Define safe states for the process in case of PLC restarts (e.g., energize contacts, de-energize, keep the previous state).
| Security Objective | Target Group |
| Resilience | Product Supplier Integration / Maintenance Service Provider |
Safe State when PLC Restarts
If something commands a PLC to restart in the middle of a working process, we should expect the program to pick up smoothly with minimal disruption to the process. Make sure that the process it controls is restart-safe.
If it is not practical to configure the PLC to restart safely, be sure that it alerts you to this fact and that it does not issue any new commands.
Also, for that case, ensure that the Standard Operating Procedures (SOP) have very clear instructions for setting the manual controls so that the PLC will start up the process properly.
Also, document all start-up, shut-down, steady-state control, and flying control system restart procedures.
Why?
| Beneficial for…? | Why? |
| Security | Eliminates potential unexpected behavior: The most basic attack vector for a PLC is to force it to crash and / or restart. For many PLCs, it is not that hard to do, because many PLCs cannot cope well with unexpected inputs or too much traffic. While there are several diagnostics for controller actions while it is running, how it handles startup up with a running process is usually not clear. This may be uncommon, but it is a basic attack vector if we take into account the malicious behavior of an attacker. |
| Reliability | Avoid unexpected delays: If after a PLC power on, the state machine initializes to a state with some conditions that don’t let the process to start, and the operator cannot normalize the system. A technician would need to enter the PLC program to force the conditions to go to the desired state to be able to start operation. This could cause delays and production losses. |
| Maintenance | / |
References
| Standard/framework | Mapping |
| MITRE ATT&CK ICS | Tactic: Â TA009 – Inhibit Response Function Technique: Â T0816 – Device Restart/Shutdown |
| ISA 62443-3-3 | SR 3.6: Deterministic Output |
| ISA 62443-4-2 | CR 3.6: Deterministic Output |
| ISA 62443-4-1 | SVV-1: Security requirements testing |
Source: PLC Security
