A Modicon controller may operate water, power or transport equipment, so network access and program changes need deliberate control. Review the protections supported by the installed controller and firmware, including application protection and a security profile. Achilles certification concerns the tested product; it is not a switch that makes an installation secure. Use the checklist to examine the configuration and the access it permits.
The checklist illustrates hardening choices for a Modicon M580. Select an item to read its effect and watch the demonstration score change. That score is a teaching aid, not a security assessment. Check the actual device settings and operating requirements before disabling a service or changing access protection.
Use defence in depth to combine controls with different roles. Network segmentation limits reachability, disabled services remove unused access paths, and authentication and application protection restrict changes. Check each control on the installed system; a completed checklist does not prove that the controller can resist every attack.
🚪 Disable unused services. Review FTP, TFTP, HTTP, EtherNet/IP and Modbus access. Disable services the application does not need, using the controls supported by the device. Confirm which communications depend on a service before changing it.
🔑 Authentication & the security profile. Set application & section protection where supported, select the appropriate security settings and use individual engineering accounts when the system provides them. Avoid blank or shared credentials that prevent you from controlling or tracing access.
🧱 Network segmentation. Separate the control network from the office network with the required firewall and DMZ arrangements. Permit the communication needed by the application instead of allowing unrestricted access from the office LAN to the controller.
✍️ Integrity. Use the available run/stop protection, event logging and integrity checks as specified for the controller. Check what each facility detects and records rather than assuming every logic change is automatically logged.
Someone proposes using only the application password to secure the controller. Which other access paths would that leave for you to review?