Ensure operators can only input what’s practical or physically feasible in the process. Set a timer for an operation to the duration it should physically take. Consider alerting when there are deviations. Also, alert when there is unexpected inactivity.
Security Objective | Target Group |
Integrity of I/O values | Integration / Maintenance Service Provider |
If the operation takes longer than expected to go from one extreme to the other, that is worthy of an alarm. Alternatively, if it does it too quickly, that is worthy of an alarm too.
A simple solution could be a step-timeout alert. This would be useful for sequence/step-controlled tasks.
For example, the step “move object from A to B” takes 5 sec from the start of the step until the transition condition (sensor: object arrived at B) is met.
If the condition is met significantly too early or too late, the step-timeout is alert triggered.
Physical plausibility checking can also mean alert for physically implausible inactivity:
If there is an expectation of a regular, repeating cycle of events (e.g., batches, diurnal patterns), an inactivity timer would alert if something which is expected to change (discrete or analog value) remains static for far too long.
The gates on a dam takes a certain time to go from fully closed to fully open
In a wastewater utility, a wet well takes a certain time to fill
Manufacturing process or pipeline batching should regularly cycle between control ranges or operating modes.
Municipal wastewater treatment plants typically have a diurnal cycle of activity/pattern of influent flow rates.
e.g., Oldsmar Florida case allowed for operator input that’s a) thousands of times more than what was typically needed b) that’s physically not possible.
Try to configure the operational limits in the PLC code wherever possible instead of using HMI scripts.
Why?
Beneficial for…? | Why? |
Security | 1. Deviations can indicate an actuator was already in the middle of a travel state or that someone is trying to fake the I/O, e.g., by doing a replay attack. 2. Inactivity alerts facilitate monitoring for frozen or forced constant values which could be the result of system or device tampering. |
Reliability | 1. Deviations give you an early alert for broken equipment due to electrical or mechanical failures. 2. Inactivity alerts help flag measurements or system control loops which may be failing (thus static) due to physical device fault or an issue with the logic control algorithm or failed/improper operator input. |
Maintenance |
References
Standard/framework | Mapping |
MITRE ATT&CK for ICS | Tactic: TA010 – Impair Process Control Technique: T0806 – Brute Force I/O |
ISA 62443-3-3 | SR 3.5: Input Validation SR 3.6: Deterministic Output |
ISA 62443-4-2 | CR 3.5: Input Validation CR 3.6: Deterministic Output |
MITRE CWE | CWE-754: Improper Check for Unusual or Exceptional Conditions |
Source: PLC Security
The conveyor sorting machine is widely used in the packing industries using the PLC program…
Learn the example of flip-flop PLC program for lamps application using the ladder logic to…
In this article, you will learn the STAR DELTA programming using PLC controller to start…
Lube oil consoles of rotary equipment packages in industrial process plants are usually equipped with…
Rotating equipment packages such as pumps, compressors, turbines need the lube oil consoles for their…
This article explains how to blink lights in ladder logic with a detailed explanation video…