How do I detect attacks on PLCs in a small factory?

Watch the traffic to and from the controllers, because a programmable logic controller (PLC) keeps almost no security log of its own. The useful signals are simple: a write or a program download from a computer that is not your engineering station, a stop or start command nobody planned, office machines talking directly to controllers, and activity at night or at weekends when nobody works on the line. Begin with the free steps: list which stations may program each PLC, check that the office network cannot reach the control network, and leave the controllers' key switches in run mode where your hardware has them. From the Pro plan, NetSenX reads Modbus/TCP, DNP3, BACnet/IP, EtherNet/IP and S7comm from a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port and raises four kinds of OTOT: operational technology. The computers that run machines, production lines, building systems and utilities. alert: unauthorised writes, traffic crossing plant network levels, off-hours OT activity and S7comm commands. It never probes the controllers, and it does not see serial links or segments you do not mirror.

← All 50 questions on OT and IoTAll topics