Blog
Blog
The Top 20 Secure PLC Coding Practices. Part 13 – Validate inputs based on physical plausibility
Ensure operators can only input what’s practical or physically feasible in the process. Set a timer for an operation to the duration it should physically take. Consider alerting when there are deviations. Also alert when there is unexpected inactivity. ...
Security Operations Centre – part 1
What is a Security Operations Centre (SOC)? As with many concepts, there isn’t one single definition as to what a Security Operations Centre (SOC) is. According to the SANS Institute, SOC is a combination of people, processes and technologies securing an...
The Top 20 Secure PLC Coding Practices. Part 12 – Instrument for plausibility checks
Instrument the process in a way that allows for plausibility checks by cross-checking different measurements. Security Objective Target Group Integrity oI/O values Product Supplier Integration / Maintenance Service Provider Guidance There are different ways...
Zero Trust Architecture
For many years the infrastructure security model was based on securing the perimeter of the environment. Defenses were built at the perimeter of the network to prevent malicious actors from getting inside. However, once an attacker broke through the...
The Top 20 Secure PLC Coding Practices. Part 11 – Assign designated register blocks by function (read/write/validate)
Assign designated register blocks for specific functions in order to validate data, avoid buffer overflows and block unauthorized external writes to protect controller data. Security Objective Target Group Integrity of PLC variables Product Supplier...
Data Privacy, Data Security, Vol. III
Browser hardening There are many layers at which you can improve your security and privacy. Apart from the layer of the operating system and its settings, the layer of applications, the next important layer is the browser used. Browsers are a window into the...
The Top 20 Secure PLC Coding Practices. Part 10 – Validate indirections
Validate indirections by poisoning array ends to catch fence-post errors. Security Objective Target Group Integrity of PLC variables Product Supplier Integration / Maintenance Service Provider Guidance Indirection is the use of the value of a register in...
Data Privacy, Data Security, Vol. III
Privacy & Security improvement tips for Windows users (and many others) 1. Password Use a strong password, something easy to remember but difficult to hack. There are a few good concepts around such as to use three random words or a passphrase – such as...
The Top 20 Secure PLC Coding Practices. Part 9 – Validate HMI input variables at the PLC level, not only at HMI
HMI access to PLC variables can (and should) be restricted to a valid operational value range at the HMI, but further cross-checks in the PLC should be added to prevent, or alert on, values outside of the acceptable ranges which are programmed into the HMI. ...
Data Privacy, Data Security, Vol. II
Data Security Data security is all the things you do and solutions you implement to protect digital information from unauthorised access, corruption, or theft throughout its entire lifecycle. I am sure the reader is well aware of the various basic data...