Hardening the engineering workstations that program your PLCs

Engineering workstations can change controller logic, so treat them as the most sensitive Windows machines on site. Limit which ones may connect to controllers, restrict what runs on them, require MFA for remote access, keep them patched on a tested schedule, and log every programming session.

Why they are the target

Each advisory cited here touches them. AA22-103A says the described tools can compromise Windows engineering workstations through a vulnerable driver, and advises limiting ICS connections to approved engineering and management workstations. The Unitronics advisory describes actors who set logic to an older version, blocking engineering workstation communication, and asks owners to update engineering software. The Siemens S7 alert recommends mapping engineering workstations, patching the programming software and watching for scripting libraries on non engineering systems.

A hardening checklist

Purpose and placement

• Dedicate machines to engineering work. Do not browse the web or read email from them.
• Put them in a controlled zone, reachable only through the DMZ or a jump host.

Connections to controllers

• Allowlist which workstations may talk to which controllers by address.
• Block everything else at the zone boundary.

Software control

• Use application allowlisting and install only necessary applications, as the advisories recommend.
• Keep programming software and plugins current, with testing first.
• Watch for programming libraries or drivers appearing on machines that should not have them.

Accounts and access

• Use named accounts, not shared ones.
• Apply least privilege and remove dormant accounts.
• Require MFA for remote access to these hosts.

Platform protections

• AA22-103A suggests hardening management systems with operating system protections it names, and EDR where suitable, and enforcing strong anti-virus settings.

Logging

• Retain security and application logs.
• Log each connection to a controller and record the person and ticket behind it.

Removable media and laptops

Contractors often bring a laptop with a copy of the project file. Define a clean, scanned route for transferring files and a rule about whether outside laptops may connect. A single unmanaged laptop undoes the rest.

Keep project files safe

Source project files hold the gold copy of controller logic. Store them access controlled, hash them and keep an offline copy. That ties into the baseline process for controller logic.

Test changes first

Hardening can break engineering tools. Pilot on one workstation with an engineer who will tell you what stopped working, then roll out.

Review quarterly

Every quarter, list who can program which controllers, confirm each account is still needed, check patch levels of programming software, and review a sample of connection logs against change tickets. Anything without a ticket gets a conversation.

Quick check

Sources

• CISA, APT Cyber Tools Targeting ICS/SCADA Devices, AA22-103A
• CISA, IRGC-Affiliated Cyber Actors Exploit PLCs, AA23-335A
• CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A

Last reviewed: 19 October 2026.