The federal advisory on Iranian-linked threats to Schneider Electric and Siemens PLCs is a serious warning. Organizations using these controllers have faced disruptions and financial losses due to malicious project file interactions and manipulated HMI/SCADA displays. If your PLCs are internet-facing, you're at risk from state-affiliated actors exploiting these vulnerabilities.
This guide helps you isolate, harden, and monitor internet-facing operational technology. By following these steps, you'll reduce your attack surface and enhance detection capabilities in constrained OT environments.
Why This Matters
State-affiliated actors targeting critical infrastructure go beyond reconnaissance. The attacks detailed in the expanded CISA advisory show adversaries manipulating project files and altering display data, indicating they have write access to control logic and operator interfaces. These are not exploratory scans but operations aimed at disrupting physical processes.
Your risk increases with every PLC, HMI, or SCADA gateway that accepts inbound connections from the internet. This threat is real: organizations have already suffered operational disruptions and financial losses. The advisory's expansion to include Schneider Electric and Siemens highlights that attackers are broadening their targets.
Act now to prevent your control systems from becoming the next case study.
Preparation
Before making changes to your OT environment, gather these resources:
Network Visibility: Inventory every PLC, HMI, engineering workstation, and SCADA server with IP connectivity. Use passive asset discovery tools like Claroty or Nozomi Networks if needed. Don't rely on outdated network diagrams.
Change Control Authority: Coordinate with operations, engineering, and safety teams. Get sign-off from process owners before modifying firewall rules or disabling remote access paths. Document your rollback plan.
Segmentation Infrastructure: Use industrial firewalls or next-generation firewalls capable of deep packet inspection for industrial protocols (Modbus TCP, EtherNet/IP, S7comm, OPC UA). Standard IT firewalls lack protocol-level visibility.
Backup and Recovery Capability: Back up PLC logic, HMI projects, and SCADA configurations before making changes. Test your restore procedure to ensure a quick recovery if needed.
Monitoring Tools: Deploy logging for authentication attempts, configuration changes, and protocol anomalies. You need visibility into who accesses your controllers and what commands they're sending.
Step-by-Step Implementation
Phase 1: Eliminate Direct Internet Exposure
Remove any PLC, HMI, or SCADA component from direct internet reachability. This is your most impactful control.
Identify Exposed Assets: Use Shodan, Censys, or your vulnerability scanner to run external scans against your public IP ranges. Look for common OT ports: 502 (Modbus), 2222 (EtherNet/IP), 102 (S7comm), 4840 (OPC UA), 47808 (BACnet). Document every hit.
Close Inbound Rules: Work with your network team to remove firewall rules allowing inbound traffic to OT devices from the internet. Disable port forwarding or NAT mappings exposing PLCs for remote vendor access.
Deploy Jump Hosts: For remote access, route connections through a hardened jump host in a DMZ. Require multi-factor authentication and session recording. Never allow direct inbound connections to controllers.
Phase 2: Segment OT from IT Networks
Create network boundaries to prevent lateral movement from compromised IT systems into your control environment.
Deploy Industrial Firewalls: Position firewalls between your IT network and each OT zone (process control, safety systems, building automation). Deny all traffic by default, then explicitly permit only necessary protocols and source/destination pairs.
Implement Unidirectional Gateways: For data flowing from OT to IT (historian data, alarm notifications), use data diodes or unidirectional gateways. These devices prevent return traffic, eliminating command injection risks from IT networks.
Restrict Engineering Workstation Access: Engineering laptops that program PLCs should be on isolated VLANs with no direct internet access. Use separate devices or tightly controlled proxy servers for internet access if needed.
Phase 3: Harden Controller Configurations
Secure the PLCs against unauthorized access and malicious project files.
Change Default Credentials: Change default usernames and passwords for every PLC. Use unique credentials for each device class and store them in a privileged access management system.
Enable Authentication: Turn on password protection for PLC programming software connections. Enforce authenticated sessions with tools like Schneider Electric Unity Pro, Siemens TIA Portal, and Rockwell Studio 5000.
Restrict Firmware Updates: Configure PLCs to reject firmware uploads except from specific authorized engineering workstations. Enable digital signature verification for firmware images if available.
Disable Unused Services: Turn off web servers, FTP services, and diagnostic protocols you don't use. Every enabled service is a potential attack vector.
Phase 4: Lock Down HMI and SCADA Systems
The advisory highlights manipulation of HMI and SCADA displays, indicating attackers are targeting the human-machine interface layer.
Implement Read-Only Operator Screens: Configure HMI projects so operators can view process data but can't modify setpoints or issue control commands without elevated privileges. Use role-based access control to separate operator and engineer permissions.
Validate Display Data: Deploy checksum verification or cryptographic signing for HMI project files. Enable integrity checking in your SCADA system to detect unauthorized modifications to display logic.
Log All Operator Actions: Capture every button press, setpoint change, and mode switch. Maintain an audit trail showing who did what and when. Forward these logs to a separate logging server that OT users can't modify.
Validation
Run these tests to confirm your hardening measures are effective:
External Scan Validation: Re-scan your public IP ranges. You should see zero OT devices or protocols exposed. If open ports remain, revisit your controls.
Penetration Test from IT Network: Have your security team attempt to reach PLCs from a standard IT workstation. They shouldn't connect without going through your jump host or VPN infrastructure.
Authentication Test: Try connecting to a PLC using default credentials. The connection should fail. Attempt to upload a modified project file without proper authentication; the controller should reject it.
Monitoring Validation: Generate test events (failed login attempts, configuration changes, unusual protocol traffic) and verify they appear in your SIEM or OT monitoring platform promptly.
Incident Response Drill: Simulate an attack scenario where an adversary gains access to an HMI. Can your team detect the intrusion and isolate the affected segment? Time the response and document gaps.
Ongoing Tasks
OT security requires continuous effort. Incorporate these activities into your routine:
Quarterly Asset Discovery Scans: OT environments change as you add sensors, upgrade controllers, or connect new systems. Re-scan your network quarterly to catch new exposures.
Monthly Firewall Rule Review: Audit your industrial firewall rules monthly. Remove overly permissive rules and access paths without documented business justification.
Vendor Access Governance: Issue temporary credentials for vendor access that expire after the maintenance window. Require approval for each session and log all vendor activity. Review vendor access logs weekly.
Threat Intelligence Integration: Subscribe to ICS-CERT advisories, vendor security bulletins, and sector-specific threat feeds. Cross-reference indicators against your environment within 48 hours of advisories like the one covering Iranian-linked attacks.
Tabletop Exercises: Run quarterly scenarios where your team responds to simulated OT incidents. Practice isolation procedures, communication protocols, and recovery steps. Update your playbooks based on lessons learned.
The expanded scope of state-affiliated targeting demands a robust defensive posture. These steps won't eliminate all risk, but they'll make it significantly harder for adversaries to compromise your control systems. Start by eliminating internet exposure, then enhance your segmentation and monitoring capabilities. Your operations depend on it.
