“CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers at water utilities,” explains CISA Acting Director Nick Andersen. “We urge critical infrastructure owners and operators to remove publicly exposed PLCs and other operational technology from the Internet as soon as possible. We also encourage all organizations to review the latest guidance on CISA.gov and to report suspected incidents or anomalous activity to us for further support.”

Control Design’s longest standing columnist, automation industry veteran Jeremy Pollard, spoke with me about the vulnerabilities of PLCs; the evolution of their connectivity to the Internet; the use of virtual private networks (VPNs) and gateways; and what machine builders can learn from this to keep industrial equipment secure.

Rockwell Automation has addressed the alert with a published security advisory including guidance on restoring access to MicroLogix 1400 and MicroLogix 1100 controllers when the password is unknown. Its corporate communications spokesperson indicated: "Rockwell Automation takes the security of its products and solutions seriously and has been working with customers, partners and government agencies regarding reports of unauthorized cyber activity and disruptions at some utilities. Rockwell Automation has provided customers with guidance and published security advisories that include recommendations for strengthening the security of operational technology environments."

Chapters

• 00:00 – CISA Security Alert Overview
• 01:41 – Why Are PLCs Susceptible to Attacks?
• 03:29 – Boundary Checks
• 04:45 – Password Management
• 09:05 – Wastewater SCADA Architecture
• 12:23 – Understanding VPNs & Nodes