Skip to main content
OT Atlas
Search

Vendor profile

Rockwell Automation

Logix controllers on EtherNet/IP cell networks with Stratix switches, FactoryTalk servers (View SE, Historian, AssetCentre) at Level 3, Studio 5000 engineering hosts, and CIP Safety carrying machine-safety functions over the same physical media as standard control traffic.

PLC / PACHMISafety controllersDrivesIndustrial networkingMES software

Controllers

ControlLogix 5580CompactLogix 5380 / 5480GuardLogix 5580 (SIL 3 safety)Micro800SLC 500 / PLC-5 / MicroLogix (legacy, end of life)

HMI / Visualization

PanelView Plus 7PanelView 5000FactoryTalk View SE (distributed)FactoryTalk View ME

Software

Studio 5000 Logix DesignerFactoryTalk AssetCentreFactoryTalk Linx / Linx GatewayFactoryTalk HistorianFactoryTalk Policy Manager (CIP Security)Plex and Fiix (cloud)

Drives / Motion

PowerFlex 525 / 755Kinetix servo drivesArmorStart distributed motor control

Networking

Stratix switches (Cisco-based)1756-EN2TR / EN4TR communication modules

Defensive considerations

  • Set the controller keyswitch to RUN outside change windows and alarm on any mode change — CIP mode change is an unauthenticated command on legacy paths
  • Enable Logix change detection (audit value and change counters) and trend it; a changing audit value with no work order is a high-confidence signal
  • Use FactoryTalk AssetCentre to hold known-good ACD projects and schedule automated controller-to-baseline comparison
  • Restrict 44818/TCP and 2222/UDP to named engineering hosts and HMI servers at the cell boundary; block them at the IT/OT boundary entirely
  • Watch for PCCC commands tunnelled inside CIP — port-only rules on 2222/TCP miss them
  • Deploy CIP Security (FactoryTalk Policy Manager) on controllers and modules that support it, starting with the engineering-to-controller conduit
  • Segment CIP Safety traffic and alarm on safety-task signature changes in GuardLogix
  • Track the FactoryTalk Services Platform and Studio 5000 patch level — several advisories affect the engineering software rather than the controller
  • Inventory remaining SLC 500 / PLC-5 / MicroLogix units: they have no fix path and need compensating segmentation

At a glance

HeadquartersUnited States (Milwaukee, Wisconsin)
Protocolsethernet-ip, cip, cip-safety, pccc, devicenet, modbus-tcp, opc-ua
IndustriesManufacturing, Food & Beverage, Automotive, Water / Wastewater, Life Sciences

Sources & further reading

This website is an independent educational and defensive cybersecurity resource and is not affiliated with the vendors referenced within it.