Schneider Electric Modicon and EcoStruxure Hardening Guide: controller access, secure engineering and event logging

A Modicon controller is only as protected as the passwords, services and engineering link settings chosen in EcoStruxure Control Expert before the first download, and most of those choices sit with the asset owner. Schneider Electric documents a full set of controls for the Modicon M580 and M340 platform: Security Editor user profiles, application and firmware passwords, memory protection, per-service access control lists, IPsec on communication modules, a TLS engineering link and Syslog event logging. This guide turns that documentation into a hardening baseline for water, energy, manufacturing and infrastructure sites that run Modicon PAC and safety controllers with Control Expert. It covers how access works, who should hold privileged rights, how HMIs, SCADA, OPC UA clients and maintenance tools connect, what to log and the misconfigurations seen most often. It is written for automation engineers, OT security leads and system integrators. For the general PLC threat model, read the PLC Security Guide first; this page goes deeper on the Schneider settings.

This is an independent guide from NHI Mgmt Group, based on Schneider Electric's public documentation as of November 2026. It is not sponsored or reviewed by Schneider Electric. Product features change, so confirm settings against Schneider Electric's current documentation.

Key takeaways

• Configure security before the first download. Services, access control lists and passwords are set on the Ethernet tabs and project settings in Control Expert, then built and downloaded, so a project template decides the security of every controller copied from it.
• Use every password layer. Application, safety area, firmware update, data storage and web, and section passwords each guard a different thing; set all that apply and vault them.
• Move the engineering link to Enforced. The M580 engineering link has Full Access, Filtered (the default) and Enforced modes; Enforced accepts only secure drivers over HTTPS and Modbus Secure Mode.
• Turn on memory protection and RUN/STOP by input. Both stop a remote client from changing the running program or the operating mode over Ethernet without a deliberate physical action.
• Send cybersecurity events to Syslog. Control Expert can forward controller events over TCP in RFC 5424 format, with cybersecurity events under facility 10, which gives the SOC download, login and lockout evidence.

How identity and access work in Modicon and EcoStruxure Control Expert

Access control for a Modicon system sits in four layers, and a baseline needs all of them. Schneider's Modicon Platform Cybersecurity User Guide (EIO0000001999, updated for Control Expert V16.4) describes each one.

• The engineering software: the Control Expert Security Editor defines software users and their authorisations. It ships with a SecurityAdmin account and user profiles such as ReadOnly (no modification), Operate (execution and parameter changes) and Program (all functions).
• The application: an application password protects opening and changing the project, with optional encryption of the .STU, .STA and .ZEF files. Program units, sections and subroutines can carry their own passwords, and a separate password protects the safety-related area of a safety application.
• The controller: firmware update and data storage and web passwords protect maintenance functions. From M580 firmware V4.01, firmware updates and data storage use HTTPS and share this password with web access. Memory protection and RUN/STOP by input add a physical gate to program and mode changes.
• The network path: per-service access control lists, IPsec on the BMENOC0301 and BMENOC0311 communication modules, and the M580 engineering link modes decide which hosts can reach which service.

Admin roles and privileged access

Treat every right that can change controller behaviour as privileged: downloading, changing the operating mode, updating firmware, editing safety logic and editing the security configuration itself.

• SecurityAdmin: the account that changes Security Editor policy is the most powerful identity in the engineering estate. Schneider recommends a dedicated password for it; keep it in a vault, use it only for policy changes and record each retrieval.
• Narrow profiles: give operators and maintenance staff ReadOnly or Operate, and reserve Program for named engineers who download changes under a change record.
• Safety separation: the safety-related area password, and the right to download to a safety controller, belong to the functional safety team. See the Safety Instrumented Systems Security Guide for why the safety layer needs its own access model.
• Shared controller secrets: firmware, data storage and web, and application passwords are shared secrets by design. Generate them with high complexity, store them in a vault, and rotate them after staff or integrator changes. The OT and ICS Identity and Access Guide covers vaulting and break-glass handling for OT.
• Change default passwords: Schneider's guide lists changing the FTP default password as a recommended setting, and its Recommended Cybersecurity Best Practices asks owners to change default passwords when software is installed and regularly after that.
• Cybersecurity Admin Expert (CAE): CAE creates secure configurations, supports a centralised mode for managing many devices, and can decommission a controller back to its out-of-box state. Restrict who can run it, because it can reset protection on a device.
• Engineering workstations: the person at Control Expert with a vaulted password and a network path to the controller holds the keys to production. Harden these hosts and broker remote sessions; see the Engineering Workstation Security Guide.

Integrations, API tokens and service accounts

Modicon controllers serve many non-human clients. Each one is either a credential, a key or an IP address in an access control list, and each needs an owner and a review date.

• HMIs and SCADA on Modbus TCP: Modbus on port 502 appears as its own service in the access control list. Allow only the SCADA servers and HMIs that need it, by host address, ahead of any broader subnet rule. Modbus TCP itself carries no authentication; see the Modbus TCP and Modbus Security Guide.
• Secure engineering link: the TLS engineering link uses HTTPS and HTTPS over USB drivers on port 443, plus Modbus Secure Mode (TLS over TCP) on port 802 for M580 firmware 4.60 and later. Controller authentication relies on the M580's self-signed certificate, which Control Expert holds in its Security Editor Certificate Whitelist. Treat that list as a trust store: add certificates only after checking them on a point-to-point connection, and remove entries for decommissioned controllers.
• IPsec on BMENOC modules: BMENOC0301 and BMENOC0311 can protect Modbus, EtherNet/IP, HTTP, FTP and SNMP server traffic with IPsec using a pre-shared key. Schneider advises a high-complexity generated key and a first download over a point-to-point connection such as USB. The guide lists the flows to plan separately when IPsec is enabled, including DHCP/BOOTP, EtherNet/IP class 1, the Modbus client, the NTP client and the SNMP agent, so design those paths before switching it on.
• OPC UA through BMENUA0100: the BMENUA0100 module has its own cybersecurity settings and access control and can run in a secure mode. Use signed and encrypted security policies, authenticated users and managed certificates; the OPC UA Security Guide covers the certificate lifecycle.
• Automation Device Maintenance: this tool updates M580 firmware. For firmware V4.10 and later, it uses HTTP/HTTPS rather than FTP. Allow it only from a named maintenance host in the access control list.
• Remote sites and VPN: Schneider's guide describes IPsec VPN with IKEv2 through an EAGLE40 firewall for remote connections. Use certificate or strong pre-shared key authentication, terminate the tunnel at the site boundary and send all remote engineering through a single managed point, as Schneider's best practices require. See the OT Remote Access Guide.
• Wireless: for the PMXNOW0300 wireless module the guide specifies WPA2-PSK; treat the key as a shared secret with the same vaulting and rotation as controller passwords.

These pre-shared keys, certificates and service passwords rarely expire and are seldom inventoried. Record each one with its owner, location and rotation date, as described in the Device and IoT Identity Guide.

Logging and detection

Modicon controllers can report their own security events, which is unusual in older controller estates and worth switching on everywhere.

• Enable event logging: in Control Expert, open Tools, Project Settings, General, PLC diagnostics, enable Event Logging, enter the Syslog server address and port, then build and download. Events are sent over TCP in RFC 5424 format, and cybersecurity events use facility 10.
• Watch logging health: the SERVICE_STATUS2 DDT exposes EVENT_LOG_STATUS and LOG_SERVER_NOT_REACHABLE; alarm on these in SCADA so a silent log path is noticed.
• Keep one time source: Schneider recommends a single NTP reference so controller, firewall and server events line up in an investigation.
• Integrity checks: the M580 runs a firmware integrity check after a firmware upload or restart, and Control Expert performs an integrity check at server start-up. Investigate any failure as a possible tampering event.

Forward these events to the OT SOC with the firewall and monitoring data; the OT Network Security Monitoring Guide explains how to baseline normal engineering traffic.

Hardening baseline

Roll the baseline out in this order. Test each step on a spare controller or a test rack, and keep the previous project version and firmware so you can roll back.

1. Inventory and update: list each controller, communication module, firmware version and the Control Expert version. Subscribe to Schneider Electric security notifications, which are published as PDF and machine-readable CSAF, and apply vendor security updates promptly through your OT patch process. The ICS Advisory Triage and OT Vulnerability Management Guide shows how to triage CSAF feeds.
2. Lock down Control Expert: set a dedicated SecurityAdmin password, create named users, and assign ReadOnly, Operate or Program profiles by job.
3. Set passwords and encryption: application password with file encryption, safety area password, firmware and data storage passwords, and section protection with no read or write access. Generate and vault each one.
4. Close services: Schneider's default Ethernet settings start at the maximum security level, so services must be enabled deliberately. Keep only those you need; the CSPN reference configuration deactivates FTP, TFTP, HTTP, DHCP/BOOTP, SNMP, EtherNet/IP and NTP through Enforce security, which is a useful target state for high-consequence controllers.
5. Write the access control list: per service, list the specific source hosts first and subnets after, because the first matching entry wins.
6. Enforce the engineering link: move from Filtered to Enforced once every engineering station uses the secure drivers, and add controller certificates to the Certificate Whitelist.
7. Gate program and mode changes: activate memory protection and RUN/STOP by input only, and store no upload information inside the controller where the process allows it. On Modicon Quantum, memory protection uses the physical key switch on the controller module.
8. Protect the SD card port: on controllers with firmware 4.30 or later, turn on SD card port protection from the web pages.
9. Turn on logging: enable Event Logging to a Syslog server and alarm on LOG_SERVER_NOT_REACHABLE.
10. Segment and broker access: place controllers in zones behind firewalls, isolate control and safety networks from business networks as Schneider's best practices require, and route remote access through one managed interface. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Brownfield versus greenfield: new M580 projects should start with Enforced engineering link, Syslog and full password coverage from day one. Installed estates with older firmware or M340 controllers usually move in stages: access control lists and segmentation first, passwords and memory protection at the next outage, secure engineering link after HMIs and engineering stations are updated. Prioritise controllers that run high-consequence processes or are reachable from wider networks. Small sites with one integrator can still apply every step; the main difference for large estates is using Cybersecurity Admin Expert in centralised mode to keep configurations consistent.

Framework mapping

Detection and measurement

• Engineering link enforcement: percentage of M580 controllers in Enforced mode.
• Password coverage: percentage of controllers with application, firmware and data storage passwords set and recorded in the vault.
• Logging coverage: percentage of controllers sending Syslog events, and hours per month with LOG_SERVER_NOT_REACHABLE raised.
• Unexplained downloads: program downloads without a matching change record (target zero).
• Service exposure: controllers with FTP, TFTP, HTTP or SNMP enabled without a documented need.
• Notification exposure: controllers below the fixed version in open Schneider security notifications, weighted by process consequence.

Common misconfigurations

• Template projects with open services: a library project with FTP, HTTP and SNMP enabled, copied to every controller on site.
• Subnet rule before host rule: an access control list that allows the whole control subnet first, so later host-specific entries never apply.
• Engineering link left on Filtered: the default mode kept after secure drivers are available, so unencrypted engineering connections remain possible.
• One password for everything: the same application and firmware password on every controller, known to every integrator who has worked on the site.
• Memory protection off for convenience: disabled during commissioning and never turned back on.
• Logging configured but unwatched: Syslog enabled without an alarm on the log server status, so a broken path goes unnoticed for months.

Practitioner checklist

• Inventory controllers, modules, firmware and Control Expert versions; subscribe to Schneider security notifications and CSAF.
• Set a dedicated SecurityAdmin password and assign ReadOnly, Operate or Program profiles to named users.
• Set and vault application, safety area, firmware and data storage passwords; protect sections; encrypt project files.
• Disable unused services and write per-service access control lists with host rules before subnet rules.
• Move the M580 engineering link to Enforced and manage the Certificate Whitelist.
• Activate memory protection, RUN/STOP by input and SD card port protection where supported.
• Enable IPsec on BMENOC modules or secure mode on BMENUA0100 where those paths are used.
• Send cybersecurity events to Syslog with one NTP reference and alarm on log server status.
• Route remote access through one managed, authenticated interface and keep controllers behind firewalls.

Standards and references

• Schneider Electric: Modicon Platform Cybersecurity User Guide (EIO0000001999)
• Schneider Electric: Recommended Cybersecurity Best Practices
• Schneider Electric: Security Notifications
• MITRE ATT&CK for ICS: Program Download (T0843)
• MITRE ATT&CK for ICS: Change Operating Mode (T0858)
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology Security
• CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology

Related NHI Mgmt Group resources: PLC Security Guide · Water and Wastewater Cybersecurity Guide · Energy Sector Identity and OT Access Guide · OT Security Guide · Engineering Workstation Security Guide