Cybersecurity

PLC Cybersecurity & IEC 62443: Protecting Industrial Networks in the Connected Age

Your PLC is now on the network — and attackers know it. Learn IEC 62443 defense-in-depth, zone segmentation, access control patterns, and how to write Structured Text that resists tampering.

· 20 min read

  • Cybersecurity
  • IEC 62443
  • Network Security
  • Industrial Protection
  • Structured Text

🛡️ Why PLC Cybersecurity Is No Longer Optional

In 2010, Stuxnet proved that PLCs are viable cyberattack targets. Since then, attacks on industrial control systems have surged: the 2021 Oldsmar water treatment hack, the 2022 Pipedream/Incontroller toolkit targeting Schneider and Omron PLCs, and countless unreported incidents. If your PLC touches a network — even an "air-gapped" one — it needs security.

IEC 62443 (formerly ISA/IEC 62443) is the international standard for industrial automation cybersecurity. This article covers the practical aspects every controls engineer needs: network architecture, PLC-level protections, and Structured Text patterns that detect and resist tampering.

🏰 Defense-in-Depth: The Castle Model

IEC 62443 uses defense-in-depth — multiple layers of protection so that no single breach compromises the entire system:

| Layer | Protection | Analogy | | Enterprise Network | Firewall, DMZ | Castle walls | | Plant Network (L3) | IDMZ, segmentation | Inner bailey | | Control Network (L2) | VLAN isolation, ACLs | Keep | | Device Level (L1/L0) | Hardened PLCs, firmware | Crown jewels |

The Purdue Model (Updated)

Level 5: Enterprise Network (ERP, email, internet)
         ─── Corporate Firewall ───
Level 4: Site Business (MES, historian server)
         ─── IDMZ (Industrial DMZ) ───
Level 3: Site Operations (SCADA servers, engineering stations)
         ─── Control System Firewall ───
Level 2: Area Control (PLCs, DCS controllers)
         ─── Network Segmentation ───
Level 1: Basic Control (I/O modules, drives, sensors)
Level 0: Physical Process (motors, valves, instruments)

The IDMZ (Industrial Demilitarized Zone) is the critical boundary. No direct traffic should flow between Levels 4-5 and Levels 0-3. Data exchange happens through broker services in the IDMZ (data diodes, OPC UA aggregation servers, or replicated databases).

🔒 Zone and Conduit Model

IEC 62443-3-2 defines zones (groups of assets with the same security requirements) and conduits (communication paths between zones):

// PLC-side: Zone identity and access validation
TYPE SecurityZone :
STRUCT
    ZoneID        : INT;
    ZoneName      : STRING[20];
    SecurityLevel : INT;        // SL1 to SL4
    AllowedSources: ARRAY[1..16] OF STRING[15]; // Allowed IP addresses
    NumAllowed    : INT;
END_STRUCT;
END_TYPE
FUNCTION FC_IsAllowedSource : BOOL
VAR_INPUT
    SourceIP     : STRING[15];
    Zone         : SecurityZone;
END_VAR
VAR
    i : INT;
END_VAR
FOR i := 1 TO Zone.NumAllowed DO
    IF Zone.AllowedSources[i] = SourceIP THEN
        FC_IsAllowedSource := TRUE;
        RETURN;
    END_IF;
END_FOR;
FC_IsAllowedSource := FALSE;

🔐 PLC Access Control Patterns

Command Authentication

Don't accept commands from just anyone on the network. Implement a challenge-response or at minimum a session token:

FUNCTION_BLOCK FB_CommandAuth
VAR_INPUT
    IncomingToken  : DWORD;
    CommandCode    : INT;
    SourceID       : INT;
END_VAR
VAR_OUTPUT
    Authorized     : BOOL;
    RejectionCount : DINT;
END_VAR
VAR
    ValidToken     : DWORD := 16#A5B4C3D2;   // Shared secret (rotate periodically)
    LastRejectTime : STRING[20];
    ConsecRejects  : INT := 0;
    LockoutActive  : BOOL := FALSE;
    tmrLockout     : TON;
END_VAR
Authorized := FALSE;
// Lockout after too many failed attempts
tmrLockout(IN := LockoutActive, PT := T#60S);
IF LockoutActive THEN
    IF tmrLockout.Q THEN
        LockoutActive := FALSE;
        ConsecRejects := 0;
        tmrLockout(IN := FALSE);
    END_IF;
    RETURN;   // Reject everything during lockout
END_IF;
// Validate token
IF IncomingToken = ValidToken THEN
    Authorized := TRUE;
    ConsecRejects := 0;
ELSE
    Authorized := FALSE;
    RejectionCount := RejectionCount + 1;
    ConsecRejects := ConsecRejects + 1;
    
    // Lockout after 5 consecutive failures
    IF ConsecRejects >= 5 THEN
        LockoutActive := TRUE;
        // Log: Potential brute-force attack from SourceID
    END_IF;
END_IF;

Write Protection for Critical Parameters

FUNCTION_BLOCK FB_ProtectedParameter
VAR_INPUT
    NewValue       : REAL;
    WriteRequest   : BOOL;
    AuthLevel      : INT;          // 0=Operator, 1=Engineer, 2=Admin
    RequiredLevel  : INT := 1;     // Minimum auth level to change
END_VAR
VAR_OUTPUT
    CurrentValue   : REAL;
    WriteAccepted  : BOOL;
    WriteRejected  : BOOL;
    LastChangeBy   : INT;
END_VAR
VAR
    _value         : REAL;
    _minLimit      : REAL := 0.0;
    _maxLimit      : REAL := 100.0;
END_VAR
WriteAccepted := FALSE;
WriteRejected := FALSE;
IF WriteRequest THEN
    IF AuthLevel >= RequiredLevel THEN
        IF NewValue >= _minLimit AND NewValue <= _maxLimit THEN
            _value := NewValue;
            WriteAccepted := TRUE;
            LastChangeBy := AuthLevel;
        ELSE
            WriteRejected := TRUE;
            // Log: Out-of-range write attempt
        END_IF;
    ELSE
        WriteRejected := TRUE;
        // Log: Unauthorized write attempt — auth level insufficient
    END_IF;
END_IF;
CurrentValue := _value;

🕵️ Anomaly Detection in the PLC

The PLC itself can detect suspicious activity:

FUNCTION_BLOCK FB_AnomalyDetector
VAR_INPUT
    Enable          : BOOL;
    // Monitor these for anomalies
    ScanTimeActual  : TIME;
    CommRequestRate : INT;       // Requests per second
    WriteAttempts   : INT;       // HMI write commands per scan
    UnknownSourceIP : BOOL;      // Connection from unknown IP
END_VAR
VAR_OUTPUT
    ThreatLevel     : INT;       // 0=Normal, 1=Low, 2=Medium, 3=High, 4=Critical
    AlertMessage    : STRING[80];
    TotalAlerts     : DINT;
END_VAR
VAR
    NormalScanTime  : TIME := T#10MS;
    MaxCommRate     : INT := 100;
    MaxWriteRate    : INT := 10;
END_VAR
ThreatLevel := 0;
AlertMessage := '';
IF NOT Enable THEN RETURN; END_IF;
// Check 1: Scan time anomaly (CPU overload = possible DoS)
IF ScanTimeActual > (NormalScanTime * 3) THEN
    ThreatLevel := 2;
    AlertMessage := 'Abnormal scan time — possible DoS attack';
    TotalAlerts := TotalAlerts + 1;
END_IF;
// Check 2: Excessive communication requests (scanning/probing)
IF CommRequestRate > MaxCommRate THEN
    ThreatLevel := 3;
    AlertMessage := 'Excessive comm requests — possible network scan';
    TotalAlerts := TotalAlerts + 1;
END_IF;
// Check 3: Rapid write attempts (brute force or fuzzing)
IF WriteAttempts > MaxWriteRate THEN
    ThreatLevel := 3;
    AlertMessage := 'Rapid write attempts — possible attack';
    TotalAlerts := TotalAlerts + 1;
END_IF;
// Check 4: Connection from unknown source
IF UnknownSourceIP THEN
    ThreatLevel := 4;
    AlertMessage := 'Connection from unauthorized IP address';
    TotalAlerts := TotalAlerts + 1;
END_IF;

📋 Hardening Checklist

| Action | Priority | IEC 62443 Reference | | Change default passwords on all devices | Critical | SR 1.5 | | Disable unused communication ports | Critical | SR 7.7 | | Enable encrypted communication (TLS/OPC UA) | High | SR 4.1 | | Implement network segmentation (VLANs) | High | SR 5.2 | | Restrict physical access to control cabinets | High | SR 2.1 | | Enable audit logging on PLC | Medium | SR 2.8 | | Implement firmware version verification | Medium | SR 3.4 | | Establish incident response procedures | Medium | SR 6.2 | | Conduct regular vulnerability assessments | Medium | SR 3.3 | | Use application whitelisting on engineering stations | Low | SR 3.2 |

Summary

| Concept | Implementation | | Defense-in-depth | Multiple layers: network, zone, device, application | | IDMZ | No direct traffic between enterprise and control networks | | Zone model | Group assets by security level, control conduits between zones | | Command authentication | Token validation with brute-force lockout | | Parameter protection | Auth-level gated writes with range validation | | Anomaly detection | Monitor scan time, comm rate, write rate, source IPs | | Hardening | Systematic checklist based on IEC 62443 requirements |

Cybersecurity in OT isn't about installing antivirus on a PLC. It's about architecture, segmentation, and vigilance — designed into the system from day one, not bolted on after an incident.