Skip to main content
OT Atlas
Search

Access

Engineering Workstation (EWS)

The computer holding engineering software and controller projects — the legitimate path to change control logic.

Critical criticalityLevel 2 – Level 3

What it does

Develops, compares and downloads controller programs, configures devices and performs diagnostics.

Typically locatedEngineering offices, control rooms, sometimes portable laptops taken between sites.

At a glance

PurdueLevel 2 – Level 3
CategoryAccess
Protocolss7comm, profinet-dcp, ethernet-ip, pccc, umas, ads-ams, opc-ua
Talks toPLC, DCS, Safety systems, Version control / project repositories
Common vendorsSiemens (TIA Portal, STEP 7, DIGSI 5), Rockwell Automation (Studio 5000), Schneider Electric (Control Expert, TriStation 1131), ABB (Automation Builder), Emerson

Why should I care?

Engineering Workstation sits at Level 2 – Level 3. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.

Common security problems

  • Internet or email access on the same machine
  • Local admin rights and unmanaged software
  • Roaming laptops that bypass network controls
  • Project files stored without integrity control

If it is compromised

  • Attacker gains an authorised-looking path to change controller logic
  • Project file tampering that propagates to controllers

What to monitor

  • Process execution and new binaries
  • USB insertion
  • Engineering software launches and download events
  • Network destinations reached

How to defend it

  • Dedicated, managed, non-internet-facing build with allow-listing
  • Jump-host mediated access into control zones
  • Project files in version control with change review
  • MFA on engineer identities

Hunting

Hunt ideas for this component

Advanced

Engineering Workstation Compromise

Hunt for signs that an engineering host has been compromised before it is used to change a controller.

Foundational

New Engineering Workstation Appears

Find hosts newly behaving like engineering workstations — running engineering software or speaking programming protocols.

Foundational

Unapproved USB / Removable Media

Identify removable media use on OT hosts, especially engineering and operator systems.

Related

Protocols this component speaks

Vendor-associated

S7 Communication (S7comm / S7comm-plus)

102/TCP

Open / standardized

PROFINET DCP

N/A — layer 2, broadcast within the subnet

Industry consortium

EtherNet/IP

44818/TCP (explicit), 2222/UDP (implicit I/O)

Vendor proprietary

PCCC / CSP

2222/TCP (CSP), 44818/TCP when tunnelled in CIP

Vendor proprietary

UMAS

502/TCP (Modbus function code 90 / 0x5A)

Vendor-associated

Beckhoff ADS/AMS

48898/TCP

Open / standardized

OPC UA

4840/TCP (default)

Sources & further reading