Endpoints
Engineering Workstation Protection
Treat engineering hosts as the highest-value endpoints in the environment.
Defensive guide
Why should I care?
They provide the legitimate, supported path to change controller logic.
How to implement it
- Dedicated, managed builds with no email or general browsing
- Application allow-listing where the vendor supports it
- Project files under version control with review
- Access into control zones only through a jump host
What good looks like
- A short, known application inventory
- Predictable network peers
- Every download traceable to an engineer
Common failure modes
- Engineering laptops used as general-purpose machines
- Local admin for everyone
- Projects stored on personal drives
How to verify it
- Compare running software against the approved list
- Confirm project file history is intact