PodcastOT & ICS · PLC Security

PLC Logic Changes During Live Production: An OT Pressure Test

A hypothetical production scenario examines what evidence teams need when a PLC program change is flagged and the process still appears stable.

Cybersecurity Under Pressure podcast artworkPodcast episode
Listen here

Listen to the full episode.

Episode guide

Navigate the reasoning, not just the runtime.

Four editorial phases and the conclusions worth carrying into a technical or risk discussion.

Chapters

01
The Technical Breakdown

Compare the authorised change record, engineering access and available controller evidence. An online edit, a compromised workstation and misleading operator views are hypotheses to check.

02
The Operational Decisions

Decide which live checks are safe, who owns the stop decision and what evidence the plant needs before restoring normal operation.

03
The Pressure Test

What could an operator verify independently if the normal engineering workstation or display is in doubt?

04
The Key Takeaways

Normal-looking process readings cannot establish controller logic integrity. Use a trusted baseline and process-safe recovery criteria.

Key takeaways

  1. Keep possible change paths separate from confirmed observations.
  2. Correlate the authorisation record with evidence from the controller and engineering path.
  3. Agree operational authority for continuing, isolating or stopping before an incident.
  4. Test recovery against a known baseline and plant safety criteria.

Editorial chapter map. Timecodes appear only when validated against the published audio; none are inferred from duration or section names.

What this episode examines

A PLC program change is flagged during live production. The process indicators still look normal. The episode uses this hypothetical scenario to examine when the plant has enough evidence to continue, isolate or stop safely.

The Technical Breakdown

Compare the authorised change record, engineering access and available controller evidence. An online edit, a compromised workstation and misleading operator views are hypotheses to check.

The Operational Decisions

Decide which live checks are safe, who owns the stop decision and what evidence the plant needs before restoring normal operation.

The Pressure Test

What could an operator verify independently if the normal engineering workstation or display is in doubt?

The Key Takeaways

Normal-looking process readings cannot establish controller logic integrity. Use a trusted baseline and process-safe recovery criteria.