Skip to main content
OT Atlas
Search

Vendor profile

Siemens

S7 controllers on PROFINET cells with ET 200 distributed I/O, Comfort/Unified Panels or WinCC at Level 2, PCS 7 or PCS neo servers and TIA Portal engineering hosts at Level 3, SCALANCE S firewalls enforcing cell boundaries, SINEMA Remote Connect terminating vendor access, and — in utility estates — SICAM RTUs and SIPROTEC relays on a separate IEC 61850 station bus.

PLC / PACHMIDCSSafety controllersSubstation automationDrivesEngineering softwareIndustrial networking

Controllers

SIMATIC S7-1500 / S7-1500TSIMATIC S7-1200SIMATIC S7-300 / S7-400 (legacy, extended support)SIMATIC ET 200SP distributed controllersSIMATIC S7-1500 Software Controller

Safety

SIMATIC S7-1500F / S7-1200F fail-safe CPUsSIMATIC Safety Integrated (PROFIsafe)ET 200SP F-modules

HMI / SCADA

SIMATIC HMI Comfort and Unified PanelsWinCC (TIA Portal / V7)WinCC OAWinCC Unified

DCS / process

SIMATIC PCS 7SIMATIC PCS neoSIMATIC BatchSIMATIC Route Control

Engineering

TIA PortalSTEP 7 / STEP 7 V5.x (classic)SIMATIC ManagerAutomation License ManagerSINEC NMS

Energy / substation

SICAM A8000 RTUsSICAM PAS / PQSSIPROTEC 5 protection relaysDIGSI 5 engineering tool

Drives / motion

SINAMICS drivesSIMOTIONSIMOCODE motor management

Networking / edge

SCALANCE S industrial firewallsSCALANCE X / W switches and wirelessRUGGEDCOM ROX / RSG (utility)SIMATIC Industrial EdgeSINEMA Remote Connect

Defensive considerations

  • Set the CPU protection level (read/write protection) and know-how protection on blocks; S7-1500 also supports per-connection access passwords — legacy S7-300/400 has no equivalent and needs compensating segmentation
  • Restrict 102/TCP (ISO-on-TCP) to named TIA Portal / STEP 7 hosts and the HMI servers that need it; block it outright across the IT/OT boundary
  • Constrain PROFINET DCP to the cell VLAN — DCP is layer-2 and unauthenticated, so anyone on the cell can rename a device or reassign its IP with no credential
  • Alarm on CPU mode changes (RUN → STOP / STOP → RUN) and on any block download; Stuxnet's payload was a block download to an S7-300 and the same command path still exists
  • Keep TIA Portal / STEP 7 project files in version control and run periodic online-versus-offline comparison against the running CPU
  • Enable PROFIsafe monitoring on F-CPUs and alarm on F-program signature or passivation changes — a passivated F-block is a safety event, not a nuisance
  • Harden and patch the engineering and SCADA layer as aggressively as the controllers: many ProductCERT advisories affect TIA Portal, WinCC, PCS 7 and the Automation License Manager rather than the CPU
  • Treat SINEMA Remote Connect as a controlled conduit — named accounts, MFA at the identity provider, session recording, and access enabled only for the duration of the work
  • In substations, baseline SIPROTEC setting groups and DIGSI 5 connections, and isolate the IEC 61850 station bus at layer 2
  • Track the Siemens ProductCERT advisory feed by article number for the exact CPU and firmware in service — advisories are frequently firmware-band specific

At a glance

HeadquartersGermany
Protocolss7comm, profinet, profinet-dcp, profibus, opc-ua, modbus-tcp, iec-61850, goose, mms, iec-60870-5-104
IndustriesManufacturing, Electric Power, Water / Wastewater, Chemical, Pharmaceutical, Transportation

Sources & further reading

This website is an independent educational and defensive cybersecurity resource and is not affiliated with the vendors referenced within it.