Rockwell Allen-Bradley PLC security: off the internet, RUN keyswitch, port 44818 blocked, firmware, backups

Securing Rockwell Automation (Allen-Bradley) PLCs in a plant starts with a few basics: keep PLCs off the internet, block EtherNet/IP at the edge of the control zone, leave the mode keyswitch in RUN during normal operation, update firmware according to the vendor's security advisories, and keep backups with change detection. This article summarises what Rockwell Automation and CISA publish, and how to apply it in a running plant.

Where the risk is

In May 2024 Rockwell issued notice SD1672: customers should immediately check for devices facing the public internet and remove that connectivity where devices are not designed for it, citing heightened geopolitical tensions and cyber activity. The notice lists related CVEs in Logix controllers, Logix Designer, 1756 communication modules and FactoryTalk.

The clearest example is ICSA-21-056-03 (CVE-2021-22681, CVSS v3 10.0): an unauthenticated attacker could bypass the mechanism Logix Designer uses to verify it is talking to a controller, then change configuration or application code. Affected controllers span ControlLogix, CompactLogix and GuardLogix families from 1768 to 5580. Rockwell determined this vulnerability cannot be mitigated with a patch; the mitigations are network controls, the mode switch and CIP Security.

Without overstating it: in several advisories (for example ICSA-23-193-01 and ICSA-24-214-09) CISA reports no known public exploitation. In each case the attacker must first reach the controller's network.

Layers of protection from the vendor documents

Keep PLCs off the internet

Start with an inventory of every IP device and every path out: the machine builder's 4G modem, a router with port forwarding, a dual-homed engineering laptop, preinstalled remote-control software. The May 2025 fact sheet from CISA, FBI, EPA and DOE puts removing OT connections to the public internet first, followed by changing default passwords. Where disconnection is not yet feasible, SD1672 asks customers to apply Rockwell's security best practices in the meantime.

Do not expose EtherNet/IP outside the control zone

Advisory PN1042 recommends blocking traffic to CIP-based devices from outside the operational zone by blocking or restricting TCP and UDP ports 2222 and 44818 on a firewall or similar security appliance; ICSA-21-056-03 repeats the advice to restrict TCP 44818 from outside the ICS zone. For the other FactoryTalk ports and how to write the rules, see Firewalls for FactoryTalk and Logix systems.

If MES or reporting on the office network needs PLC data, do not open 44818 through the firewall. SECURE-RM001J states that EtherNet/IP control traffic stays in the Industrial Zone and does not traverse the IDMZ; data for the office goes through an intermediate server in the IDMZ, such as a historian replica.

Segmentation: zones and conduits

SECURE-RM001J uses the Converged Plantwide Ethernet (CPwE) architecture, which applies IEC 62443 to group levels into zones: Cell/Area Zone (Levels 0–2) for controllers, I/O and drives; Industrial Zone (Level 3) for SCADA and engineering stations; the IDMZ buffer; and the Enterprise Zone (Levels 4–5).

In practice: one VLAN/subnet per line; per-flow firewall rules between zones; the IDMZ as the only path to the office; AD, DNS and NTP replicated inside the Industrial Zone; and the ability to cut access at the firewall. IEC 62443 security levels need a risk assessment per system.

Controlled remote access

CISA and Rockwell allow remote access under conditions: an up-to-date VPN, multi-factor authentication, role-based access, dormant accounts disabled. For Stratix 4300 with FactoryTalk Remote Access, SECURE-RM001J describes prior device registration, outbound-only connections, two-factor authentication and physical controls for the plant to enable or disable access. CISA notes a VPN is only as secure as the devices connected to it (ICSA-24-214-09). Simple rule: remote access is off by default, enabled only against a work permit.

Mode keyswitch: RUN, REM, PROG

According to the ControlLogix 5580 user manual (1756-UM543), the keyswitch on the front of the controller sets the operating mode:

• RUN: online edits, program downloads and firmware updates are not allowed.
• REM: allows mode changes (Remote Run, Remote Program, Remote Test) and online edits from Logix Designer.
• PROG: Program mode for local work; the controller does not execute the program.

Rockwell recommends RUN with the key removed during normal operation, and REM or PROG only for commissioning, maintenance or program changes. ICSA-21-056-03 and ICSA-24-214-09 both give the RUN position as a mitigation where an update is not yet possible.

Two notes. With the switch in REM, anyone who can reach the network with Logix Designer may be able to change the program; ICSA-21-056-03 lists FactoryTalk Security among the affected products, so it does not close this gap on its own. And the switch governs program edits, downloads and firmware; to limit tag writes from other devices, SECURE-RM001J points to the External Access attribute (set to None by default, open only the minimum) and Constant. Other controller families have different mode switches — check the user manual for the family in use.

CIP Security

CIP Security, based on the ODVA standard, lets EtherNet/IP devices authenticate each other and provides data integrity and encryption. Policies are set in FactoryTalk Policy Manager, workstations connect through FactoryTalk Linx; RSLinx Classic cannot be used. The FactoryTalk Linx help lists minimum firmware, for example ControlLogix 5580 from 32.011 and CompactLogix 5380 from 34.011; the 1756-EN4TR and the 1783-CSP proxy support it at any revision. In ICSA-21-056-03 Rockwell states that CIP Security mitigates the vulnerability.

For ControlLogix 5570 at firmware v31 and later, that advisory gives the option of adding a 1756-EN4TR with CIP Security. Older systems may need hardware changes; fold this into a Rockwell system upgrade plan rather than doing it separately.

Firmware per security advisories

Rockwell's Trust Center filters advisories by product, severity and CISA KEV status, with email alerts. Two examples:

• ICSA-23-193-01 / PN1633: 1756-EN2T, EN2TR, EN3TR and EN4TR modules need specific firmware (11.004 for the newer series such as EN2T Series D, EN2TR Series C and EN3TR Series B; 5.002 for EN4TR; signed 5.029 for older series). Once on signed firmware, you cannot revert to unsigned versions.
• ICSA-24-214-09: a bypass of the ControlLogix 5580 Trusted Slot feature; fixed in V32.016, V33.015, V34.014, V35.011 or later; some older EN2T-family modules have no fix and must move to Series D.

SECURE-RM001J requires downloading firmware only from Rockwell's official portal, verifying digital signatures, and updating with ControlFLASH or ControlFLASH Plus. A controller firmware update means a stop: test first and have a backup. The device list with firmware also feeds a lifecycle review.

Backup and change detection

Where a vulnerability cannot be patched, Rockwell recommends monitoring changes with the Controller Log (v17+), Change Detection in Logix Designer (v20+) or FactoryTalk AssetCentre (ICSA-21-056-03). SECURE-RM001J chapter 6 adds AssetCentre versioning, scheduled backup and compare; component change detection (Logix Designer v30+) for tracked tags, modules and routines; and security events over syslog. For implementation, see FactoryTalk AssetCentre: automatic backup. The CISA fact sheet also calls for routinely testing backups and the ability to operate manually.

Order of work in a running plant

Start with the low-cost layers: inventory and removing internet paths, the firewall, the key in RUN, scheduled backups. Firmware updates go into planned shutdowns; CIP Security and detailed segmentation belong in the upgrade plan.

Network and OT security design: industrial networks and OT security. Need an engineer on site: request support.