50% of Automotive Manufacturers Are Susceptible to a Ransomware Attack

The automotive industry has started to ramp up its digitalization in their manufacturing sites but cybersecurity is still an afterthought for most organizations. For cyber criminals who are adopting ransomware attack methods, this is music to their ears.

According to a recent ransomware trends report, close to 50% of the 100 largest automotive manufacturers are highly affected by ransomware attacks. Additionally, more than 17% of automotive suppliers most likely will incur a ransomware attack.

One headline-grabbing example of a successful ransomware attack that hit automakers hard was the 2017 WannaCry outbreak. This attack affected over 200,000 computers in over 150 countries. This included France’s Renault where many of their industrial systems were exploited and were forced to temporarily idle some of their plants in Europe. Renault manufacturing plants in France, Slovenia and Romania were so affected, that all their industrial activity was shut down and remained offline for days.

A more recent example of automotive manufacturing companies being attacked is when massive vehicle manufacturers Volkswagen and Audi fell victim to the “Conti” ransomware group. Over 3.3 million customers and interested buyers in the United States and Canada were affected by this attack. The attacker was able to obtain access to their networks by scraping an unsecured Microsoft Azure server. Data stolen includes email addresses, vehicle identification numbers, phone numbers, and physical addresses.

The threat landscape of automotive manufactures will only continue to grow and the need for improved cybersecurity will become more obvious as more automotive companies will fall victim to cyber criminal attacks.

The Keys Are in The Cyber Criminals’ Glove Compartment

No industry is safe from the threat of cyberattacks such as ransomware and this is especially true with the automotive industry. Due to implementing legacy systems and their physical cybersecurity approach, the industry as a whole needs to rethink its security strategy.

Until recently, the majority of automotive manufacturers believed the security of their manufacturing plants and enterprise IT systems were less of a priority. This meant that the typical automotive organization would keep any security attack or event out of the public eyes which resulted in their security teams ignoring the real risks at hand.

As the technology of automotive manufacturers is advancing, security is becoming more prominent not just inside the cars, but also in the manufacturing phase. According to an industrial threat research report by IBM, “automotive manufacturers were the top targeted manufacturing sub-industry in 2021, accounting for almost 1/3 of the total attacks against the manufacturing industry.”

As a result of the increasing number of attacks on the automotive manufacturing industry, organizations and their management teams are now taking security more seriously by getting a better understanding of their organization’s security strategy and how they can strengthen their security posture against attacks. While this is a good first step for organizations to understand where they are vulnerable, automotive manufacturers need to understand why cyber criminals see them as attractive targets.

Why Automotive Manufacturers Are Constantly Being Attacked

As the automotive manufacturing industry has started to embrace more Industrial Internet of Things (IIoT) it has created an endless amount of security challenges. The most glaring security risk for automotive manufacturing systems is modernizing their technology to be more interconnected to the Internet which has resulted in their OT environments being under attack. This has impacted automotive manufacturing plants as process control devices and intelligent assembly manufacturing lines with PLCs are becoming less secure by the day. These threats are challenging the industry from a security and organizational perspective.

Additionally, cyber espionage is a large threat to the manufacturing of vehicle development, production and delivery due to the automotive industry being extremely competitive. Not just between manufacturers but actually between countries as there is a massive drive for new automotive technologies and innovation. Similar to other industries, North Korean and Russian threat actors have been linked to targeting the automotive industry. The state-sponsored attackers’ key initiative is to exploit the system of automotive manufacturers and steal information that pertains to innovative research, developments, intellectual property information and in some cases to even slow down their production lines.

Another reason why state-sponsored attackers may target the automotive industry is to steal information on new technologies that are being developed for governments and the military. By targeting automotive constructors it can provide cyber criminals large amounts of information which can include, artificial intelligence, sensor detail, autonomous vehicle systems and discrete deployment information.

One of the more recent and popular methods that cyber criminals are implementing is attacking automotive manufacturer’s supply chains via third-party vendors. These external parties can be seen as low-hanging fruit for cyber criminals as they are potentially easy entry points to compromise additional systems up the supply chain in order to gain access to the targets’ primary networks. If a third party is exploited, an automotive manufacturer would be presented with even more risks.

What Automotive Organization Can Do To Prevent Attacks

Automotive manufacturers need to distribute their time and resources to gain a better understanding of how vulnerable their systems are and what they can do to secure their organization’s data and systems. To understand how to protect the organization’s systems, the first step is to understand the different security challenges and risks that relate to automotive manufacturer systems and equipment and which strategy is needed for better security.

With the amount of successful state-sponsored attacks over the past few years, different industrial verticals including automotive manufacturing, now understand the urgency of adopting the correct security practices when it comes to securing their OT environments. As more automotive organizations continue to modernize their OT equipment and connect their industrial networks to the Internet, it will open a door for cyber criminals to attack and move laterally within the OT networks.

Only until recently did the typical automotive manufacturer use stand-alone systems and equipment. However as technology has advanced, more organizations are connecting their legacy systems to the Internet to provide access to third-party vendors to work with their OT equipment. This new method of work has forced security teams of automotive manufacturing companies to change their mindset and approach to secure their OT networks and equipment.

While the industry is taking time to adapt to this new security approach, it is great to see the ongoing increase in awareness that is shaping the industry to become more secure. Some organizations, like Coşkunöz Holding have taken a more proactive approach when securing their OT assets with a passive network monitoring solution that is designed for OT environments. Coşkunöz Holding now has complete visibility into their OT networks, up-to-date inventory of all their production assets, including detailed critical asset visibility and vulnerability management capabilities.

To avoid becoming victims to the next widespread ransomware attack, the automotive industry needs to implement a more proactive security approach that is based on detection and mitigating risks within their production environment. By implementing the right OT security approach with awareness and technology, the automotive manufacturing industry can benefit significantly from it, ensuring their servers and systems are secure from incoming cyber attacks.

To learn more about smart organizations like Coşkunöz Holding are expanding their OT visibility into their automotive manufacturing plants, check out their OT Security case study here: https://www.scadafence.com/resource/global-automotive-aerospace-manufacturer-expands-ot-visibility-and-cybersecurity/

Just as the security community was recovering from the SolarWinds supply-chain attack, over July 4th holiday weekend Kaseya IT management software, commonly implemented by Managed Service Providers (MSPs) fell victim to a series of supply-chain attacks.

Kaseya is the Focus of New Supply Chain Ransomware Attack

According to a report from Bleeping Computer, on July 2, 2021, the REvil ransomware gang was actively targeting managed services providers (MSPs) and its customers via a Kaseya VSA supply-chain attack to deploy ransomware on enterprise networks. Kaseya is a popular software developed for Managed Service Providers that provide remote IT support and cybersecurity services for small- to medium-sized businesses that often cannot afford to hire full-time IT employees, due to their limited size or budgets.

Hundreds of worldwide businesses, including Coop supermarkets in Sweden, confirmed to the BBC they have been impacted by the Kaseya attack, although they are not customers of Kaseya, and have shut down hundreds of stores in Sweden since yesterday evening. This is because they have lost their Point of Sale facilities, which are managed by a company that is a Kaseya customer.

Figure 1. What the infected systems look like

The attackers initially gained access by using a zero-day vulnerability in Kaseya VSA via a malicious automatic update to the software which eventually would deliver the ransomware. Once active in the IT environments, the ransomware would encrypt the different contents of the systems on the network. This would cause widespread operational disruption to any organization that uses this software.  Even if the latest version of Kaseya VSA was implemented at the time of the attack, the cyber criminals could remotely execute commands on the VSA appliance.

How the Ransomware is delivered

As per the DoublePulsar Blog Post on the Kaseya attack: “Delivery of ransomware is via an automated, fake, software update using Kaseya VSA.

The attacker immediately stops administrator access to the VSA, and then adds a task called “Kaseya VSA Agent Hot-fix”.

This fake update is then deployed across the estate — including on MSP client customers’ systems — as it’s fake management agent update.

This management agent update is actually REvil ransomware.

To be clear, this means organizations that are not Kaseya’s customers were still encrypted.

The Following Command is Run:

powershell.exe Set-MpPreference -DisableRealtimeMonitoring $true -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

What this does:

• Disables Real Time Monitoring
• Disables IPS
• Disables Cloud Lookup
• Disables script scanning
• Disabled Controlled Folder Access (ransomware prevention feature)
• Disables Network Protection
• Stops cloud sample submission

Throughout their attack, the cybercriminals shut off administrative access to VSA, and several protections within Microsoft Defender were disabled, including Real-Time Monitoring, Script Scanning, and Controlled Folder Access. Kaseya and the US Cybersecurity and Infrastructure Company have both advised clients functioning the VSA software on their servers to shut those servers down as soon as possible.

Figure 2. The Ransom Note

How MSPs Can Open The Door For Attackers

Large organizations that often have a budget for IT and security can easily adopt a robust security strategy to prevent cyber attacks. Smaller organizations or companies that are not security-minded will tend to turn to MSPs to provide them with IT and security services. In order for MSPs to provide their services, they are given remote and administrator access to their client’s networks and environments. The different remote access and credentials that are provided to MSPs are extremely attractive for cyber criminals.

Figure 3. The Anatomy of an MSP Cyberattack 

Given the large number of clients that each MSP is working with, a successful cyber attack could be very profitable and attractive for a cyber criminal. Once the attacker has exploited the MSP system they could easily move laterally across MSP client’s systems and environments. In short, by attacking and successfully exploiting an MSP, cyber criminals have the opportunity to quickly gain access to all their client’s networks, systems and data without being noticed.

While the typical MSPs is a security expert when it comes to securing their clients’ networks and ensuring they are well protected, they also need to ensure their own system is secure from cyber criminals. Security patches must be applied in a timely order, vulnerabilities must be mitigated as quickly as possible and they need to adopt security solutions for any kind of attack to ensure that their system is protected.

In general, customers should set more control limits to their MSPs. For example, endpoints that do not need remote monitoring and management, should not have an agent installed on them. This reduces the risk in such attacks, and less devices will be affected.

It’s A Busy Summer Ahead

Over the past few months, there has been a major increase in the number of successful ransomware attacks. The Colonial Pipeline attack and the REvil attack of meat processor JBS resulted in millions of dollars in operational and mitigation loss. While these attacks are just two examples of successful ransomware, we expect cyber criminals to continue to exploit the different products and services that we use on a daily basis.

With each attack becoming more sophisticated and successfully exploiting well-known organizations, it has caught the attention of the U.S. government. On May 12th, United States President Joe Biden signed an executive order (EO) to improve the cybersecurity of the United States and the private sectors. This executive order seeks to increase its efforts in detecting and responding to different attacks and threat actors in the cyber espionage landscape.

Additionally, the US government plans to play a significant role when it comes to incident responding to ensure better security guidelines in the private sector. For example, in the case of the Kaseya attack, U.S. President Joe Biden has ordered federal intelligence agencies to investigate the supply chain attack. In a statement on Saturday, the U.S. Cybersecurity and Infrastructure Security Agency said it was “taking action to understand and address the recent supply-chain ransomware attack” against Kaseya’s VSA product.

Be Prepared – Not For “If” But “When”

While the Kaseya attack so far hasn’t affected OT systems, it has brought up the subject of organizations needing improved security strategies. Cyber criminals are becoming more sophisticated when targeting different organizations. As long as the security hygiene of an organization or its third-party vendors isn’t up to par, cyber criminals will increase the number of attacks to exploit organizations’ vulnerabilities to truly hurt their victims.

To be prepared for incoming cyberattacks, organizations need to think like cyber criminals and implement a more concrete security strategy with the proper security solutions for any kind of attack. Instead of checking the box in their security checklist, organizations should test their systems and networks to see where they are vulnerable. More importantly, security teams need to change their security mindset from “if we will be attacked” to “when and how we will be attacked”, and prepare accordingly.

The huge difference between the secure and the exploited is how effectively their organization handled a potential cyber attack. By being prepared with basic security practices in place, it will allow security teams to prevent potential attacks from being successful.

We recommend organizations increase their visibility into their entire network as it’s difficult to protect what you can not see. Additional recommended practices are to adopt security network monitoring solutions that provide network segmentation and micro-segmentation as this will help organizations prevent similar ransomware attacks moving forward.

If your organization is looking into securing its industrial networks, the experts at SCADAfence are seasoned veterans in this space and can show you how it’s done.

Ransomware is Everywhere

Over the past few months, there is a feeling that every day a different organization has fallen victim to a ransomware attack. While the idea of a ransomware attack isn’t new, the recent headline-grabbing attacks are exploiting the different products and services that we use on a daily basis. This growing trend of cybercriminals attacking different critical infrastructures has become more lucrative for attackers as they are affecting the way of life which is more devastating for the global community and their victims.

On top of the alarming amount of ransomware attacks, more and more severe vulnerabilities due to remote access have been discovered. This has made it easier for cybercriminals to exploit their targets. One of the most targeted industries that have been affected by poor remote access security is the water utility industry.

Due to the important role of water and wastewater infrastructures in our society, their newly connected systems have become an attractive target for cybercriminals to attack via different attack vectors such as insider and outsider threats and supply chain attacks.

Since the start of 2021, there have been different examples of water plants being successfully attacked by cybercriminals. On January 15th, a water treatment plant in San Francisco was exploited by an attacker who was trying to poison the plant. The cybercriminal gained access by using a former employee’s TeamViewer account credentials. Once the attacker accessed the water plant’s system, they deleted programs that the water plant used to treat drinking water. The attack was only discovered the next day by the water plant and the facility changed its passwords and reinstalled the programs.

A few weeks later another attack on a water plant occurred, and this time it was the Oldsmar Florida water system cyber attack. A hacker gained access into the water treatment system of Oldsmar, Florida, and hijacked the plant’s operational controls. He was able to temporarily drive up the sodium hydroxide content in the water to poisonous levels. Luckily, a plant operator was able to return the water to normal levels.

In 2018, The Department of Homeland Security (DHS) and the FBI warned that the Russian government is specifically targeting the water sector which resulted in the US government forming the Cybersecurity and Infrastructure Security Agency (CISA) to ensure the cybersecurity of critical infrastructure would be prepared for incoming physical threats.

The attack surface of water and wastewater infrastructure will only continue to grow over time. This sparks the priority for stronger cybersecurity and more secure remote access as more water utility organizations will become victims to cyber attacks which could lead to disastrous consequences or even death.

Water Utilities Are an Attractive Target

There are close to 200,00 drinking water systems in the U.S. that provide tap water to nearly 300 million Americans. These water systems are in cities, schools, hospitals, office buildings and other places. When critical water or wastewater systems are exploited by a cybersecurity attack, the malicious activity could result in devastating consequences to public health and safety.

Some attacks on water utilities could cause contamination, operational malfunction, and service outages which would result in potential illness and casualties. Additionally, it could result in a compromise of emergency response teams and possibly impact different transportation systems and food supply. Additionally, on top of attacking the physical water utility equipment, the water plant sector entities are in charge of some critical personal data. This personal data is an extremely attractive target for cybercriminals as seen in previous attacks.

Another example of a successful attack on a water utility is the city of Atlanta ransomware attack. In March 2018, the city of Atlanta and Atlanta Department of Watershed Management employees were unable to turn on their work computers or gain wireless internet access, and two weeks after the attack Atlanta completely took down its water department website “for server maintenance and updates until further notice.” It took Atlanta months to recover and an estimated cost of up to $5 million in recovery efforts, to address the attack.

Remote Access Provides Attackers an Easy Entry Point

If the recent examples of successful attacks on water infrastructures were not evident on the different security threats, now more than ever water utility companies need to get more serious about how they manage remote access.

Over the past decade, the technology behind water infrastructures and utilities has become more interconnected with OT & IoT devices. The different connected devices such as controllers, sensors and smart meters are being used by water utilities to remotely monitor and manage processes. Unfortunately, they are easy targets for cybercriminals to infiltrate.

For water utilities, smart metering can increase efficiency but it comes with its consequences and remote access is a key entry point for successful attacks. Having poor remote access security can allow cybercriminals from both internal and external to gain access to the main operating system remotely and causing severe community health issues like flooding or contaminating water sources.

There is also the issue of smart meters and water appliances that are deployed by water management organizations that can be infiltrated by cyber attacks. If a smart meter is compromised through an attack or reverse engineering, it would allow cybercriminals to potentially access the metering infrastructure which would provide them the ability to attack and move laterally within an organization’s system and networks.

The different vulnerabilities of smart meters brighten the light on the importance and need for better device protection. It is crucial for organizations that are using connected utility devices such as ICS, controllers, smart meters, sensors, etc. to be properly monitored and managed. By understanding who has access, from where they are accessing and irregular activity to a water utility device it will decrease the chance of a successful remote attack on the water systems.

What Water Organizations Can Do

Water and wastewater organizations need to prioritize security and this starts with setting aside the proper amount of resources and attention in protecting their company’s infrastructure and equipment. This process starts with getting a deep understanding of the different security risks that are presented with water and wastewater systems and which steps need to be done to ensure better security.

With the increasing number of successful attacks on water plants and more awareness of the different risks with water utilities, more organizations are slowly starting to understand the significance of implementing the right security practices when it comes to securing their IT and OT systems. As water plants adopt more smart sensors and other IoT devices to automate and modernize their water-based process, it will create new exploitable entry points for cybercriminals to exploit remotely and move laterally within the organization systems.

As water technology continues to advance, so do the different risks that come with it. By adopting more connected technologies and devices it has forced water organizations to connect to the internet which has resulted in more remote access entry points which have caused the increase of security events. This trend has resulted in security teams updating their security approach to one that fits for better remote access security and a new approach for OT security.

While not every water utility company has made the right steps for a more secure water plant, the awareness has led to changes in the water industry. Some companies and cities like The city of Hutchinson have taken a more proactive approach when securing their connected OT equipment with a passive network monitoring solution, specifically designed for OT environments. Now, the city of Hutchinson is securing all their water production, treatment divisions operate and maintain reverse osmosis (RO) water treatment center, 20 water wells, 2 booster pump stations, 4 water storage towers, 2 Class I disposal wells, and all of their groundwater remediation facilities all in one platform.

As water and wastewater organizations continue to become a more attractive target for cybercriminals, it’s best to be prepared for any kind of attack on water utilities by now taking action and mitigating any risks. With a more security-first approach cemented in an organization with the right amount of awareness, water utilizes can continue to expand as their networks do. It is important for decision-makers to consider new security approaches that offer a device-level, security by design that protects their infrastructure for years to come.

To learn more about how SCADAfence protects the water supply of 42,080 Americans in the city Of Hutchinson, Kansas, download the case study here:
https://www.scadafence.com/resource/how-scadafence-protects-the-water-supply-of-the-city-of-hutchinson/

Over the years, PLCs have been insecure by default. Security good practices have been created and adopted for IT which can be seen in OWASP’s Top Ten Vulnerabilities list and Secure Coding Practices report. However, until recently there has not been an emphasis on the different features in PLCs or SCADA for security or how engineers can program PLCs more securely.

Most organization’s PLCs were not connected to the internet or anything outside their industrial control systems or other PLCs. However, the new mindset of  Industry 4.0 of the ongoing automation of traditional manufacturing and industrial practice has created more security risks and threats for OT networks.

Until now most security research that had to do with PLCs was more focused on how to exploit PLCs and how to alter the industrial processes. Luckily insecure PLCs haven’t been highlighted as the key reason for the most recent cyberattacks on industrial organizations. The more common IT threats have been the heart of attacks with targeted ransomware attacks as seen in the Colonial Pipeline attack. Despite only attacking the IT network, the company shut down its OT networks and operations which control its pipelines and distribute fuel as a precaution which resulted in a temporary gas shortage in the United States.

Another example of a recent breach where OT networks were threatened is the water plant in the city of Oldsmar, Fla. This attack showed the potential risks of a cyberattack and the lack of secure programming practices of PLCs could lead to a physical outcome, in this case, poisoning drinking water. These examples are proof that improved and more secure PLCs will lead to becoming the biggest benefit in preventing a process from getting into a bad state.

Top 20 Secure PLC Coding Practices

As our good friend, Jake Brodsky said in his recent S4x20 talk, “No one learns secure PLC coding at school.” The idea that engineers were expected to come out of college knowing the best practices for programming PCLs is a misconception in the industry. According to Jake, there is a massive knowledge gap for the typical engineer who is tasked with programming PLCs which is resulting in more troubles for different ICS security businesses.

The eye-opening talk was the initial spark to create the Secure PLC Programming Practices Project by Jake Brodsky, Dale Peterson, Sarah Fluchs and Vivek Ponnada and is hosted by the ISA (International Society of Automation) Global Cybersecurity Alliance. This new security initiative offers a free downloadable 44-page document that outlines the 20 best practices for engineers that program industrial controls and help improve the security of their systems. Little or no additional software tools or hardware are needed to implement them. They can fit into normal PLC programming and operating workflows.

These are tips and tricks for catching and avoiding problems during the whole lifecycle of the PLC and the application. One of the main goals of this initiative is that PLC vendors will start to integrate or provide templates with their product training to help customers employ these practices when programming their devices.

Here are the key best practices from the list that we feel relate the most to OT security:

Validate and Alert For Paired Inputs/Outputs

If you have paired signals, ensure that both signals are not asserted together. Alarm the operator when input/output states occur that are physically not feasible. Consider making paired signals independent or adding delay timers when toggling outputs could be damaging to actuators (for example, asserting forward and reverse together)

This is important for security reasons because if PLC programs do not account for what is going to happen if both paired input signals are asserted at the same time it could result in the PLCs becoming a good attack vector for cyber criminals. By ensuring that both signals are not asserted together it will help to avoid an attack scenario where physical damage can be done.

Leave Operational Logic in the PLC Wherever Feasible

HMIs provide some level of coding capabilities, originally aimed to help operators enhance visualization and alarming. However, the HMI doesn’t get enough updates to do totallizing or integration. There is also a latency between HMI and PLC which may interfere with the accuracy of such efforts. Furthermore, an HMI will restart far more often than most PLC equipment. It makes sense to keep such accumulators/counters/integrators/elapsed-time counters and so forth there. The HMI can always receive totalizers/counts from a PLC. Thus the operational logic program should rather stay in the PLC to remain complete and auditable.

This practice is beneficial for security because it allows consistency in verifying code changes. HMI coding has its change control apart from PLC, generally not with the same rigor which does not allow system owners to have a complete view and even losing important considerations. HMI’s do not include “forced signals” or changed value lists as PLCs or SCADAs.

Restrict Third-Party Data Interfaces

To strengthen the security of PLCs, it’s highly recommended to restrict the type of connections and available data for 3rd party interfaces. The different connections and data interfaces should be specifically defined and restricted for third parties to be allowed to have read and write capabilities for the required data transfer.

This practice limits the different exposures to 3rd party networks and equipment while authenticating external devices to prevent spoofing. Additionally, it limits the ability for intentional or unintentional modifications or access from 3rd party locations or equipment.

Trap False Negatives and False Positives for Critical Alerts

OT teams should identify the critical alerts and program a trap for those alerts. Most critical alerts for PLCs tend to occur when they are triggered by different conditions.  In some cases, an adversary will attack OT devices by suppressing the alert trigger which could cause a false-negative or false-positive alert. By setting up a trap to monitor the different triggers of alerts it will allow OT teams to detect the alert state for any deviation. A PLC can react much faster than an HMI and can be far more sensitive to these triggers.

By detecting and mitigating false negative or false positives of critical alerts caused by an adversary attack on OT equipment it will allow OT security teams to have a better understanding if their PLC is accessible and being tampered with.

Define a Safe Process State in Case of a PLC Restart

By commanding a PLC to restart in the middle of a working process, there shouldn’t be any issues when it comes to disruption to the process.  Make sure that the process it controls is restart-safe. If it is not practical to configure the PLC to restart-safely, you should define safe process state alerts to ensure that the Standard Operating Procedures (SOP) have clear instructions for setting the manual controls so that the PLC will start up the process properly.

By defining a safe process state it eliminates potential unexpected behavior. The most basic attack vector for a PLC is to force it to crash or restart it. For many PLCs, it is not that hard to do, because many PLCs cannot cope well with unexpected inputs or too much traffic.  For example, the SCADafence research team found a remote CPU DoS vulnerability in Mitsubishi Electric iQ-R Series. This would allow an attacker to send a short burst of specially crafted packets over the MELSOFT UDP protocol on port 5006, which causes the PLC’s CPU to get into fault mode, causing a hardware failure. The PLC then becomes unresponsive and requires a manual restart to recover. This may be uncommon, but it is a basic attack vector if we take into account the malicious behavior of an attacker.

Using The Top 20 Secure PLC Coding Practices

In summary, at least half of these programming recommendations can be summarized as “Validate your inputs.” Many PLC programmers just assume that something physical doesn’t need to be validated. But it is possible to force inputs and it is possible for an HMI to push invalid data to a PLC. Plan for it.

The Top 20 Secure PLC Programming Practices is a great best practices guide that is the work of hundreds of PLC programmers, engineers, and security experts. This is a must-read for every OT security professional and PLC programmer, it is a specific guideline for coding a programmed PLC to help avoid a potential cyber-physical attack.

You can download the Top 20 Secure PLC coding practices document at www.plc-security.com.

Earlier this month, on June 4th, the North American Electric Reliability Corporation (NERC) released a new practice guide that pinpoints how organizations should integrate network monitoring solutions into industrial operational technology (OT) networks of the electric utility industry.