Security researchers have been counting refrigeration controllers sitting on the open internet – supermarket cold rooms, hospital pharmacies, distribution depots. Forescout did the counting. A French supermarket chain did the bleeding, after attackers walked in through unsecured remote access and legacy kit. Both stories were filed under IT news. Wrong shelf. I have spent two decades in automotive and aerospace plants signing shipments against control plans, and I can tell you what that controller actually is: a process parameter, a measurement device and a quality record in one grey box on a wall. If an attacker can set the temperature, he can set the record – and your control plan will sign for the shipment, because it is doing exactly what you built it to do.

The setpoint is a process parameter

Walk into a plant and ask what holds your curing-oven temperature, your plating-bath chemistry, your cold-chain storage. A controller. Now ask who can change it. The control plan assumes the answer is someone standing in front of it – a person who badged through a door, opened a locked cabinet, turned a dial. Change control assumes hands. A remote setpoint change is an engineering change nobody approved, executed at 3 a.m., with no signature, no ECN and no revision to the PFMEA.

Run the arithmetic nobody runs. A plating bath held four degrees high overnight does not drift back by itself. You scrap the load, re-plate, burn eight hours of line time – call it €40,000 before anyone writes a corrective action. And the maintenance vendor whose remote session made it possible appears on no supplier list, no process FMEA, no control plan. A supplier of variation that came in through a network socket instead of the goods-in gate.

Calibration assumes drift, not intent

I have lived inside clause 7.1.5 of IATF 16949 and AS9100 for most of my career. Calibration intervals, MSA, gauge R&R – the whole apparatus models error as unintentional. Bias is noise. Linearity moves with temperature. Stability wanders. We quantify the noise, bracket it, accept it, and the chart absorbs it.

A compromised sensor breaks every one of those assumptions at once. It is not noisy. It is precisely wrong, in the direction the attacker chooses. He holds the setpoint and the sensor; the chart stays green because he feeds the chart. Green is not evidence the process ran. It is testimony from a witness he controls.

SPC was built to catch a process that wanders. It was never built to catch a process that lies.

This is where my second life pays its keep. I hold a CEH among more than thirty security certifications, and my name sits on T-Mobile's public bug-bounty Hall of Fame for a clickjacking finding, disclosed responsibly. I found that flaw because I think like an intruder, not an auditor. The auditor asks whether the control exists. The intruder asks what you forgot. And intruders rarely take the firewall head-on – it holds. They take the forgotten maintenance path: the shared VPN password from 2016, the diagnostic modem on the tempering line that nobody remembers commissioning.

Audit the record against the part

I built the QA/QC function of a 900-employee greenfield plant from bare concrete, measurement-system programme and asset register included, so I know exactly how the register fails. It fills with what you can see: the CMM, the torque benches, the callipers. Networked instruments slip off it – the gateway on the paint oven, the vendor's remote port, the maintenance laptop with local admin rights. None of it counts as measuring equipment until the day it changes a number, and by then it is somebody else's problem. You cannot FMEA what you never listed.

So the defences start on the shop floor, not in the server room:

  • Inventory the OT estate before anything else. Every controller reachable from outside the building belongs on the asset register and the PFMEA, not just the IT diagram.
  • Pair networked sensors with dumb ones. A €30 standalone logger taped inside the cold room records a value the network never touched. When the two disagree, the disagreement is the alarm – the one alarm an intruder cannot silence, because he cannot reach the box raising it.
  • Alarm on rate-of-change, not only on limits. Drift is slow. Intent is fast. A bath that moves six degrees in ten minutes at 2 a.m. is not a calibration problem.
  • Rehearse containment by period, not by lot. A lying gauge means quarantining every shipment back to the last verified record. Know that window before you need it; working it out during a live customer escalation is too late.

And when the record and the part disagree, QRQC discipline beats all of it: go touch the part. The database says 4 °C. Put a thermometer in the case. The floor answers faster than the server, and it has no reason to lie to you.

Key takeaways

  • A process parameter changeable from outside the building is an engineering-change path with no signature – treat remote access to controllers as change control, not IT hygiene.
  • Calibration models drift, never intent; a green SPC chart is testimony from the sensor, not evidence about the part.
  • Standalone loggers beside networked sensors turn silent compromise into loud disagreement that no network attacker can suppress.
  • Containment for a compromised gauge runs in time, not lots – fix the lookback window to the last verified record now, not during the escalation call.

Quality management and ethical hacking are the same craft. Both study how complex systems fail, then build so they don't. IATF 16949 and AS9100 are superb on error by accident and silent on error with intent. Take one question to the floor tomorrow: which of our process parameters can be changed from outside this building, and who gets the alert when one moves at 2 a.m.? If the answer is a shrug, the gauge is already compromised. The chart simply hasn't told you yet.