Value of PLC Key Switch Monitoring to Keep Critical Systems More Secure
Summary: Dragos recounts that the 2017 XENOTIME compromise of Schneider Electric's Triconex SIS controller succeeded because the controller's key switch was in "Program" mode, allowing TRISIS malware to upload and download project files from a compromised engineering workstation; had the switch been in "Run" mode, the attack would not have worked. Knowing and detecting the key switch state is now the number two recommendation in the Top 20 Secure PLC Coding Practices, and the article details how Rockwell ControlLogix switches have three physical positions but five modes, with "Remote" accepting program writes from an external source.
Key Takeaway: A single physical switch position was the difference between a failed attack and the TRISIS malware landing on a safety instrumented system, and the article notes that in "Remote" mode a PLC can be controlling live operations while disruption occurs without notice.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026