Network segmentation, the unidirectional-flow instinct, and safe data extraction.
3 questions in Manufacturing & Industrial IoT.
Establish reachability before severity, then remove or narrow the paths that lead to the affected asset rather than trying to fix the asset. Patch the systems around it that can be patched, and record a risk acceptance with an owner and an expiry date instead of a permanent silence.
Segment the network into zones, put a broker or historian replica in a DMZ between plant and enterprise, and have the plant side initiate every connection outbound so no firewall rule ever permits traffic into the control zone. Nothing in the cloud reaches a controller.
Plants accumulate business-system dependencies nobody deliberately chose: a label printed from ERP, a recipe fetched over a link, an authentication call, a licence check. You find them by asking of each system what stops if it disappears, then give every answer a written degraded mode and rehearse it.