How vulnerable are legacy PLC systems to modern cyber attacks?

 

INSANELY vulnerable. Not even kind of kidding, and it is SCARY.

And you may be thinking in terms of cloud connections and remote access....

While those are risks, legacy PLCs are essentially open doorways to our world's most critical infrastructure.

If you have not already, please look into "Stuxnet".

It was the first computer virus that could manipulate something in the physical world, was specifically designed to find one specific type of Siemens PLC, and is reportedly still sitting dormant in most control systems to this day.....

 

Agree that legacy PLCs are a real concern. Most were designed for closed networks, with no authentication on programming or write commands. I would push back a little on Stuxnet still sitting dormant in most control systems, though. It was highly targeted, and the realistic risk today is more mundane: flat networks, shared engineering credentials, exposed or unmanaged remote access, and no visibility into who downloads logic to which controller.

Practical first steps for an existing site, without replacing hardware:

1. Asset inventory: every PLC, HMI and engineering workstation, with firmware versions and how each one is reached.
2. Segmentation: put the control network in its own zone and force all remote/vendor access through one monitored conduit (jump host, MFA, session logging).
3. Use what the controller already offers: keyswitch in RUN, write protection or passwords on program changes where supported.
4. Monitoring: log engineering activity (logic downloads, mode changes, firmware updates) so an unexpected change is noticed.

Those four steps cover a large share of the real-world risk on legacy systems.