How do I know if an unauthorised computer writes to our PLC?

You need something that reads the industrial protocol on the wire and knows which hosts may write, because the PLC will normally accept the write without complaint and log nothing. First write down which stations should ever change a setting: usually one or two engineering workstations and the SCADA or HMI servers. Then make the network enforce it where you can, with firewall rules that let only those hosts reach the controllers. Monitoring covers what the rules miss: a laptop plugged into the line, an office PC with a forgotten route, malware on an allowed station. From the Pro plan, NetSenX reads write requests from passive capture on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port and raises an alert when a write comes from a host that is not allowed to write, naming the source, the controller, the function and the time. It does not record the value written or which person was at the keyboard.

← All 50 questions on OT and IoTAll topics