Inst ToolsInst ToolsInst Tools
  • Courses
  • Automation
    • PLC
    • Control System
    • Safety System
    • Communication
    • Fire & Gas System
  • Instrumentation
    • Design
    • Pressure
    • Temperature
    • Flow
    • Level
    • Vibration
    • Analyzer
    • Control Valve
    • Switch
    • Calibration
    • Erection & Commissioning
  • Interview
    • Instrumentation
    • Electrical
    • Electronics
    • Practical
  • Q&A
    • Instrumentation
    • Control System
    • Electrical
    • Electronics
    • Analog Electronics
    • Digital Electronics
    • Power Electronics
    • Microprocessor
Search
  • Books
  • Software
  • Projects
  • Process
  • Tools
  • Basics
  • Formula
  • Power Plant
  • Root Cause Analysis
  • Electrical Basics
  • Animation
  • Standards
  • 4-20 mA Course
  • Siemens PLC Course
Reading: #10 PLC Best Practices – Assign Register Blocks by Function
Share
Notification Show More
Font ResizerAa
Inst ToolsInst Tools
Font ResizerAa
  • Courses
  • Design
  • PLC
  • Interview
  • Control System
Search
  • Courses
  • Automation
    • PLC
    • Control System
    • Safety System
    • Communication
    • Fire & Gas System
  • Instrumentation
    • Design
    • Pressure
    • Temperature
    • Flow
    • Level
    • Vibration
    • Analyzer
    • Control Valve
    • Switch
    • Calibration
    • Erection & Commissioning
  • Interview
    • Instrumentation
    • Electrical
    • Electronics
    • Practical
  • Q&A
    • Instrumentation
    • Control System
    • Electrical
    • Electronics
    • Analog Electronics
    • Digital Electronics
    • Power Electronics
    • Microprocessor
Follow US
All rights reserved. Reproduction in whole or in part without written permission is prohibited.
Inst Tools > Blog > PLC Tutorials > #10 PLC Best Practices – Assign Register Blocks by Function

#10 PLC Best Practices – Assign Register Blocks by Function

Assign designated register blocks for specific PLC functions in order to validate data and block unauthorized access to controller data.

Last updated: September 21, 2021 11:26 pm
Editorial Staff
PLC Tutorials
No Comments
Share
7 Min Read
SHARE

Assign designated register blocks for specific functions in order to validate data, avoid buffer overflows and block unauthorized external writes to protect controller data.

Contents
Assign Register blocks by Function in PLCBackgroundExample
Security ObjectiveTarget Group
The integrity of PLC variablesProduct Supplier Integration / Maintenance Service Provider

Assign Register blocks by Function in PLC

Temporary memory, also known as scratch-pad memory, is an easily exploitable area of memory if this practice is not followed. e.g., simply writing to a “Modbus” register that is out of bounds could lead to overwriting memory registers used for temporary calculations.

Generally, register memory can be accessed by other devices across the PLC network for read and write operations. Some registers could be read by an HMI, and others could be written by a SCADA system, etc.

Having specific register arrays for a certain application also makes it easier (in the controller or an external firewall is used) to configure Read-only access from another device/HMI.

Examples of functions for which designated register blocks make sense are:

  • reading
  • writing (from HMI / Controller / other external device)
  • validating writes
  • calculations

Ensuring external writes to allowable registers also helps in avoiding main memory reset errors either due to out-of-bound execution or malicious attempts.

These designated register blocks can be used as buffers for I/O, timer, and counter writes by validating that the buffer is completely written (does not contain part old, part new data) and validating all the data in the buffer.

Background

Main memory and register memory are used differently. Main memory is used for storing currently executing program logic whereas the register memory is used as a temporary memory by the currently executing logic.

Though register memory is a temporary one, since it is being used by the executing logic it is bound to contain some important variables that would affect the main logic.

Example

Examples for what could happen if this practice is not implemented:

(Reference: G. P. H. Sandaruwan, P. S. Ranaweera, Vladimir A. Oleshchuk, PLC Security and Critical Infrastructure Protection):

Siemens typically uses the scratchpad memory in the flag area from flag 200.0 to flag 255.7. If a bit is changed within this area there is a likelihood of a serious malfunction of the PLC based on the importance of that bit or byte.

Assume that an attacker can gain access to one of the machines in the PLC network and infect that machine with a worm which is capable of writing arbitrary values to the register memory. Since the register memory values changed arbitrarily, it can change the pressure value.

Executing logic will set a new value based on the change and that may cause the system to exceed its safety margins and possibly be driven to a failure.

Examples for implementing this practice:

In a scenario where there is a safety zone (but the DCS can read), the firewall can log any “write’ attempts with a rule that these registers are READ ONLY in the safety zone.

In another scenario, there could be some write-capable registers, and others are read-only, but having all the READ ONLY registers in a single array makes it easier to configure them in the controller (or a firewall).

Why?

Beneficial for…?Why?
              SecurityMakes it easier to protect the controller data by function (read/write/validate). Makes it easier for protocol-sensitive firewalls to do their job:

The rules get simpler because it is very clear what register blocks are allowed for the HMI to access. Makes it easier to manage the (simpler) rules in the firewall.

Making unauthorized changes to internal temporary memory is an easily exploitable vulnerability (By-pass Logic Attack).

When inputs and outputs to PLC routines are properly validated, any changes (by a malicious actor or by mistake) can be caught easily instead of staying in the logic sequence for long and throwing errors / causing issues later in execution.
        ReliabilityMakes reads and writes go faster because the number of transactions is reduced. Even authorized changes and programming mistakes can cause a malfunction if temporary memory is not protected.

Network and communications errors on long messages can result in unintended errors if the validity of the data is not checked prior to processing.
  MaintenanceProgramming mistakes causing writing to temporary memory can make it hard to find errors, so the problem can be avoided by assigning specific registers for writes.

References

Standard/frameworkMapping
MITRE ATT&CK for ICSTactic: TA009 – Inhibit Response Function,  TA010 – Impair Process Control
Technique:  T0835 – Manipulate I/O image, T0836 – Modify Parameter
  ISA 62443-3-3SR 3.4: Software and information integrity
SR 3.5: Input Validation
SR 3.6: Deterministic Output
    ISA 62443-4-1SD-4: Secure design best practices
SI-1: Security implementation review
SI-2: Secure coding standards
SVV-1: Security requirements testing
  ISA 62443-4-2CR 3.4: Software and information integrity
CR 3.5: Input Validation
CR 3.6: Deterministic Output
  MITRE CWECWE-787: Out-of-bounds Write
CWE-653: Insufficient Compartmentalization

Source: PLC Security

Don't Miss Our Updates
Be the first to get exclusive content straight to your email.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
You've successfully subscribed !

Continue Reading

Top 100+ SCADA Questions
Smart Automation Solutions: PLC Logic for Stairway Lighting
Structured Text PLC Code for Sequential Process Data Storage
Automated Test Bench – Complex PLC Programming Examples
How to Design an Effective HMI? – Human Machine Interface
PLC Program for Ceramic Burning Oven Conveyor System
Share This Article
Facebook Whatsapp Whatsapp LinkedIn Copy Link
Share
Leave a Comment

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Stay Connected

128.3kFollowersLike
69.1kFollowersFollow
208kSubscribersSubscribe
38kFollowersFollow

Categories

Explore More

SFC Language in PLC Programming
VFD Simulator Download – Free Yaskawa V1000 Software
Motor Starter Logic using Siemens PLC Tia Portal
Elevator Control: PLC Program with 5-Second Floor Stops
PLC Ladder Logic Questions and Answers
PID with Practical Example
PLC Panel and MCC Panel Interface Signals
Transferring Data Across PLC Systems – TSEND_C and TRCV_C

Keep Learning

Field Instrument package

Package System Architecture – Control & Instrumentation

Faceplate in WinCC

Siemens HMI Training – Using UDTs with Faceplates

What is Fail-safe in Siemens PLC?

What is Fail-safe in Siemens PLC?

Industrial Automation Solution

How to Choose the Right Industrial Automation Solution?

Cybersecurity in PLC

Cybersecurity in PLC

PLC Sequential Operation Example Program

PLC Sequential Operation Example Program

Conveyor Speed Logic using Structured Text in PLC

Conveyor Speed Logic using Structured Text in PLC

Types of PLC Memory

Types of PLC Memory

Learn More

Allen Bradley PLC Emulator

How to Work with Allen Bradley RsLogix Emulator?

Automation in Agriculture

Automation in Farming & Agriculture

Coriolis Mass Flowmeter Principle

Coriolis Mass Flow Meter Working Principle

Star to Delta Conversion

Star to Delta and Delta to Star Conversion Formula

hydraulic module

Identify all Spool Valve Positions

PC-Based Motion Controller

Various Types of Delta PLC used in Industrial Automation

Power Systems Questions & Answers

Power Systems MCQ Series 18

Characteristics of Level Measurement Technologies

Identify Characteristics of Level Measurement Technologies

Follow US
All rights reserved. Reproduction in whole or in part without written permission is prohibited.
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?