The identity shape of a manufacturer
Manufacturing didn’t grow up around a clean directory. It grew up around production, and identity was added later, unevenly:
- The core systems are old. The ERP, the MES, the quality and maintenance systems often authenticate against Active Directory over plain LDAP, and can’t be modified without a vendor project. They’re also the systems that run the business.
- The network is often flatter than the architecture diagram suggests. Office IT and the systems near the plant floor frequently share more than the design intended. Once someone is on the network, a lot answers.
- Outsiders need in, constantly. Machine builders, systems integrators, maintenance contractors and software vendors all need access to specific systems — and they’re granted a VPN account, because that’s what’s to hand.
- Shared and service accounts are everywhere. Operator accounts on shift, a local administrator on every engineering station, and service accounts created for each integration that were never touched again.
The systems that would stop production if they failed are often the ones protected by credentials nobody wants to touch.
Where the exposure concentrates
The pattern that turns up in manufacturing incidents is rarely a clever exploit. It’s ordinary access, used by the wrong person:
The supplier’s engineer whose credentials were phished — and who has remote access to your plant, and fifty others. The integrator’s VPN account, issued for a commissioning that finished two years ago, still live and still reaching the network. The service account for a line-monitoring tool, reading the directory, with a password in a configuration file on a machine near the floor. None of these needs malware to become an incident.
The attacker does not need to exploit the machine if they can authenticate as someone who is already trusted.
What the regulations ask for
Mirket doesn’t make you compliant — no product does. Below is what each framework expects of identity in an industrial setting.
| Framework | The identity requirement |
|---|---|
| NIS2 | Certain manufacturing sectors, including medical devices, electronics, machinery and transport equipment, can fall within scope. MFA, access control, privileged-access controls and incident detection support the identity-security requirements covered organisations need to implement |
| IEC 62443 | Identification, authentication, use control and least privilege for people and accounts reaching industrial automation and control environments |
| ISO/IEC 27001:2022 | Access control, authentication and privileged-access management as part of the information security management system |
Mirket secures the identity and access layer around industrial systems — the users, accounts, remote sessions and directory access — rather than the industrial protocols themselves.
Where to start
1. Vendors and integrators
Replace broad VPN access with controlled access to the specific systems a vendor needs. Require authentication on every connection, record the session, and let access expire with the maintenance window.
Third-Party & Vendor Access · Just-in-Time Access · Privileged Access Management
2. Legacy ERP and MES
Modern authentication without modernising the application. ERP and MES platforms that cannot support modern federation can still gain MFA. If the application authenticates through LDAP or LDAPS, Mirket enforces Push MFA in the authentication path without changing the application.
This is the part worth testing first, because it addresses the systems that are otherwise stuck: the ones no vendor will re-engineer and no one will take offline. MFA for legacy applications covers the four routes in full.
3. Engineering workstations
Protect Windows logon, RDP and privilege elevation on engineering workstations with MFA or supported passwordless authentication — so the machines that hold the design files and the programming software are not reached with a password alone.
Operating System Logon MFA · Passwordless Authentication
4. Privileged administration
Use Mirket PAM for administrative access to servers, infrastructure and management interfaces. Inject credentials so administrators never hold them, control the session, and keep a searchable recording of privileged work.
Privileged Access Management · RDP & SSH Session Recording
5. Service accounts
Discover and secure the non-human identities used by integrations. Scope where they can authenticate, rotate credentials, and reduce the value of a stolen service-account password.
LDAP Service Account Security · Service Account Password Rotation
Built for systems that stay on-premise
Manufacturing does not need to move critical systems to the cloud to modernise authentication. Mirket runs on-premise, keeping privileged sessions, credentials and directory traffic inside the environment.
What changes
| Today | With Mirket |
|---|---|
| Vendors receive broad VPN access | Vendors reach only the systems they need through controlled, recorded sessions |
| Legacy ERP and MES rely on password-only LDAP authentication | Push MFA is added in the LDAP authentication path without changing the application |
| Engineering workstations rely on password-only logon | Windows logon, RDP and privilege elevation can require MFA |
| Vendor access survives beyond the maintenance window | Access can be approved for a defined period and expire automatically |
| Privileged administration leaves only connection logs | Sessions are controlled and recorded |
| Integration credentials remain static for years | Service accounts are discovered, scoped and rotated |
Related
Solutions — Third-Party & Vendor Access · MFA for Legacy Applications · Just-in-Time Access · Operating System Logon MFA · LDAP Service Account Security
Products — Privileged Access Management · NHI LDAP Proxy · Multi-Factor Authentication