Host Engineering Forum
General Category => General Discussion => Topic started by: EliWaldner on October 30, 2024, 04:29:25 PM
-
Good Afternoon. Are there any plans in the future of Do-More to be able to read/write to all address' of Do-More? Instead of only being able to read/write to the MI, MC, MIR and MHR data blocks? This could be seen as a "Feature Request"?
-
Good Afternoon. Are there any plans in the future of Do-More to be able to read/write to all address' of Do-More? Instead of only being able to read/write to the MI, MC, MIR and MHR data blocks? This could be seen as a "Feature Request"?
Sorry, no. Sandboxing is critical to security, particularly with wholly unsecured protocols like Modbus/TCP. It would be less concerning with Modbus/RTU, but there really isn't enough demand there to justify the effort.
-
Thanks for the clear answer. We will need to plan our future projects accordingly. Keep up the great work. Do-More is a great plc!
Thanks again!
-
Thanks for the clear answer. We will need to plan our future projects accordingly. Keep up the great work. Do-More is a great plc!
Thanks again!
On occasion we hear rumors of cases where automation products have been exploited to create situations you see on the news, some specifically related to Modbus. We took those seriously during design and still do any time we hear from CISA. That's why we added the recent encryption upgrades to BRX. There were no user cases reported (just white hat guys looking for vulnerabilities) but we'd like to keep it that way.
-
BRX's security is really undersold.
When tasked with getting email reports out from our air-gapped (mostly click plc) modbus intra-network, I was concerned about security.
I turned to a BRX Do-More with the BX-P-ECOMLT. This POM functions only as a modbus server device; designed to only be written TO, not do it's own reading or writing. I have all the clicks write in their log-data, and once a day the BRX emails me a report.
I'm assuming anything is possible to a motivated hacker, but a limited physical device gives me a some reasurance versus just a software-only solution.
-
I have an application where I've done something similar. I have a main BRX controlling the process with 2 Idec HMIs using Modbus drivers. There is a second BRX with a POM that connects to both control and plant networks. Two different subnets and with an intelligent gateway, I can ensure that nobody writes to any registers in the main control PLC that they shouldn't. The second (firewall/router/gateway) BRX receives commands from the rest of the plant and forwards them to the main.