  Programmable Logic Controllers (PLCs) execute critical control software that
drives Industrial Automation and Control Systems (IACS). PLCs can become easy
targets for cyber-adversaries as they are resource-constrained and are usually
built using legacy, less-capable security measures. Security attacks can
significantly affect system availability, which is an essential requirement for
IACS. We propose a method to make PLC applications more security-aware. Based
on the well-known IEC 61499 function blocks standard for developing IACS
software, our method allows designers to annotate critical parts of an
application during design time. On deployment, these parts of the application
are automatically secured using appropriate security mechanisms to detect and
prevent attacks. We present a summary of availability attacks on distributed
IACS applications that can be mitigated by our proposed method. Security
mechanisms are achieved using IEC 61499 Service-Interface Function Blocks
(SIFBs) embedding Intrusion Detection and Prevention System (IDPS), added to
the application at compile time. This method is more amenable to providing
active security protection from attacks on previously unknown (zero-day)
vulnerabilities. We test our solution on an IEC 61499 application executing on
Wago PFC200 PLCs. Experiments show that we can successfully log and prevent
attacks at the application level as well as help the application to gracefully
degrade into safe mode, subsequently improving availability.
