OT Cybersecurity in Manufacturing: IEC 62443 Implementation for Industrial Plants in Lima and Callao

The most ignored attack vector in Peruvian manufacturing

Three Lima manufacturing plants suffered cybersecurity incidents in 2024-2025 that disrupted production. None were sophisticated targeted attacks — all three started with a trivial vector: an external maintenance technician connecting a malware-infected laptop to the PLC network to download a ladder program, or an operator inserting a personal USB drive into a production line HMI.

The problem is not attacker sophistication — it's the absence of basic controls in the OT layer that the IT layer has had as standard for 20 years.

IEC 62443: the OT cybersecurity standard

IEC 62443 (formerly ISA-99) is the international cybersecurity standard for industrial automation and control systems (IACS). Unlike ISO 27001 (designed for IT), IEC 62443 was created for the OT context: systems that cannot be patched or restarted in production, where availability takes precedence over confidentiality, and where lifecycles are 15-25 years.

The standard defines four Security Levels (SL 1-4). For most Peruvian manufacturing plants, the realistic target is SL 2 — protection against deliberate attackers with limited resources (generic malware, internal phishing) — covering 95% of real incidents in the sector.

Purdue model segmentation architecture

Level 1 (PLCs/DCS): The most problematic legacy equipment — PLCs from 2000-2015 running Windows XP Embedded that cannot be patched. The security measure is isolation, not patching: an industrial firewall (Tofino Xenon, Hirschmann EAGLE) between the PLC switch and the rest of the network, allowing only OPC-UA traffic from the SCADA server IP on port 4840. Install-without-stopping-the-line because the firewall is transparent to OT protocols.

Level 2 (SCADA/HMI): The SCADA must not be directly accessible from the corporate network. Data flow should be unidirectional: SCADA publishes data to an OT DMZ server (OSIsoft PI or equivalent); MES and ERP consume from the DMZ — never a direct connection to SCADA. If MES is compromised, the attacker reaches read-only data, not SCADA command capability.

Level 3+ (MES, ERP): Standard IT controls apply — patching, antivirus, AD identity management — separated from levels 0-2 by a perimeter firewall with default-deny policy.

Controls for 24/7 plants

USB media control: A USB decontamination kiosk (Honeywell Secure Media Exchange, Opswat MetaDefender) scans any removable media before it touches OT equipment — 2-3 minutes, no production equipment involved. The most common infection vector in Peruvian OT, eliminated without stopping the line.

Secure remote access for vendors: OT-dedicated VPN with access only to specific authorized equipment within a defined time window, full session recording (screen video + command log stored 12 months), and MFA for external vendors.

Passive OT intrusion detection: Industrial NDR systems (Claroty, Dragos, Nozomi, or open-source Zeek + OT rules) capture traffic from the switch mirror port without injecting packets — zero interference with control traffic. They establish a baseline of normal OT communications and alert on deviations: a PLC making DNS queries (malware seeking C2), an uninventoried device connecting to the switch, or a PLC program change outside a maintenance window.

8-12 week implementation plan without production downtime

Weeks 1-2: Passive NDR sensor installation builds device inventory and communication map. Weeks 3-4: Industrial firewalls installed in passive (log-only) mode to validate rules before activating blocking. Weeks 5-8: USB controls and OT VPN for vendors. Weeks 9-12: Incident response playbook and team training.

Investment for a mid-scale plant (50-150 PLCs/HMIs): USD 35,000-65,000 including hardware, licenses, and professional services.

EMAR SYSTEMS has IEC 62443-certified engineers (ISA/IEC 62443 Cybersecurity Certificate Program) with experience in food, pharmaceutical, and consumer goods manufacturing plants in Lima and Callao.