Skip to content
EDWartens UK

Free course · Cybersecurity

Cybersecurity for PLC Programmers: Hardening Siemens and Rockwell Controllers

Harden the PLCs you already program: Siemens access levels, know-how, copy and project protection, secure communication and users, Rockwell source protection, CIP Security and zones, and the Top 20 Secure PLC Coding Practices, from the people who wrote them.

See the modules

Free to learn. Verifiable certificate £19 when you pass the final exam (optional, VAT included).

Level
Intermediate
Modules
9
Video
8 hours
Price
Free

Outcome

What you will be able to do

Explain how controllers are attacked and which controls break each step; set Siemens access levels, know-how, copy and project protection and the security wizard settings; configure secure communication, users and the web server; apply Rockwell source protection, CIP Security and zones; review PLC code against the Top 20 Secure PLC Coding Practices; and use the controller's own diagnostics to detect changes nobody planned.

  • Explain how controllers are attacked and which controls break each step
  • Set Siemens access levels and use the TIA Portal security wizard
  • Apply know-how, write, copy and project protection
  • Secure users, certificates, the web server and HMI logins
  • Use Rockwell's key switch, source protection, CIP Security and zones
  • Apply the Top 20 Secure PLC Coding Practices in your own code
  • Detect unplanned changes from cycle time, memory, stops and uptime
  • Write and verify a secure configuration baseline for a mixed Siemens and Rockwell line

Software

TIA Portal (trial) with PLCSIM, and Studio 5000 if you have access. Every exercise can be done with one vendor's software.

Hardware

None required. A spare S7-1200 or CompactLogix makes the hardening exercises more real.

Syllabus

9 modules

Each module has video lessons, notes and a short quiz. The final exam closes the course.

  1. 1Why PLCs get attacked2 lessonsLab
  2. 2Secure coding and device integrity: the ideas2 lessons
  3. 3Siemens: access protection and the security wizard3 lessons
  4. 4Siemens: know-how, copy and project protection4 lessons
  5. 5Users, certificates and the web server4 lessons
  6. 6Rockwell: source protection, CIP Security, zones and conduits6 lessonsLab
  7. 7The Top 20 Secure PLC Coding Practices1 lesson
  8. 8Using the controller's own features to detect trouble1 lessonLab
  9. 9Final Assessment1 lesson

How it works

How this course works

  1. Watch the video lessonsOne module at a time, at your own pace.
  2. Take the module quizA short quiz at the end of each module shows what stuck.
  3. Keep your notesWrite in My notes beside each module and ask the trainer if you are stuck.
  4. Practise in the labOptionalTry a task from the module in the EDWartens Lab, in your browser.
  5. Sit the final examPass it once you have been through the modules.
  6. Certificate, if you want oneOptionalPaid, and only after you pass. Anyone can check it online.

EDWartens Lab

Practise this in the EDWartens Lab

Map a plant network, find the odd device and set deny-by-default firewall rules in the Lab's OT security simulator.

Works alongside Cybersecurity for PLC Programmers: Hardening Siemens and Rockwell Controllers. The Lab is ot security practice in your browser: no install, no hardware, free to use. Sign in as a learner and it opens with your account.

Open the free lab See the Lab
OT security: Defend a plant network.

Levels to try with this course

Optional. Skip it whenever you like: it never blocks your progress or your certificate.

Why practise in a lab

Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.

  • Practise safely, so a mistake costs nothing.
  • The lab checks your work like a site test, so you know when it is right.
  • Free, in your browser, with nothing to install.

Certificate

An optional certificate when you pass

Learning is free. Pass the final exam and you can have a certificate for £19, including VAT, with a number employers can check online. It records that you completed a free online course; it is not a regulated qualification or a CPD certificate.

  • Your name, the course, its study time and your final exam score
  • A unique certificate number and a QR code to its verification page
  • Issued by Wartens Ltd; add it to your LinkedIn profile in one click
  • Pay now or after you pass: it is issued the moment you pass the final

How the certificate works

Sample certificate for Cybersecurity for PLC Programmers: Hardening Siemens and Rockwell Controllers

Credits

Who made the lessons

The video lessons belong to their creators. EDWartens wrote the study plan, notes, quizzes and the final exam.

  • Mike Holcomb

    lessons on what OT is and the OT security career path

  • ICS Village

    the Top 20 Secure PLC Coding Practices talk by Sarah Fluchs and Vivek Ponnada

  • (CS)²AI

    Vivek Ponnada's introduction to the Top 20 Secure PLC Coding Practices

  • AppSec Pacific Northwest

    Vivek Ponnada on secure coding of industrial control systems

  • GRIMM Cyber

    Vivek Ponnada on using native ICS functionality to improve security

  • S4 Events

    the talk on PLC and Level 1 device integrity

  • Siemens Knowledge Hub

    S7-1500 intellectual property protection

  • Rockwell Automation

    FactoryTalk Security, source protection, CIP Security and FactoryTalk Policy Manager zones and conduits

  • Hegamurl

    TIA Portal password, block, copy, project and web server protection

  • Outlier Automation

    user management with UMC and TLS certificates in TIA Portal

  • EandM

    a lesson in "Siemens: access protection and the security wizard"

  • PLC SCADA ENGINEER

    a lesson in "Siemens: access protection and the security wizard"

  • Tim Wilborne

    a lesson in "Rockwell: source protection, CIP Security, zones and conduits"

Questions

About this course

Is this a hacking course?
No. It teaches PLC programmers to protect the controllers they are responsible for. There are no techniques for breaking into equipment, and the course deliberately leaves out password-unlocking tools.
How is it different from OT and ICS Cybersecurity with IEC 62443?
That course covers the standard and the security programme. This one is hands-on for PLC programmers: the protection settings in TIA Portal and Studio 5000, and secure coding in the logic itself. They complement each other.
Do I need both Siemens and Rockwell software?
No. Most exercises use TIA Portal with PLCSIM; the Rockwell module can be followed from its lessons and documentation if you do not have Studio 5000.
Where do the Top 20 Secure PLC Coding Practices come from?
A community project led by Sarah Fluchs and Vivek Ponnada, published in 2021 and freely available. The course uses their own talks, credited on the module, and none of the authors is affiliated with EDWartens.
Is the course really free?
Yes. Every module, the notes, the project and the final assessment. The only paid item is the certificate, if you want it.
What certificate do I get?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a number anyone can verify on our site. It is not a vendor or ISA/GIAC certification.
How long does it take?
About 8 hours of lessons and reading, plus about 10 hours for the project. At a few hours a week alongside work, that is two to three weeks.
Does it prepare me for CompTIA SecOT+ or GICSP?
Not directly. Those exams cover OT security broadly; this course goes deep on one part of it, the controller and its code. It is a useful practical companion, and EDWartens is not affiliated with CompTIA or GIAC.

The Professional Module is five live days of Siemens PLC, HMI and SCADA with an instructor, then a resume session and a CPD certificate.

See the Professional Module