Programmable logic controllers (PLCs) in plain English
Think of a washing machine: depending on the program, it fills with water, heats it, washes, and spins. A small control unit decides what happens when. A PLC does the same job in industry – only more rugged, faster, and freely programmable. In German, it’s called a speicherprogrammierbare Steuerung, or SPS for short.
PLCs are found in packaging machines, bottling plants, wastewater treatment plants, elevators, and building automation. They belong to industrial control systems, or ICS for short, and are a central building block of OT (operational technology). This refers to the technology that controls physical processes rather than processing data.
How a PLC works
A PLC works in a fixed cycle that often repeats many times per second:
- Reading inputs: Sensors report, for example, temperature, pressure, fill level, or whether the light beam of a photoelectric sensor has been interrupted.
- Running the program: The control program decides what to do according to fixed rules – such as “If the tank is full, close the valve.”
- Switching outputs: The PLC drives actuators – motors, valves, pumps, or signal lights.
The PLC is programmed using special software on an ordinary PC known as the engineering workstation. The common programming languages are defined in the IEC 61131-3 standard. Over the network, the PLC exchanges data with operator panels (HMIs, human-machine interfaces) and control systems such as SCADA.
This is exactly where the security problem lies. Many controllers and industrial protocols such as Modbus/TCP were developed for isolated networks. They often don’t check who is sending a command. Anyone with access to the network can then read and change values, overwrite the control program, or stop the controller.
A practical example
A food manufacturer has its networks examined as part of a penetration test. According to the network diagram, production is separated from the office network. The test reveals, however, that a forgotten firewall rule for remote maintenance lets an office PC reach the controllers of the bottling line directly.
The testers can read out a PLC’s control program without a password. The configuration also shows that the controller would accept program changes without a password. An attacker could thus have changed setpoints such as temperatures or fill quantities. The company removes the firewall rule, sets up secure remote maintenance, and enables the controllers’ access protection.
Why does this matter for businesses?
When a PLC is manipulated, more than data is at stake. The risks include production outages, defective products, and, in the worst case, danger to people and the environment. Since the Stuxnet computer worm came to light in 2010, if not earlier, there has been clear evidence that malware can deliberately sabotage controllers.
On top of that, PLCs often run for many years, sometimes decades. Updates can’t simply be installed, because every change affects production and often has to be coordinated with the manufacturer.
Regulation is tightening, too. The EU Machinery Regulation (EU) 2023/1230, which applies from January 20, 2027, requires machine manufacturers, among other things, to protect machines and their control systems against tampering that could lead to hazardous situations. The IEC 62443 series of standards provides guidance on how to secure them.
How to protect your organization
- Separate networks: Controllers belong in their own strictly isolated network zones. Only explicitly permitted connections should be possible between the production and office networks – the key concept here is network segmentation.
- Never expose them to the internet: A PLC must not be reachable from the internet.
- Secure remote maintenance: Grant service providers access only with multi-factor authentication, for limited periods, and with logging.
- Use built-in protection: Many controllers offer password protection for program access, access levels, or write protection. Enable these functions. On some models, a key switch on the device also prevents program changes during operation.
- Harden engineering workstations: These PCs can reach all controllers. They shouldn’t also be used for email and web browsing.
- Maintain an inventory and backups: Do you know which controllers are running which firmware – that is, which device software? Back up the control programs regularly.
- Plan updates: Install firmware updates during maintenance windows once the manufacturer has approved them.
How Rootsektor can help
With a penetration test for OT, ICS/SCADA & IoT, we check whether attackers can get from the office network or via remote maintenance all the way to your controllers, and how well those controllers are protected. We start passively, without sending any traffic into the control network. Active tests on controllers take place only with your approval – preferably during maintenance windows or on a test setup. You can read more about the requirements in your industry under Manufacturing & Industry.