# Security Challenges in Industry 4.0 PLC Systems
## 3 Risk Sources in OT Systems
### Network System Hardware
#### 3.2.3 PLC Controllers  
PLC controllers are one of the basic elements building industrial networks. They are electronic devices equipped with a microprocessor, designed to control the operation of a machine or technological device. A PLC controller is most often equipped with an appropriate number and type of input systems, the task of which is to collect information about the state of the object and operator's requests, as well as an appropriate number and type of output systems, whose task is to set the connected actuators and signaling elements or to handle data transmission. The controller is adapted to a specific control task by means of the introduced operating algorithm, the main feature of which is the cyclicality of the program execution. At the beginning of each cycle, the controller downloads the input states and writes the value data to the appropriate registers in the memory. After executing all the commands and calculating the current state of the outputs, the controller transfers these states to the memory registers responsible for the controller outputs. Companies producing programmable controllers usually provide a programming environment that allows to write applications in one or more programming languages. These languages are usually a more or less precise implementation of the recommendations of IEC 61131-3. As a network device, a PLC can be equipped with a module of data exchanging via the network with other controllers, and receiving or sending information to other devices active in the industrial network. With the knowledge of the structure and the basics of the operation of the PLC controller in a given process control system, it is possible to determine the conditions under which a given controller is connected to the industrial network. This is one of the key steps to identify locations vulnerable to cybersecurity attacks in a given industrial network. Many people dealing with the security of industrial networks do not realize that the process control system is not completely isolated from the connection to the global network or assume that the risk of infection is negligible. It is true that ordinary computer viruses do not interact in any way with PLCs, but cybersecurity events suggest that controllers, such as SCADA systems, are at risk of being hacked even when isolated from the main industrial network with access to the global network. In 2000, in Queensland, Australia, one of the former employees of a sewage treatment plant, using a computer, radio and commercially available software, took control of the -waste management system [81] for two months. His activity resulted in the release of over 800,000 L of untreated sewage into the environment. Another example confirming the importance of PLC security in industrial networks happened at the Davis-Besse nuclear power plant in Ohio, where in 2003 internal security was penetrated by malicious software [82]. As a result of this hacking attack, two important monitoring systems were disabled for almost 15 h. This type of accident in a nuclear power plant is particularly dangerous for human life, and it happened despite the strict rules established by federal law in the United States. In spite of the potentially serious risk of these cases, they were classified as a low-risk group, until 2010. The Stuxnet computer worm, the first known worm used to spy on and reprogram industrial installations has been identified and the topic of cybersecurity of industrial networks has been seriously dealt by PLC manufacturing companies and those responsible for network security. Despite its detectability in well-secured industrial networks, Stuxnet poses a serious threat as it opens the way for potential hackers to create new malware from its code to rebuild the algorithm in PLCs. Since 2010, many PLC manufacturers, such as Hitachi, Mitsubishi, Panasonic, Samsung and Siemens, have been working with antivirus software vendors (such as Kaspersky or Symantec) to find solutions to gaps and inefficiencies in PLC systems.