An engineering workstation is one of the few systems in an OT environment that almost always has full configuration access to critical equipment such as RTUs, protection relays and station controllers. That makes it both indispensable for maintenance and one of the most valuable targets for an attacker.
Why engineering workstations are vulnerable
Engineering workstations often run vendor-specific software that does not always support the latest operating system, are occasionally connected to both office and OT networks, and are sometimes used by several people or even external parties. This combination — broad access rights, outdated software and varying use — makes them attractive as a stepping stone to critical systems.
Key measures
- Isolate engineering workstations in their own zone, separated from both office IT and the process bus, with controlled conduits to both.
- Use personal accounts instead of shared admin accounts, so that actions are traceable.
- Restrict connections to removable media and the internet. Where possible, work with a separate, isolated environment for downloading and validating software and updates.
- Validate project files from an external source before opening them, for example via an isolated scanning environment, because insecure deserialisation in engineering software is a known attack path.
- Keep software and patches up to date, including the underlying operating systems, within the limits of what the vendor supports.
- Log and monitor use, so that deviating activity — such as logging in outside office hours — can be detected.
Remote engineering: an extra point of attention
More and more maintenance is done remotely. When an engineering workstation is accessed remotely, this must go through a controlled remote access gateway with multi-factor authentication and session recording — not through a direct connection from a vendor network to the substation.
Practical example
At a system integrator, a local engineering workstation is only occasionally connected to the substation LAN, solely during planned maintenance windows, and never permanently connected. Outside these windows the device is physically disconnected and offline, which greatly limits the attack surface without losing maintenance capability.
Common mistake
Leaving one engineering workstation permanently connected to both the office network (for email and software updates) and the substation LAN. This completely undermines the segmentation between zones, however well the rest of the network is set up.