On August 19, CISA, FBI and NSA issued a new warning concerning an active cyber threat targeting Siemens S7 PLCs.

The warning follows recent cyber incidents involving internet-facing Rockwell Automation/Allen-Bradley PLCs at US water and wastewater utilities.

At first glance, these may look like two product-specific stories.

The more important lesson is broader.

It is not only about the PLC manufacturer

During the July incidents, attackers remotely accessed internet-facing Rockwell/Allen-Bradley MicroLogix PLCs and changed device configurations, including IP addresses and passwords.

This resulted in loss of monitoring and, in some cases, loss of control of connected equipment. Reported operational consequences included loss of water pressure and flooding.

The FBI also made clear that although the observed activity involved Rockwell PLCs, similar security considerations should be applied to PLCs from other manufacturers.

The subsequent warning concerning Siemens S7 systems reinforces that broader point.

The key question is not only which PLC is installed. It is how the entire OT environment surrounding it is protected.

Multiple weaknesses can exist at the same time

Research following the Rockwell incidents identified 4,407 internet-facing Rockwell/Allen-Bradley controllers worldwide.

Among 22 exposed controllers examined in locations already affected by the campaign, 19 were running firmware vulnerable to a known security flaw dating back to 2017.

There is no evidence that this vulnerability was the route used to compromise those devices.

But it illustrates an important OT security principle:

Multiple weaknesses can exist simultaneously.

A PLC may be externally accessible while also running outdated firmware. Network segmentation may be insufficient. Remote access may be too broad. Monitoring may be limited.

Each weakness matters. Combined, they increase the overall exposure.

Resilience requires multiple security barriers

OT security should therefore not depend on one firewall, one password or one secure remote access solution.

Multiple barriers need to be built throughout the environment so that one weakness does not automatically provide access to the critical process.

Secure remote access

Remote access is essential in many modern OT environments, but PLCs and other critical devices should not be directly exposed to the public internet.

Access should be controlled, authenticated, monitored and restricted to what is operationally required.

Network segmentation

Compromising one device should not automatically provide access to the rest of the OT environment.

Segmentation, firewalls and clearly defined communication paths can limit movement between systems and reduce the potential impact of an incident.

Access control

Users, suppliers and systems should only have the permissions they genuinely require.

Strong authentication, clearly defined roles and controlled access reduce the number of potential entry points.

Firmware and patch management

The earlier Rockwell incidents also highlight the importance of structured firmware and patch management.

OT systems cannot always be updated in the same way as traditional IT systems. Changes often require testing and careful planning around operations and compatibility.

However, known vulnerabilities still need to be identified, assessed and managed systematically.

Logging and monitoring

If unusual activity occurs in the OT environment, organisations need the ability to detect and investigate it.

Access, configuration changes and relevant system activity should therefore be logged and monitored.

Backup and recovery

Backup is about more than simply having a copy.

PLC programs, configurations and critical system data should be available in known and verified versions, with clear procedures for safe recovery.

OT cybersecurity is also operational resilience

The difference between traditional IT and OT becomes clear when something goes wrong.

A compromised PLC, lost communication or an unavailable SCADA system can directly affect the physical process.

Cybersecurity should therefore not be treated as a separate IT project.

It should be an integrated part of the design, operation and maintenance of the OT environment.

How Frontmatec can help

At Frontmatec, we work across the complete OT environment, from PLC and automation systems to SCADA, industrial networks, server infrastructure and remote access.

This enables us to consider cybersecurity in the context of the physical process the technology is there to support.

We can help organisations:

• map OT environments and potential access paths
• review remote access and external connections
• assess and improve network segmentation
• strengthen access control and authentication
• review firmware and patch levels
• establish or improve logging and monitoring
• strengthen backup and recovery procedures
• identify and prioritise relevant security improvements

The objective is not to depend on one product or one security measure.

The objective is to build multiple barriers throughout the OT environment so that one weakness does not automatically become a serious operational problem.

How robust is your OT environment?

The latest Siemens S7 warning and the earlier Rockwell incidents demonstrate that the challenge extends across PLC manufacturers.

The relevant question is therefore:

How well is your complete OT environment protected if someone attempts to gain access?

Frontmatec can help review your current setup and identify where security and operational resilience can be strengthened.