OT and ICS Security
PLC, HMI and Engineering Workstation Review
We review who can modify controller programs and whether these changes are logged. We assess the hardening status of the engineering workstation.
What it is
PLCs and HMIs are typically designed for ease of access in production rather than security. The review covers who can modify the controller program and how this is protected. It assesses password status, default settings and whether changes are logged. The engineering workstation is reviewed separately as it provides access to these devices.
Scope
- Identifying who has the authority to modify the controller program
- Password and default setting status on the PLC and HMI
- Whether program changes are logged
- Hardening and update status of the engineering workstations
- Device access via software loading and USB
The need
When organizations need it
- When it is unclear who can access the PLCs managing production processes.
- When you discover there is no record of who made a program change and when.
- When setting up a new engineering workstation and defining the hardening baseline.
Method
How we work
-
Access Rights
We work with your operations team to determine who accesses the controller program and by which method.
-
Assessment
We assess password, default setting and change log status. Active testing is performed only on a spare device.
-
Recommendation
We sequence specific steps to restrict access and log changes according to your maintenance window.
Outcome
What you have at the end
A clear overview of who can modify controller programs and the traceability of changes, plus a sequenced hardening plan for engineering workstations.
Frequently asked questions
Can the review cause a PLC to stop?
By default, active testing is not performed on live devices. Since older controllers may react unpredictably to unexpected requests, active validation is done on a spare device or during a maintenance window.
Which standards do you follow?
In the review we reference IEC 62443 component requirements and accepted best practices for secure PLC programming.
OT and ICS Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting