Production data leakage prevention: How to define the network boundary for workshop internet access

Workshop director Li has been facing a tough problem recently. Quality inspection workstations need to upload test results back to the system, while workers want to browse the internet on their phones in the rest area. However, process parameters and drawings for the production line are the core assets of the whole factory and must never flow out of the network freely. Without clear boundaries defining where each network cable extends, production data may leak through unnoticed loopholes.

Internet access in workshops is a practical requirement, but keeping production data within the internal network is a non-negotiable bottom line. The location and configuration of boundaries determine whether security protection is effective or just superficial.

1. Clarify what each network segment is for before enabling workshop connectivity

There are two types of terminals in the workshop with completely different requirements:

• Production terminals: PLCs, industrial PCs and quality inspection systems, which should only connect to the internal production network for process and control traffic.
• User internet terminals: Workers’ mobile phones, rest-area Wi‑Fi and visitor devices, which only access the internet and have no connection to production lines.

Mixing them on one single network brings huge risks. Malware carried by internet traffic may compromise production terminals, and data can leak through the same egress. Users may also copy drawings by plugging USB drives or connecting private networks to workshop computers.

These two categories of terminals must be deployed on separate networks. Many workshop security incidents do not stem from insufficient boundary hardware, but from the failure to separate production lines and staff internet access at the design stage. Retrofitting afterwards is highly disruptive.

Another easily overlooked point: production data leakage is not always caused by hackers. Drawings sent via WeChat, private cloud disks, or process photos posted on social platforms by staff are all examples of accidental leakage. Clear boundaries not only block external malware, but also set a clear rule for internal staff that production data must stay inside the secure domain.

2. Isolate the production network from office, guest and internet networks

AINOPOL’s integrated connectivity-security solution natively combines the all-optical foundation, audio & video engine and security protection. Network segmentation is built into the workshop design from the start:

• Independent VLAN for production: Segregated from office and guest networks at Layer 2 to split broadcast domains. Production IP segments are not accessible to office networks or the public internet.
• Multi-service support over one fiber infrastructure: Data, voice, surveillance, IoT and Wi‑Fi share the same fiber cabling. Segmentation is enforced by policies, eliminating the need for separate wiring for the production network.
• PON + industrial Wi‑Fi 6 dual band: Fiber reaches directly to the workshop floor. It delivers low latency, minimal packet loss and fast roaming for AGV scheduling. Production traffic is assigned the highest priority to guarantee stable production line collaboration.

The underlying two-layer flat PON architecture enables fiber connections to workshop endpoints, reduces the need for air-conditioned equipment rooms and cuts cabling workload significantly. It supports smooth evolution to 50G/200G PON. This is especially suitable for legacy workshop upgrades. There is no need for new trenching and rewiring; fiber can run directly to machines, and production downtime can be minimized.

3. Prevent data exfiltration: Permission control, audit and encryption

Isolation blocks external intrusions, while data governance prevents data from being copied and taken away:

• File permission control: Process parameters and drawings are accessible only according to job roles, and unauthorized access is rejected.
• Activity audit: All access, download and outbound transfer actions are fully logged, with clear records of user, timestamp, terminal and file information.
• Transmission encryption: Production data is encrypted end-to-end inside the LAN. Industrial protocols are allowed via whitelists, and industrial IDS monitors abnormal behaviour.

The Dream Gateway has built-in IPS, WAF and antivirus modules to block abnormal outbound connections at the boundary. Combined with industrial protocol whitelisting, unknown protocols are blocked from entering the control network, preventing non-production traffic from contaminating production systems.

4. Route legitimate outbound services through controlled channels

The production network is not entirely cut off from external connectivity. Necessary outbound scenarios such as ERP reporting, remote maintenance and cloud quality inspection go through dedicated controlled tunnels:

• Only required ports and destination addresses are opened; all other outbound traffic is denied by default.
• Outbound traffic is validated and audited by firewall policies, and abnormal behaviour is blocked immediately.
• Remote maintenance uses VPN plus two-factor authentication, and management ports are never exposed to the public internet.

Multiple factory sites are managed centrally from headquarters. Policies for production and office networks are unified, and the full topology is visualized. Administrators can check permitted and blocked traffic paths clearly, and locate and resolve faults remotely to reduce on-site visits and ease operational pressure.

The workshop network boundary is not about completely cutting off internet access. It is about defining who can connect to which resources and where data is allowed to flow. Three core measures — production network isolation, data permission audit and encryption, and controlled outbound channels for approved services — keep production data safely within the factory.

FAQ

Q: Can the rest-area Wi‑Fi for workers access the production network?
A: No. Rest-area Wi‑Fi belongs to the guest/staff internet VLAN and is logically isolated from the production network. They cannot discover each other by default. Workers browsing the internet use the public internet egress and cannot reach production line systems.

Q: How to confirm the scope of legitimate outbound business?
A: The production team sorts out systems that genuinely require external connectivity, such as ERP reporting and online quality inspection. The gateway opens only the minimum required ports and addresses based on the least privilege principle. The scope is documented in security policies and reviewed periodically.

Q: Do AGVs and barcode scanners in workshops also need isolation?
A: Industrial terminals related to production are placed on the production network, with highest priority and low-latency guarantees. Mobile phones and visitor devices used by staff run on the independent internet segment. The two are strictly isolated and cannot cross boundaries.