On June 15, ISA Global Cybersecurity Alliance (ISAGCA), With admeritia GmbH (admeritia) They published a document where they explained the best practices for programming PLC improving the IT security of the PLCs and the plants they control.
Would you like to learn how to protect IoT devices and train as a Cybersecurity Director? Visit our Master in Cybersecurity Management, Ethical Hacking and Offensive Security and learn with the best.
What is a Programmable Logic Controller (PLC)?
A PLC (Programmable Logic Controller) is a device which is usually used in automatic engineering or industrial automation, for automate processes, such as the control of factory machinery, other production processes, etc.
ISA Global Cybersecurity Alliance is a collaborative forum to promote cybersecurity awareness, education, preparedness and knowledge sharing.
From admeritia GmbH they indicate that in the document we can find:
- Orientation: Instructions, theory, background and explanations.
- Examples: Examples of implementation or also examples of what would happen if the practice was not implemented.
- “By that”: A list of benefits that the implementation of these practices will bring. They are almost always advantages regarding safety, but also maintenance and reliability.
- References: References to standards and frameworks.
20 Best Practices for Programming PLCs
- Modularize PLC code, divide the PLC code into modules.
- Monitoring of operating modes. Keep the PLC on RUN mode.
- leave the operational logic in the PLC whenever possible
- Use PLC indicators as integrity checks
- Use cryptographic integrity checks and/or checksum for the PLC code.
- Validate timers and counters.
- Validate and alert on paired inputs/outputs.
- Validate the variables HMI input at PLC level, not just at HMI
- Validate hints.
- Assign record blocks designated by function (read/write/validation).
- Instrument of plausibility check.
- Validate contributions based on physical plausibility.
- Disable unnecessary/unused ports and communication protocols
- Restrict third-party data interfaces.
- Define a safe process state in case of PLC reset.
- Summarize the times PLC cycle times and trends in the HMI.
- Record uptime of the PLC and the trend in the HMI
- Record hard stops from the PLC and trend on the HMI.
- Monitor the use of PLC memory and create trends in the HMI.
- Catch false negatives and false positives for critical alerts Identify critical alerts and schedule a trap for those alerts.
We leave you the link to see the full report here.
