Kaspersky Industrial CyberSecurity for Networks can monitor industrial network traffic for information about PLC projects and compare this information with previously received information about PLC projects.
A PLC project is a microprogram written for a PLC. A PLC project is stored in PLC memory and is run as part of the industrial process that uses the PLC. A PLC project may consist of blocks that are individually transmitted and received over the network when the project is read or written.
Information about a PLC project/block may be received by the application when it detects operations for reading a project/block from a PLC or writing a project/block to a PLC. The obtained information is saved in Kaspersky Industrial CyberSecurity for Networks. The next time it detects a project/block write or read operation, the application compares the received information about the project/block with the saved information. If the received information about a project/block does not match the latest saved information about that project/block (including when there is no saved information), the application registers the corresponding event.
Receiving information about PLC projects is supported for the following types of devices:
To monitor read and write of PLC projects, you are not required to add assets to the list of process control devices. Read and write of PLC projects is monitored for all detected assets of the specified types.
For each asset, the application saves no more than 100 different variants of PLC projects. If a PLC project is transmitted or received by individual blocks, up to 100 different variants of each block are saved.
If the maximum number of saved PLC projects (or PLC project blocks with the same name) has been reached for an asset, the application saves a newly detected project/block in place of the oldest project/block.
When monitoring read/write of PLC projects, the application registers events based on Asset Management technology. Events are registered with system event types that are assigned the following codes:
You can configure the available parameters for event types in the Application Console on the Configure events tab.
You can view information about registered events when connected to the Server through a web browser.
Page top