Question

A manufacturing company runs a fleet of programmable logic controllers (PLCs) on a legacy SCADA network that communicates using Modbus/TCP. A security assessment found that any host on the OT segment can issue write commands to the PLCs, and the protocol offers no authentication or integrity checking. The controllers cannot be patched or replaced for at least three years due to warranty and safety-certification constraints. Which approach BEST reduces the risk of unauthorized command injection while respecting these operational limitations?

Accepted Answer

Deploy a protocol-aware industrial firewall (Modbus deep-packet inspection) that enforces read/write function-code allowlists and restricts write commands to specific engineering-workstation source addresses

Answer

Enable TLS 1.3 with mutual certificate authentication directly on the PLCs to encrypt and authenticate all Modbus/TCP sessions

Answer

Install endpoint detection and response (EDR) agents on each PLC to monitor for anomalous command execution

Answer

Require operators to authenticate to the PLCs with multifactor authentication before issuing write commands