Why it matters in practice
Within OT and ICS Security, PLC, HMI and Engineering Workstations changes how scope, prerequisites and evidence should be handled. Focus on the concrete asset or data flow under test, record the assumptions that make the condition exploitable and connect verified behavior to an operational consequence and remediation decision.
Primary coverage
- Map who can program, deploy, upload, download or monitor logic.
- Review workstation hardening, removable media practice, vendor tooling and remote access paths.
- Check whether operator interfaces expose more process control than defenders think.
- Treat shared credentials and maintenance laptops as serious trust multipliers.
Assessment focus
For PLC, HMI and Engineering Workstations, document the starting condition, tested action, observable result and any constraint that limited validation. Separate what was proven from what remains inferred, then tie each recommendation to the control boundary described in the evidence.
Selected public references
- CISA ICS ResourcesGeneral ICS security and system-hardening context.
- OpenPLCAccessible PLC context for testing and learning.
- MITRE ATT&CK ICS TechniquesICS technique references for operator and workstation abuse.