Kaspersky Industrial CyberSecurity for Networks can monitor industrial network traffic for information about PLC projects and compare this information with previously received information about PLC projects.
A PLC project is a microprogram written for a PLC. A PLC project is stored in PLC memory and is run as part of the industrial process that uses the PLC. A PLC project may consist of blocks that are individually transmitted and received over the network when the project is read or written.
Information about a PLC project/block may be received by the application when it detects operations for reading a project/block from a PLC or writing a project/block to a PLC. The obtained information is saved in Kaspersky Industrial CyberSecurity for Networks. The next time it detects a project/block write or read operation, the application compares the received information about the project/block with the saved information. If the received information about a project/block does not match the latest saved information about that project/block (including when there is no saved information), the application registers the corresponding event.
Receiving information about PLC projects is supported for the following types of devices:
You do not need to add Process Control settings for devices to monitor read/write of PLC projects. Read/write of PLC projects is monitored for all detected devices of the listed types.
For each device, the application saves no more than 100 different variants of PLC projects. If a PLC project is transmitted or received by individual blocks, up to 100 different variants of each block are saved.
If the maximum number of saved PLC projects (or PLC project blocks with the same name) has been reached for a device, the application saves a newly detected project/block in place of the oldest project/block.
When monitoring read/write of PLC projects, the application registers events based on Asset Management technology. Events are registered with system event types that are assigned the following codes:
You can configure the available parameters for event types under Settings → Event types.
You can view information about registered events when connected to the Server through the web interface.
Page top