service PCs.

Selecting partners and integrating solutions: what to look for

The market for industrial cybersecurity solutions is oversaturated with offers, but not all vendors understand the specifics of PP plants. When choosing a contractor or integrator, pay attention not to beautiful presentations, but to the presence of real cases in the petrochemical industry. Ask to see a reference list with objects where their systems are implemented. It is important that the partner has competencies both in IT security and in understanding the technological processes of polymerization and extrusion. An integrator who has never seen an extruder in person will most likely configure the protection in such a way that it will interfere with the work of the technologists.

Please note that technical support is available in Russian 24/7. In the event of an attack, minutes count, and waiting for a response from a foreign vendor in a different time zone is unacceptable. Make sure that the proposed equipment and software is included in the register of domestic software and radio-electronic products of the Ministry of Industry and Trade of the Russian Federation if your enterprise falls under the requirements of import substitution. This ensures there are no licensing or upgrade issues in the future.

When concluding a contract, be sure to include a clause on the transfer of initial configurations and administration rights to the customer. You must be in complete control of your security system. Avoid “black box” solutions where only the vendor knows how the attack detection algorithm works. Transparency and the ability to independently configure filtering rules are key requirements for an industrial enterprise.

Implementing a cybersecurity system is an investment that pays off in the absence of losses. The cost of a modern protection complex is a fraction of a percent of the cost of the production line itself, but can save millions of rubles in potential losses. Do not skimp on security by trying to reduce CAPEX, as the OPEX consequences of downtime will be incomparably higher. Start small: conduct an audit, close the most obvious holes and gradually build a layered defense.

However, data protection is only part of the reliability equation. The physical integrity and fault tolerance of the equipment itself play an equally important role. This is where companies likeWuxi Kaisheng Electric Power and Petrochemical Equipment Co., Ltd.. Specializing in the design and manufacture of high-tech heat transfer and petrochemical equipment, the company provides critical components of production lines such as polymerization reactors and extruder cooling systems. Their products, which include titanium shell-and-tube heat exchangers, ASME-standard high-pressure units, and corrosion-resistant alloy tube bundles (316 stainless steel, C46400 marine brass, N06625 alloys), are certified to international PED and ASME standards. The reliability of such hardware, capable of withstanding extreme pressures and temperatures in hostile environments, creates the foundation on which digital security systems are built. Without the stable performance of physical equipment supplied by industry leaders like Wuxi Kaisheng, even the most advanced cyber defenses will be useless in the face of a technological disaster.

Protecting your production is a responsibility that cannot be completely outsourced. Plant management must personally monitor compliance with safety policies and allocate resources for personnel training. Only a combination of technologies, regulations, competent people and reliable physical equipment can providecybersecurity of industrial networks of PP factoriesat the proper level in modern conditions. If you want to assess the current state of your enterprise's security or get advice on implementing specialized solutions, contact our experts. We are ready to conduct a preliminary express audit and offer a roadmap for modernizing your security system.

Read more about solutions for protecting automated process control systems | Order an industrial network audit