A CNC machine does exactly what its part program, tool offsets and parameters tell it to, so anyone who can change those values on the network can scrap parts, crash a spindle or ship out-of-tolerance components without tripping a single IT alert. Machine tools now sit on plant networks for program transfer, monitoring and OEM support, yet they are usually bought machine by machine, run controllers for decades and are managed by production rather than security teams. This guide covers the security of computer numerical control (CNC) machines and the systems around them: controllers and their HMI PCs, distributed numerical control (DNC) networks and file servers, the CAM-to-spindle program chain, machine monitoring interfaces such as MTConnect and OPC UA, removable media and vendor remote access. It is written for OT security engineers, manufacturing engineering leads and plant IT staff. The plant-wide programme sits in the Manufacturing Cybersecurity Programme Guide; this page goes deeper on the machine tool cell.
Key takeaways
- Protect the data, not just the box. Part programs, tool geometry and wear offsets, work offsets and machine parameters decide what gets cut; integrity of those values is the core security objective.
- Treat the DNC server as a controller. Whoever can write to the program store can change every part the cell makes, so it needs controller-grade access control, change logging and backups.
- Machine data interfaces are read paths that often allow writes. Data collection protocols, vendor APIs and network shares on controllers need allowlisted clients, authentication where the controller supports it, and segmentation.
- Verify programs end to end. A hash or checksum recorded at CAM release and checked before cutting, plus first-article inspection, catches both tampering and honest errors.
- Plan for manual and islanded running. A cell that can load verified programs from a local, known-good store can keep producing while the plant network is down.
What makes machine tools different
A modern CNC controller usually combines a real-time numerical control kernel and an embedded PLC with an operator panel that is often a Windows-based industrial PC. The real-time side moves axes; the PC side handles program editing, file transfer, network shares and vendor software. Both sides matter: the PC is the usual network entry point, and the NC data is what changes the physical output.
| Asset | What it holds or does | Why it matters for security |
|---|---|---|
| Part program (G-code and macros) | Toolpaths, feeds, speeds and parametric logic from CAM post-processing | A small edit changes geometry or hole count while the program still runs normally |
| Tool table, geometry and wear offsets | Tool length, radius and wear compensation values | An offset change moves every cut and can drive a tool into the workpiece or fixture |
| Work offsets and machine parameters | Fixture zero points, axis limits, spindle and servo settings | Changes can cause collisions, damage the machine or quietly push parts out of tolerance |
| Operator HMI PC | Operating system, file shares, vendor apps, USB ports | Ransomware and malware land here; long-lived OS versions limit patching |
| DNC or program management server | Released programs, revision history, drip-feed to machines | Single point of change for the whole cell |
| Serial-to-Ethernet converters | Bridge RS-232 controllers onto the network | Often reachable with no authentication and forgotten in inventories |
| Monitoring agents and gateways | MTConnect agents, OPC UA servers, vendor data APIs, edge devices | Expose production data and sometimes write functions to the wider network |
| Probing and inspection systems | In-process probes, CMM programs, quality data | Manipulated results let bad parts pass inspection |
Machine tools are also safety-relevant: guarding, interlocks and emergency stops are designed to be independent of the network, and security changes must never bypass them. Keep safety functions under the machine builder's validated design and treat any change near them as a safety change.
Threats to the machine tool cell
Trend Micro researchers tested four widely used controller families in 2022 and showed that network access to a controller could be used to alter tool geometry wear values so a tool crashed into the workpiece or cut 4.80 mm instead of 5.05 mm, change a parametric program to drill 25 holes instead of two, raise custom alarms that stopped production, and pull production data and program code through interfaces with no authentication. Their recommended mitigations were industrial intrusion detection, segmentation with VLANs and firewalls, patching, and configuring controllers per vendor guidance with encryption and authentication enabled where available. CISA published advisories ICSA-22-298-01 and ICSA-22-298-02 for two of the controller families after that research.
| Threat | Example in a CNC cell | MITRE ATT&CK for ICS | Primary control |
|---|---|---|---|
| Program tampering | Edited program on the DNC server or controller memory | T0889 Modify Program, T0843 Program Download | Program hashing, write-restricted program store, change logging |
| Offset and parameter manipulation | Wear offsets or work offsets changed remotely | T0836 Modify Parameter, T0831 Manipulation of Control | Restrict remote write functions, offset change logging, in-process probing |
| Intellectual property theft | Programs and CAM files copied from shares or controllers | T0845 Program Upload, T0811 Data from Information Repositories, T0882 Theft of Operational Information | Authenticated file access, segmentation, egress control |
| Ransomware on HMI PCs and DNC servers | Encrypted program store halts the cell | T0867 Lateral Tool Transfer, T0828 Loss of Productivity and Revenue | Segmentation, allowlisting, offline program backups |
| Infected removable media | USB stick used to carry programs between CAM and machine | T0847 Replication Through Removable Media | Media scanning kiosk, controlled media, network transfer instead |
| Vendor or integrator remote access misuse | Always-on modem, VPN or remote desktop on the HMI | T0822 External Remote Services, T0859 Valid Accounts | Brokered, time-bound, recorded access with MFA |
| Exposed controller or agent | Monitoring agent or controller reachable from the internet | T0883 Internet Accessible Device | Remove internet exposure, outbound-only connectors |
| Production stoppage | Spurious alarms, controller restart, deleted programs | T0816 Device Restart/Shutdown, T0827 Loss of Control | Local known-good program store, recovery runbooks |
Program integrity from CAM to spindle
The program chain usually runs CAD model, CAM toolpath, post-processor, released NC file, program management or DNC server, controller memory, then cutting and inspection. Each hand-off is a place where a file can be changed. Build integrity into the chain rather than relying on operators to spot an odd line of G-code.
- Release with a fingerprint: when a programmer releases a program, record its SHA-256 hash, revision and approver in the program management system or PLM record.
- Write-protect released programs: only the release workflow writes to the released folder; machines and operators read from it. Keep a separate controlled area for prove-out edits.
- Verify before cutting: where the DNC software or a small script can compare the file sent to the controller with the released hash, do it on every transfer; otherwise compare on a schedule and after any alert.
- Capture shop-floor edits: operators legitimately optimise feeds and fix programs at the machine. Pull edited programs back, diff them against the released version and route accepted changes through re-release, so the program store stays the source of truth.
- Back up offsets and parameters: export tool tables, work offsets and machine parameters after every planned change and on a schedule, and compare exports to catch unplanned changes.
- Close the loop with inspection: first-article inspection, in-process probing and statistical process control are also tamper detectors. A sudden shift on one machine with no planned change deserves a security look as well as a quality one.
Protect CAM workstations and post-processors as well: a modified post-processor alters every program it generates, and the hash recorded at release will faithfully fingerprint the altered output.
DNC networks, protocols and segmentation
DNC covers both classic serial drip-feeding of long programs and modern network transfer over file shares, FTP or vendor protocols. Many shops run a mix, with serial controllers bridged through serial-to-Ethernet converters and newer controllers mounting shares from the DNC server. Monitoring adds another path: MTConnect agents serve machine data over HTTP (the reference agent's examples use port 5000, with TLS optional and recommended when data crosses network boundaries), and the reference agent describes a read-only information model that never sends instructions to machines. Some agent configurations enable HTTP PUT for data ingestion, so check that setting. OPC UA servers and vendor data APIs may expose both read and write functions.
| Path | Typical exposure | Recommended placement and settings |
|---|---|---|
| File shares on HMI PCs | SMB shares writable from the plant network, sometimes without authentication | Remove where possible; otherwise restrict to the DNC server's address and a named account |
| DNC or program management server | Joined to the office domain, reachable from many subnets | Place in the manufacturing operations zone (Level 3), allow only cell subnets and the CAM release path |
| Serial-to-Ethernet converters | Web or Telnet management with default credentials | Change credentials, disable unused services, allow only the DNC server to connect |
| MTConnect agent | HTTP API reachable plant wide; PUT may be enabled | Enable TLS, restrict clients, keep PUT off unless a named ingestion source needs it |
| OPC UA server on the controller or gateway | Anonymous sessions or security mode None left on after commissioning | Require Sign and Encrypt security mode, user authentication and certificate trust lists |
| Vendor data and control APIs | Network libraries that can read and sometimes write offsets and parameters | Disable remote write where the controller allows it; allowlist the monitoring host only |
| Vendor cloud connectors | Outbound connections from the machine to the builder's service | Own zone, outbound-only to documented endpoints, reviewed in contracts |
Group machines into cells by line or product family and put each cell behind a conduit with explicit rules, following the zone and conduit model in the IEC 62443 Guide. Joint guidance from CISA, the FBI, the EPA and the Department of Energy lists the same priorities for OT in general: remove public internet connections, change default passwords, secure remote access, segment IT and OT with a DMZ, and practise manual operation.
Controller hardening and removable media
- Edit and parameter protection: most controllers offer protection levels, passwords or keyswitches for program edit, offsets and parameters. Turn them on, give setters and operators different levels, and keep machine builder levels with maintenance.
- HMI PC baseline: apply the machine builder's approved updates only, remove unused software, disable unused services and shares, and use application allowlisting where the builder supports it. Ask the builder in writing which security tools are supported before installing anything.
- USB and memory cards: prefer network transfer from the DNC server. Where media is still needed, use dedicated, labelled devices scanned at a kiosk, and disable USB storage on HMI PCs that do not need it.
- Time and logging: set controller and HMI clocks from a plant time source so program loads, alarms and edits can be correlated with network logs.
- Patching: track builder and controller vendor advisories; the ICS Advisory Triage and OT Vulnerability Management Guide covers prioritising advisories when patching needs a production window and requalification.
Where identity fits
Machine tool cells run on shared logins: a single HMI account per machine, a shared DNC service account that writes to every controller, and OEM accounts that never expire. Give programmers, setters, operators and maintenance distinct roles on the DNC server, keep the DNC service account scoped to the cell it feeds and rotate its password with the server's change process, and broker OEM access with approval, time limits and session recording. The Manufacturing Identity and OT Access Guide covers shift handover, shared HMI accounts and contractor access in detail.
Choosing controls by shop size
| Profile | Start with | Add as you mature |
|---|---|---|
| Job shop, under 20 machines, no OT team | Separate machine network from office Wi-Fi, change default credentials, nightly offline backup of programs and offsets, no internet exposure | Released-program folder with write restricted to one account, media kiosk |
| Mid-size plant with a DNC system | Cell segmentation, DNC server in Level 3, brokered OEM access, program hashing at release | Passive OT monitoring for controller protocols, automated offset change comparison |
| Aerospace, defence or medical supplier | All of the above plus controlled technical data handling for programs and models, audited access to the program store | Hash verification on every transfer, independent review of program changes on critical parts |
Implementing the programme
- Inventory (weeks 1 to 4): list every machine with controller model and version, HMI operating system, network interfaces, converters, shares, monitoring agents, remote access paths and media use. Passive monitoring helps find what walk-downs miss.
- Quick wins (weeks 2 to 6): remove internet exposure, change default credentials on converters and HMIs, disable unused shares, and start offline backups of programs, offsets and parameters.
- Pilot cell (months 2 to 3): segment one cell, move it to a write-restricted released-program store with hashing, and run in monitor-only mode on the firewall first to learn real traffic. Agree a rollback: the previous flat network rules saved and a local program copy at each machine.
- Remote access (months 3 to 4): replace modems and direct remote desktop with a brokered access service, and update builder contracts to match.
- Scale by criticality (months 4 to 12): roll out cell by cell, starting with bottleneck machines and safety-critical or high-value parts, and schedule changes in planned downtime with production sign-off.
- Exercise recovery: at least yearly, restore a machine's programs and offsets from backup and cut a verified first article.
Detection and measurement
Monitor program transfers to controllers from anything other than the DNC server, writes to offsets or parameters outside planned changes, new shares or listening services on HMI PCs, connections to converters from unexpected hosts, remote access sessions outside approved windows, and changes in the released-program store that did not come from the release workflow. Feed DNC server logs and firewall logs into the plant or enterprise SIEM.
- Program integrity coverage: share of released programs with a recorded hash and verification on transfer.
- Unplanned change rate: offset or parameter changes per month found by comparison with no matching work order.
- Exposure: count of controllers, converters and agents reachable from outside their cell (target zero outside the conduit).
- Backup recency: share of machines with a program and parameter backup newer than 7 days, and with a tested restore in the last year.
- Remote access hygiene: share of OEM sessions brokered, approved and recorded.
Framework mapping
| Framework | Reference | Where it applies |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SI-7 Software, Firmware, and Information Integrity; CM-3; CM-5 | Program hashing, controlled release, edit protection |
| NIST SP 800-53 Rev. 5 | SC-7, AC-17, MP-7, SI-3, CP-9 | Cell segmentation, OEM access, media, malware, backups |
| NIST CSF 2.0 | PR.DS-01, PR.IR-01, DE.CM-01, RC.RP-03 | Program store protection, segmentation, monitoring, verified restore |
| NIST SP 800-82 Rev. 3 | OT security guidance | Architecture, threats and countermeasures for OT, including manufacturing |
| IEC 62443-3-3 | FR 3 System integrity, FR 5 Restricted data flow | Integrity of programs and parameters, zones and conduits |
| ISO/IEC 27001:2022 Annex A | 7.10, 8.7, 8.13, 8.22, 8.32 | Storage media, malware, backup, network segregation, change management |
| MITRE ATT&CK for ICS | T0889, T0836, T0843, T0845, T0847 | Program and parameter tampering, upload, removable media |
Common failure patterns
- Program share open to everyone: the folder machines read from is writable by every domain user, so one infected office PC can encrypt or alter the whole cell's programs.
- Forgotten serial converters: converters bought years ago still run factory credentials and accept connections from any subnet.
- Monitoring project widens access: a data collection rollout opens controller APIs or agents to the whole plant network, including write functions nobody needs.
- Shop-floor edits never reconciled: controller copies drift from the released versions, so nobody can tell a tampered program from an optimised one.
- Endpoint agents installed without the builder: security software on an HMI PC breaks the controller software or voids support, and is then removed entirely.
- Backups that skip offsets and parameters: programs are restored after an incident, but tool and work offsets are lost and every machine needs a full re-setup.
Practitioner checklist
- Inventory every controller, HMI PC, converter, agent, share and remote access path.
- Remove internet exposure and change default credentials on HMIs and converters.
- Put the DNC server in the operations zone and restrict writes to the released-program store.
- Record a SHA-256 hash at program release and verify it before cutting.
- Turn on controller edit, offset and parameter protection levels.
- Restrict or disable remote write functions in data APIs, OPC UA and MTConnect PUT.
- Back up programs, offsets and parameters offline and test a restore yearly.
- Replace direct OEM remote access with brokered, time-bound, recorded sessions.
- Alert on unplanned offset, parameter and program changes.
Standards and references
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- NIST NCCoE: SP 1800-10, Protecting Information and System Integrity in Industrial Control System Environments
- MTConnect Institute: MTConnect reference agent
- Trend Micro Research: Uncovering Security Blind Spots in CNC Machines
- MITRE ATT&CK for ICS: Modify Program
- MITRE ATT&CK for ICS: Modify Parameter
Related NHI Mgmt Group resources: Manufacturing Cybersecurity Programme Guide · Manufacturing Identity and OT Access Guide · Additive Manufacturing Security · OT Security Guide