#2 PLC Best Practices – Track Operating Modes

Track PLC operating modesKeep the PLC in RUN mode. If PLCs are not in RUN mode, there should be an alarm to the operators.

Security ObjectiveTarget Group
  The integrity of PLC logicIntegration / Maintenance Service Provider / Asset Owner

Track PLC Operating Modes

If PLCs are not in RUN mode (e.g., PROGRAM mode), their code could be changed to track the RUN mode. Some PLCs have a checksum to alert for code changes, but if they do not, there’s at least an indirect indicator of a potential issue while tracking operating modes:

If PLCs are not in RUN mode, there should be an alarm to the operators. If they are aware that someone is supposed to be working on that control system, they can acknowledge the alarm and move on.

The HMI should be configured to re-alert the operator toward the end of the shift about the presence of the alarm. The goal should be to keep track of any staff or contractors in the plant doing work that might impact the process.

Exception Case

If the plant is in a testing or development phase, consider disabling this alarm but the plant should be isolated from higher levels of the network.

Track PLC Operating Modes

Example

If the PLC does not have a hardware switch for changing operating modes, it is recommended to at least make use of software mechanisms that can restrict changing PLC code.

e.g., password protection in engineering software for reading and writing PLC code.

Why?

Beneficial for…?Why?
      SecurityThe operating mode (run / edit / write; for Allen Bradley PLCs: RUN / PROGram / REMote) determines if PLC can be tampered with.

If the key- switch is in the REMote state, it is technically possible to make changes to the PLC program over the communication interfaces even if the PLC is running.
Reliability/
Maintenance/

References

Standard / frameworkMapping
  MITRE ATT&CK for ICSTactic:  TA009 – Inhibit Response Function
Technique:  T0858 – Utilize/Change Operating Mode
ISA/IEC 62443-4-1SI-1 : Security implementation review

Source: PLC Security

Share With Your Friends

Leave a Comment

#2 PLC Best Practices - Track Operating Modes

Send this to a friend