Top 20 Secure PLC Coding Practices

Official account of the Top 20 Secure PLC Coding Practices Project.
Maintained by @SarahFluchs, @ControlsCyber and @JoshuaRuff17

[Top 20 Secure PLC Coding Practices @securePLC]

Secure Coding Practices don't exist for PLCs?
Thing of the past!

Today is the launch day of the Top 20 Secure PLC Programming Practices.
It contains distilled wisdom of hundreds of PLC programmers, engineers, and security experts.

Download:
https://t.co/7IKeJAh39P

[Arnaud SOULLIÉ @arnaudsoullie]

My workshop at @brucon is about to start!

[Top 20 Secure PLC Coding Practices @securePLC]

New use cases for Siemens and Grantek are up for and available for download. These use cases are helpful for referencing which practices your peers are implementing.

https://t.co/rtZ56Ew6ku

[Top 20 Secure PLC Coding Practices @securePLC]

@dietersar @PatrickCMiller @bengoerz @brysonbort @BEERISAC @chrissistrunk @ICS_SCADA @icscybernz @jfslowik @ControlsCyber @shipulin_anton @hacks4pancakes @magg_py @Marmusha @ics_Marty @R1ngZer0 @arnaudsoullie @M_Vingaard @montaelkins @DreamFighter22 @lvandenaweele Thank you for spreading the word 🙏🏽

[Claudio Caracciolo @holesec]

Muy buen post de @SarahFluchs respecto a qué es y qué no es el proyecto Top20 Secure PLC Coding Practices, y algunos detalles sobre lo que sucedió desde que salió a la luz:
https://t.co/2QuUai2f44

Vale la pena recordar que desde @info_CCI colaboramos en la versión en Español

[Top 20 Secure PLC Coding Practices @securePLC]

Starting to apply the Top 20 secure PLC coding practices does not need to be a daunting task. Integrating secure coding into your cybersecurity practice will take some time to align the culture. A sample vendor policy example is now available for download. https://t.co/7YlRonlaeW

[Sarah Fluchs @SarahFluchs]

One year since the Top 20 @securePLC Coding Practices have been published! It's a good time to clarify a few things: What the Top 20 are, what they are not, and what you should do with them (as an asset owner, integrator, or vendor).

https://t.co/qfVv4RWwG3

[Arnaud SOULLIÉ @arnaudsoullie]

Just discovered there is a graphic recording of my talk on PLC code security at the SANS ICS Summit, thanks @MindsEyeCCF & @SANSICS !

[Arnaud SOULLIÉ @arnaudsoullie]

…and a brand new one focused on the Top 20 Secure PLC Coding Practices (👋 @securePLC ) on Friday afternoon https://t.co/jzYGlMsR72 & https://t.co/epNDRyJ53A

[Sarah Fluchs @SarahFluchs]

If we understand (ICS) security by design as integrating security into an existing engineering workflow, I expected us to end up with.....some new kind of workflow.

Well...we didn't. Here's a first intro to our security by design decisions approach.

https://t.co/GAnnCmPRjU

[Top 20 Secure PLC Coding Practices @securePLC]

The German translation of the Top20 Secure PLC Coding Practices is now available!

[Martin Scheu @martin_scheu]

Mit dem Abschluss des ctrlX Entwickler-Wettbewerbs von @BoschRexroth ist nun auch die deutsche Übersetzung der SPS Programmier Praktiken zur Erhöhung der Cybersicherheit auf https://t.co/GGMqFqD2uj verfügbar. Besten Dank @SarahFluchs und @securePLC! #ctrlxautomation

[Top 20 Secure PLC Coding Practices @securePLC]

GRANTEK's application use case can be downloaded here: https://t.co/1sGoaFdu0l

And there's also an application note template free to use for anyone on our website:
https://t.co/t4Cb8hQrkQ

[Top 20 Secure PLC Coding Practices @securePLC]

Many of our Secure PLC Coding Practices cannot be implemented by operators. So we've been working with integrators and vendors who want to share how they implement the Top 20 in "application notes".

GRANTEK is the very first integrator to share their approach. Applause! 🥳🥳

[Sarah Fluchs @SarahFluchs]

That's a big milestone we've been working towards. It's been difficult to get vendors and integrators to join the conversation on PLC security. I hope many others will follow GRANTEK's example. Asset owners will love you for being transparent about PLC security, I promise!

[Arnaud SOULLIÉ @arnaudsoullie]

PLC TOP20 training is on at #S4x22 with Vivek & Josh !
Let's spread the best practices

[Top 20 Secure PLC Coding Practices @securePLC]

The Top 20 Secure PLC Coding Practices are now available in Spanish!Don't you agree that "Prácticas seguras de codificación de PLC" sounds way more elegant? ❤️🇪🇸
Thanks to CENTRO DE CIBERSEGURIDAD INDUSTRIAL for the translation!

https://t.co/PNtfYIDHUD

[Sarah Fluchs @SarahFluchs]

In 2020, @scadateer said about secure PLC programming at @S4xNews: "Nobody learns this at school."

2 years later, here's proof of @A_Valencia_Gil teaching the Top 20 @securePLC coding practices. At school. Yay! 🥳

[Top 20 Secure PLC Coding Practices @securePLC]

Top 20 in Turkish! 🤗🇹🇷

[Can Demirel @secandit]

We are happy to contribute both community driven projects and teach that topics our future colleagues at universities!
@securePLC @Cyberwise_TR