Assessing device identity, message protection and access permissions

Hello everyone. A device supporting EtherNet/IP does not automatically encrypt its communication. Protection depends on the CIP Security profiles implemented, the active security policy and the network architecture. Reviewing how the protocol operates alongside its security functions provides a clearer picture than a general statement in a product catalog.

How does CIP Security protect communication?

TLS protects TCP-based EtherNet/IP communication, while DTLS protects UDP-based time-critical I/O communication. Depending on the supported security profile, X.509 certificates or pre-shared keys can authenticate endpoints. Assess the requirements for standard and secure communication separately when reviewing message types and ports.

Message integrity helps detect changes made in transit; message authentication helps establish that a message came from a trusted endpoint. Confidentiality restricts access to the content through encryption. Encryption capabilities and their use depend on the profile, product and policy: a statement that a device supports CIP Security does not establish that all traffic is always encrypted.

Device identity and user permissions are different

A PLC authenticating another device does not establish that every operation performed through that device is authorized. The CIP User Authentication Profile provides a basis for user-level authentication and role-based authorization. Using these functions requires support in the relevant devices and software.

For example, monitoring, parameter changes and program management can be treated as separate permissions. Verify the implementation during configuration. An HMI user account alone does not prove that equivalent access controls apply to every CIP service on the network.

Distinguish CIP Safety from cybersecurity

CIP Safety addresses functional safety communication, while CIP Security addresses cybersecurity. Designing a safety function to handle communication faults does not remove the need for authentication and encryption. Similarly, an encrypted connection does not replace the machine's functional safety design.

What boundaries do VLANs and firewalls create?

A VLAN logically partitions an Ethernet network. Traffic can still pass between VLANs when routing is enabled. Complement this separation with appropriate firewall and access rules based on the network layers involved. Define which system needs to reach which destination and for which service.

An open port does not prove that a packet is legitimate. Suitable industrial firewalls can inspect protocol content, but inspection of encrypted content depends on the product architecture and where encryption terminates. Defense in depth combines several protective layers.

What does a VPN provide for remote access?

A VPN can establish a protected tunnel between a remote user and the VPN termination point. Do not assume that it automatically protects every subsequent device connection. In plant automation, manage remote access through a controlled gateway or industrial DMZ, using individual accounts, multifactor authentication and time-limited permissions.

Restrict a maintenance provider to the devices and services required by the application. Remove access when the work is complete and record who connected, when and to which destination. Exposing PLC services directly to the internet does not provide controlled remote access.

Managing certificates and legacy devices

Certificate expiration, trusted authorities and device identity belong in the maintenance plan. Establish the manufacturer's procedures for introducing a replacement device and retiring the old identity. Supporting products may provide automated certificate enrollment; do not expect the same management method in every device.

Adding a standard switch does not give a legacy device CIP Security support. A suitable security proxy can extend protection in some systems; identify precisely which communication segment it protects. Also control access to physical connections and ports on any unprotected local segment.

Monitoring, updates and production continuity

During diagnostics, monitor unauthorized configuration changes, failed sessions and certificate errors. Passive analysis tools observe existing traffic but do not automatically reveal encrypted message contents. Device and security management logs therefore matter. Assess the production impact of active scans and traffic-blocking IPS rules before deploying them.

Patch management includes tracking vendor advisories, testing changes and preparing a recovery plan. Measure latency, RPI and packet processing load when enabling security settings. Separately define how outputs and the process should behave if communication is lost.

Field example: why will a replacement drive not connect?

Suppose a replacement drive uses the failed unit's IP address and is visible on the network. A secure connection may still fail because its certificate, trust relationship or security profile differs. Check product and policy compatibility first. The commissioning plan should cover introducing the replacement identity, establishing the necessary trust and removing the retired device's access.

How should you evaluate a support claim?

Ask the manufacturer for the supported security profile, firmware version, management tool and scope of protected communication. Check which product and version a conformance document covers. ISA/IEC 62443 addresses product, system and lifecycle responsibilities. A single protocol capability does not establish compliance for an entire plant. Evaluate the limits of the protection within that scope.