How do I detect a PLC program change outside working hours?
Combine a record of when your engineers really work on the controllers with a sensor that sees program downloads and writes on the network. A program change at 02:00 on a Sunday is not proof of an attack, since maintenance often happens while the line is stopped, but someone should be able to explain it the next morning. Keep a simple change log with the planned maintenance windows, compare it with what the network shows, and keep a known-good copy of each PLC program offline so you can compare and restore it. Some controllers can also report a changed program to the SCADA system. From the Pro plan, NetSenX flags OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. activity outside working hours and decodes S7comm requests such as a program block download, with the block name, from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port. It does not read the program's content or compare versions; your engineering software does that.
Read next
Related questions
Terms used here
- OT (operational technology)
- The computers that run machines, production lines, building systems and utilities.
- SPAN (switch port analyser)
- A switch setting that sends a copy of network traffic to one port, where a sensor can watch it.
- TAP (test access point)
- A small device that copies the traffic on a network cable for a sensor to watch.