Limit PLC Access FactoryTalk Security vs Service Edition

bmschedler · Sep 16, 2022

I am trying to evaluate the differences between using FactoryTalk Security and the Service Edition of Rockwell software to limit access to edit PLCs (upload, download, edit tags) for maintenance personnel while allowing them to view code. (RSLogix 500, 5000, Studio 5000)

I understand the best way to limit this is to send maintenance to training and have them fully understand the severity of editing PLCs, but alas I am still being asked to evaluate limiting the ability via engineering controls.

I do not want to limit editability on a PLC by switching the control to RUN as it limits the engineers from having remote access.

After looking at FactoryTalk Security it seems I can granularly select which things each user has in regards to RSLogix 5, 500, and 5000. How does this work though? Does it make it so that whenever a user accesses a license of one of the previous software they must login? It seems that this could be circumvented by locally going online with the PLC.

The Service Edition looks like a good option since you can lock out upload and download, which forces them to get a copy from AssetCentre. It sucks to have to purchase more licenses, but Rockwel.... Can the Service Edition still edit tag values though?

PreLC · Sep 16, 2022

bmschedler said:
I am trying to evaluate the differences between using FactoryTalk Security and the Service Edition of Rockwell software to limit access to edit PLCs (upload, download, edit tags) for maintenance personnel while allowing them to view code. (RSLogix 500, 5000, Studio 5000)

I understand the best way to limit this is to send maintenance to training and have them fully understand the severity of editing PLCs, but alas I am still being asked to evaluate limiting the ability via engineering controls.

I do not want to limit editability on a PLC by switching the control to RUN as it limits the engineers from having remote access.

After looking at FactoryTalk Security it seems I can granularly select which things each user has in regards to RSLogix 5, 500, and 5000. How does this work though? Does it make it so that whenever a user accesses a license of one of the previous software they must login? It seems that this could be circumvented by locally going online with the PLC.

The Service Edition looks like a good option since you can lock out upload and download, which forces them to get a copy from AssetCentre. It sucks to have to purchase more licenses, but Rockwel.... Can the Service Edition still edit tag values though?

Rockwell security is more or less free. Logging the security though happens through FT Assetcenter.

Do you have the following infrastructure?

1)Capability of getting a Windows Server to host a central Factorytalk Directory which individual computers with programming software can connect to?
2)An active directory at your workplace shared by all PCs?

If your answer is Yes to only (1)
-Get a windows server commissioned for your purposes and install the factorytalk services platform on that PC.
Once you have a factorytalk services platform, specify this server as the directory to your PC. Now, you can change policies from the directory which grey-out your RSLogix buttons based on your logged-in usernames. A list of capabilities are here:

Once you have this setup done, go to your PLC, and change this drop down to the server name configured above.

Now your PLCs would force you to be connected to this server if you want to do any operations, and it would limit your operations to your assigned privilege in the server.

bmschedler · Sep 16, 2022

So if you disconnect from the network since the security in the PLC itself has been changed, it won't allow you to do anything to the PLC? What if you connect directly to the PLC via USB or ethernet or serial port?

Does this work with all PLC versions or does this security setting only go back so far? I would imagine it would stop at the SLC-05/05.

PreLC · Sep 17, 2022

If your laptop is offline, there is a cached amount of time that is configurable from the administration console to specify how long before your laptop is disconnected from the directory.
I haven't tried other than ethernet, but I would assume that it has nothing to do with connection protocol, as it's likely verifying a checksum against your PC.

I believe this can also be set to infinite. This is why you see the cache timeout in your "Log on to factorytalk" icon in the system tray.

It works for all RSLogix5,500,5000.
This is because Rockwell PLCs are 21 cfr part 11 compliant, and enforce well built feature control and data logging.

Limit PLC Access FactoryTalk Security vs Service Edition

bmschedler

Member

PreLC

Member

bmschedler

Member

PreLC

Member

Similar Topics