PROFINET and PROFIBUS Security: Classes 1 to 3 Explained

PROFINET and PROFIBUS carry the I/O, drive and safety traffic of a large share of European discrete manufacturing, and in most installed plants neither protocol authenticates the devices or messages it carries. Any station that can reach a PROFINET segment can usually discover devices, rename them, change their IP settings and read cyclic process data, and PROFIBUS has no security mechanism at all. PROFIBUS and PROFINET International (PI) has defined three PROFINET Security Classes that add signing, integrity and encryption, but adoption depends on new controllers, devices and engineering tools. This guide explains what the classes actually provide, how to protect legacy PROFINET and PROFIBUS networks today, how to plan a move to secure application relations, and how to monitor the traffic. It is written for OT security engineers, control system integrators and plant network teams; controller hardening itself is covered in the PLC Security Guide.

Key takeaways

Legacy PROFINET trusts the wire. Discovery and Configuration Protocol (DCP), cyclic real-time I/O and record data were designed without authentication, so network position is the only control in most plants.
Security Class 1 is hygiene, not cryptography. It improves SNMP and DCP configuration options and makes signed GSD files mandatory, but it adds no cryptographic protection to protocol exchanges.
Classes 2 and 3 bring secure application relations. Endpoints authenticate with IEEE 802.1AR certificates and protect traffic with AES-256-GCM; Class 3 adds confidentiality for cyclic real-time data.
PROFIBUS has to be protected from outside. There is no secure PROFIBUS variant, so protect the PROFINET or Ethernet gateway, the engineering station and physical access to the bus.
Certificates are a new operational burden. Secure PROFINET needs owner-issued device certificates (LDevIDs), a Security Infrastructure Handler and a renewal process; plan the identity lifecycle before you buy Class 2 or 3 equipment.

How PROFINET and PROFIBUS work, and where they are exposed

PROFINET is a family of Ethernet-based protocols specified by PI and standardised in IEC 61158-5-10 and IEC 61158-6-10. PROFIBUS DP and PA are older serial fieldbuses (RS-485 and the intrinsically safe MBP physical layer for process automation) that are still common below PROFINET in many plants, often connected through a proxy or gateway. The exposure differs by protocol component.

Component	What it does	Legacy security property	Typical abuse to defend against
DCP (Discovery and Configuration Protocol)	Layer 2 identify, set station name, set IP address, reset to factory	No authentication on legacy devices	Renaming or re-addressing a device so the controller loses its I/O; reconnaissance of the whole segment
PROFINET RT and IRT (cyclic I/O)	Real-time input and output data between IO controller and IO devices, EtherType 0x8892	No integrity or confidentiality protection	Sniffing process values; injecting or replaying frames from a station on the same segment
Context management and record data (DCE/RPC over UDP)	Connection set-up (application relations), parameterisation, diagnostics	No authentication of the peer	Unauthorised parameter changes and reading device configuration
Alarms	Diagnostic and process alarms from devices	No integrity protection	Suppressing or spoofing alarms that operators rely on
SNMP and LLDP	Topology discovery and diagnostics, used by engineering tools	Often SNMPv1/v2c with default community strings	Topology mapping, configuration reads and, where write is enabled, changes
PROFIBUS DP and PA	Cyclic master to slave exchange on a serial bus	No authentication, integrity or encryption	Anyone with physical bus access or control of the master can read and write

The relevant MITRE ATT&CK for ICS techniques are Remote System Discovery (T0846), Network Sniffing (T0842), Adversary-in-the-Middle (T0830), Modify Parameter (T0836), Denial of Service (T0814) and Denial of Control (T0813). Most of them require the attacker to already be on the cell network, which is why segmentation and access to engineering stations dominate the defence of legacy installations. See the MITRE ATT&CK for ICS Guide.

The three PROFINET Security Classes explained

PI's security extensions are organised into three hierarchical classes, and a higher class includes the capabilities of the lower ones. The descriptions below come from papers published by members of the PI working group CB/PG10 (PROFINET Security) and PI's own security pages; check the current PROFINET specification for the definitive text, because transfer of the extensions into IEC 61158 was still in progress when those papers were written.

Capability	Security Class 1	Security Class 2	Security Class 3
Signed GSD file (GSDX)	Mandatory	Mandatory	Mandatory
Improved DCP and SNMP configuration options	Yes	Yes	Yes
Cryptographic protection of protocol exchanges	None	Secure application relations (ARs)	Secure ARs
Record data (parameters, diagnostics)	Unprotected	Integrity and confidentiality	Integrity and confidentiality
Cyclic IO data	Unprotected	Integrity only	Integrity and confidentiality
Alarms	Unprotected	Integrity (confidentiality not settled in the published table)	Integrity and confidentiality
Mutual endpoint authentication	No	Yes, certificates	Yes, certificates

How secure application relations work

Authentication and key establishment: endpoints authenticate each other with public-key certificates before relevant communication starts. Key establishment uses TLS wrapped in EAP (EAP-TLS, as used in IEEE 802.1X); TLS is used only for the handshake, not for the bulk data.
Bulk protection: traffic in a secure AR is protected with AES using 256-bit keys in GCM mode, in either integrity-only or integrity-and-confidentiality mode, with periodic rekeying designed to keep the channel available during key changes.
Certificates: device certificates follow IEEE 802.1AR, with elliptic curve keys (Curve25519, Curve448, NIST P-256 or P-521). The manufacturer's IDevID is for initial set-up only; operational protection uses owner-issued LDevIDs.
Security Mode: each Class 2 or 3 component has a persistent Security Mode of ANY or PROTECTED. In PROTECTED mode it accepts only secure ARs. Secure and plain ARs can coexist in one network and even on one endpoint, which is what makes a gradual migration possible.
Security Infrastructure Handler (SIH): the role that manages security configuration, certificates, keys and trust anchors, normally hosted on the IO controller and sometimes in engineering or diagnostic tools, using an integrated or external certificate authority.

What the classes do not cover matters as much. The CB/PG10 authors list interfaces that are not PROFINET (for example the engineering station to controller connection) and human user authentication as out of scope. A Class 3 cell with an unprotected engineering workstation is still a soft target. The cryptography of the classes also aligns with IEC 62443-4-2 component requirements for communication integrity, and PI states it is working with TUV Sud on that alignment, but a class is not the same thing as a 62443 security level.

Choosing a class: decision guidance

PI's pages describe security as a configuration option that must not disrupt production, and the CB/PG10 paper tells operators to weigh confidentiality against cycle time and diagnostic needs. Use the following as a starting point.

Situation	Recommended target	Reasoning
Brownfield cell, devices with no security class	Segmentation, DCP and SNMP hardening, monitoring	No cryptographic option exists; reduce who can reach the segment
New cell, standard machine control, data not sensitive	Class 1 minimum, Class 2 where controllers and devices support it	Integrity of I/O and authenticated endpoints stop injection; confidentiality of I/O adds little
Cells exposed to shared or third-party networks (Ethernet-APL field networks, multi-vendor skids)	Class 2 in PROTECTED mode	Authenticated ARs stop rogue stations that the network cannot keep out
Process values or recipes that are commercially sensitive, or wireless segments	Class 3	Confidentiality of cyclic data, at the cost of more processing and harder troubleshooting
Safety functions (PROFIsafe)	Keep PROFIsafe and add Class 2 or 3	PROFIsafe protects against random faults, not deliberate manipulation; the two are complementary

Small sites: a single managed switch with port security, a firewall between the cell and the office network and disabled DCP write from the office side gives most of the benefit. Do not deploy Class 2 without a plan for certificate renewal.
Large sites: standardise the SIH and certificate authority design across lines, decide whether certificates come from an OT PKI or the corporate PKI, and specify the security class in procurement. See the OT Product Procurement Guide.
Troubleshooting trade-off: encrypted cyclic data cannot be read by passive diagnostic taps. Agree with maintenance how they will diagnose a Class 3 cell before you enable it.

Protecting legacy PROFINET and PROFIBUS today

Most plants will run unprotected PROFINET and PROFIBUS for years. PI and its partners (FieldComm Group, ODVA and the OPC Foundation) published a joint risk-based paper on securely deploying legacy industrial protocols that lack authentication and integrity, which reflects the same principle: put the protection in the architecture.

Cell and area zones: place each PROFINET IO system in its own zone with a conduit to supervisory systems. PROFINET RT is Layer 2 and not routable, so it should never need to cross the zone boundary; only DCE/RPC, OPC UA or historian traffic should. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Block DCP across boundaries: DCP is Layer 2 multicast. Keep it inside the cell VLAN, and where devices support it, lock station name and IP settings so DCP Set is refused during operation.
Harden SNMP: change default community strings, disable SNMP write, and move to SNMPv3 where the devices and engineering tools support it.
Switch port controls: disable unused ports, use MAC-based port security on access ports, and protect the media redundancy ring (MRP) ports from casual patching. A laptop on a free port is the most common path onto a cell network.
Engineering stations and gateways: the station that runs the engineering tool, and any PROFIBUS gateway or PN/PN coupler, is the real control point. Harden it, restrict who logs on, and keep project files under change control.
PROFIBUS: physical security of cabinets and bus connectors, a locked master configuration, and monitoring of the upstream Ethernet side. There is no network control that authenticates PROFIBUS frames.
Signed GSD files: import only GSD files from the manufacturer or PI's product finder, and prefer signed GSDX files where the engineering tool verifies them. PI issues GSD signing certificates to members for three years.

Where identity fits

Secure PROFINET turns every IO device and controller into a machine identity with a certificate, a private key and an expiry date. That changes the operating model of the plant.

IDevID versus LDevID: the manufacturer's IDevID proves where the device came from. The owner's LDevID binds the device to your plant and is what secure ARs should rely on. Record both in the asset inventory.
Trust anchors: decide which CA the SIH trusts, protect the CA key as a privileged credential, and avoid a single plant-wide CA whose compromise would let an attacker enrol rogue devices everywhere.
Renewal and replacement: plan certificate expiry so a line does not stop because a certificate lapsed, and define how a replacement device is enrolled at 3am by a maintenance technician.
Engineering accounts: human and service accounts on engineering stations remain outside PROFINET Security. Control them as privileged access. See the Identity for OT Environments Guide and the IoT Device Identity with TPM and DICE Guide.

Detection and monitoring

A passive monitoring sensor on a SPAN or tap port in each cell can decode PROFINET and learn normal behaviour, because cyclic traffic is extremely regular. See the OT Network Security Monitoring Guide.

Signal	Why it matters	ATT&CK for ICS
DCP Set (name, IP, factory reset) outside a maintenance window	Can disconnect a device from its controller	T0836, T0813
DCP Identify All from a station that is not an engineering tool	Segment reconnaissance	T0846
New MAC address or new IO controller in the cell	Rogue station or misconnected laptop	T0842, T0830
Write record requests from unexpected hosts	Parameter changes to drives or I/O	T0836
Bursts of frames or broken cyclic timing, AR aborts	Possible flooding or interference	T0814
SNMP set requests or default community use	Configuration change or reconnaissance	T0888
Plain ARs to a device that should be in PROTECTED mode	Downgrade or misconfiguration during migration	T0830

Metrics that show it is working

Cell isolation: percentage of PROFINET IO systems with a documented zone and no Layer 2 path to the office network.
Monitoring coverage: percentage of cells with a passive sensor and a learned baseline.
Unplanned DCP Set events: count per month, each traced to a work order or investigated.
SNMP hygiene: percentage of switches and devices with default communities removed and write disabled.
Secure AR adoption: percentage of new or refurbished cells running Class 2 or 3 in PROTECTED mode.
Certificate health: device certificates expiring within 60 days without a scheduled renewal.

Implementation roadmap

Inventory: list every IO controller, IO device, switch, gateway and engineering station per cell, with firmware and security class support. Use passive discovery first; active DCP scans can disturb older devices. See the OT Asset Visibility Guide.
Zone the cells: define the conduit for each cell, put a firewall or Layer 3 boundary between the cell and supervisory networks, and test in a maintenance window with a rollback plan (keep the previous switch and firewall configurations ready to restore).
Harden in place: SNMP, unused ports, DCP locks and engineering station access. Apply one cell at a time and watch for lost connections.
Monitor: deploy passive sensors, learn the baseline, then tune alerts for the signals above.
Specify security in procurement: require signed GSDX files, the PROFINET security class and IEC 62443-4-2 evidence for new equipment.
Pilot Class 2: on a test bench or a non-critical line, build the SIH and CA design, measure cycle time impact, run in Security Mode ANY with secure ARs, then switch to PROTECTED. Rollback is setting the mode back to ANY, which should be a documented and rehearsed change.
Scale and operate: roll out to new lines, monitor certificate expiry and track the metrics.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	Other
Cell zoning and conduits	SC-7 Boundary Protection	PR.IR-01	IEC 62443-3-2 zones and conduits; ISO/IEC 27001:2022 A.8.22
Secure ARs (integrity, confidentiality)	SC-8, SC-13	PR.DS-02	IEC 62443-4-2 communication integrity
Device certificates	IA-3 Device Identification and Authentication	PR.AA-03	IEEE 802.1AR
Signed GSD files	CM-14 Signed Components, SR-11	PR.PS-01	PI GSD signing
DCP and SNMP hardening	CM-6, CM-7	PR.PS-01	CIS Controls v8.1 Control 12
Passive monitoring	SI-4 System Monitoring	DE.CM-01	CIS Controls v8.1 Control 13
Inventory	CM-8	ID.AM-01	NIST SP 800-82 Rev. 3

Common failure patterns

Flat plant networks: PROFINET cells on the same Layer 2 domain as office PCs or the MES, so DCP and cyclic traffic are reachable from any compromised workstation. The Jaguar Land Rover cyberattack stopped production for more than five weeks after a defensive shutdown of systems, without any published evidence of controller compromise; how well plant networks are isolated decides whether lines can keep running or restart safely.
Assuming a security class equals security: buying Class 1 devices and believing traffic is protected, when Class 1 adds no cryptography.
Leaving secure devices in ANY mode: deploying Class 2 equipment but never switching to PROTECTED, so plain ARs are still accepted.
Unmanaged certificates: enabling secure ARs with no renewal process, so an expired certificate becomes a production outage and teams disable security to recover.
Default SNMP communities and open switch ports: the easiest entry points, and the ones least often audited.
Ignoring the engineering station: protecting the fieldbus but leaving the PC that can download projects to every controller with shared accounts and remote access.

Practitioner checklist

Inventory every PROFINET and PROFIBUS cell with device firmware and security class support.
Place each IO system in its own zone with a documented conduit and no Layer 2 path to IT.
Lock DCP name and IP settings where supported and alert on DCP Set outside work orders.
Remove default SNMP communities, disable SNMP write and plan SNMPv3.
Disable unused switch ports and enable port security on access ports.
Harden and restrict engineering stations and PROFIBUS gateways as privileged assets.
Require signed GSDX files, a stated security class and IEC 62443-4-2 evidence in procurement.
Pilot Class 2 with a designed SIH, CA and certificate renewal process before scaling.
Deploy passive monitoring per cell and track the six metrics above.

PROFINET and PROFIBUS Security Guide: Security Classes, Segmentation and Monitoring