Yokogawa CENTUM VP Security Guide: Authentication Modes, Vnet/IP Patching and Hardening

Yokogawa CENTUM VP runs refineries, LNG plants, chemical sites and power stations across Asia, the Middle East and beyond, and many installations still use an authentication mode that Yokogawa's own advisories now tell customers to move away from. As a distributed control system (DCS), CENTUM VP combines Windows-based operator and engineering stations, field control stations and the Vnet/IP control network, often alongside the ProSafe-RS safety system. Its security depends on how users are authenticated, how the Windows hosts are hardened, and how quickly control network firmware and patches are applied. This guide explains how identity and access work in CENTUM VP, the privileged roles and integrations to control, what to log, a hardening baseline built on Yokogawa's guidance and recent advisories, and the misconfigurations that recur. It goes deeper than the OT Security Guide and is for DCS engineers, OT security teams and asset owners in process industries. Version-specific facts come from Yokogawa security advisories; always confirm details for your exact revision with Yokogawa.

Key takeaways

• Move to Windows Authentication Mode. Two Yokogawa advisories (YSAR-23-0001 and YSAR-26-0003) affect only CENTUM Authentication Mode, and switching to Windows Authentication Mode is the stated countermeasure for many revisions.
• The control network needs patching too. YSAR-26-0002 (2026) covers Vnet/IP interface packages and firmware in FCS modules, interface cards and ProSafe-RS modules, with fixes such as Vnet/IP firmware R35.
• Every HIS and ENG is a Windows host. Host compromise is the precondition in several advisories, so CIS-based hardening, allowlisting and restricted shared folders are core DCS controls.
• Old revisions carry unfixable risk. CENTUM CS 3000 and CS 1000 are end of support in recent advisories, and some CENTUM VP R4 and R5 issues have no patch; plan migration and compensating controls.
• Integrity checks exist; use them. CENTUM VP includes a cyclic redundancy check of field control station programs and databases that raises a system alarm on error.

How identity and access work in CENTUM VP

A CENTUM VP system typically includes human interface stations (HIS) used by operators, engineering stations (ENG) used to build and download control applications, field control stations (FCS) that run the control logic, and servers for alarm management (CAMS for HIS), OPC access (Exaopc), plant resource management and integration. These connect over Vnet/IP, Yokogawa's control network, and to the wider plant network through firewalls and servers.

User authentication on the HIS has two modes, which Yokogawa advisories name explicitly:

Within CENTUM, users are assigned permission levels that decide which operations they can perform. YSAR-26-0003 notes that the PROG user's default permission is S1, equivalent to OFFUSER, and that the risk rises if that permission was changed. Yokogawa added a function in CENTUM VP R4.03, according to a 2010 product announcement, to coordinate user account changes with an IT management system so that leavers and transfers are handled promptly. Changing authentication mode requires Yokogawa engineering work, so plan it as a project with the vendor.

Admin roles and privileged access

The privileged actions in a DCS are building and downloading control applications, changing tuning and alarm settings, managing users and permissions, patching and changing Windows configuration, and administering Vnet/IP devices. In ATT&CK for ICS terms the risks include Valid Accounts (T0859), Modify Alarm Settings (T0838), Alarm Suppression (T0878) and Manipulation of View (T0832); Yokogawa's 2018 advisory YSAR-18-0001 concerned faked and blocked alarms in CENTUM and Exaopc.

• Separate operator, engineer and administrator accounts: operators should not hold engineering or Windows administrator rights; engineers should use named accounts for application changes; Windows administration should use separate admin accounts used only for maintenance.
• Review built-in accounts: confirm that built-in CENTUM accounts such as PROG keep their default minimal permissions, as YSAR-26-0003 advises, and that unused accounts are disabled.
• Dedicated DCS domain: if you use Windows Authentication Mode with a domain, keep it separate from the corporate domain with no trust, or a tightly controlled one-way design, so a corporate compromise does not reach the DCS. See the OT and ICS Identity and Access Guide.
• Vendor and integrator access: Yokogawa service staff often perform updates and mode changes. Give them named, time-limited accounts and route remote sessions through a brokered, recorded service. See the OT Remote Access Guide.
• Control network devices: earlier advisories covered Vnet/IP switches revealing administrator passwords in SNMP community strings, SNMPv3 authentication bypass and remote management and debug functions. Change default credentials, restrict management access and keep switch firmware current.

Integrations, service accounts and shared folders

CENTUM VP rarely stands alone. Historians, MES, advanced process control, asset management and safety systems connect to it, usually through OPC servers such as Exaopc, file shares or dual-homed servers.

• OPC access: Exaopc provides OPC access to process data. The 2026 Yokogawa announcement states Exaopc achieved OPC UA compliance certification; where you can use OPC UA with security modes and application certificates, prefer it over OPC Classic and DCOM. See the OPC Classic and DCOM Hardening Guide and the OPC UA Security Guide.
• Service accounts: give each integration its own Windows account with the minimum rights, and record its owner. Do not let historian or reporting interfaces run under operator or engineering accounts.
• Shared folders: both YSAR-23-0001 and YSAR-24-0002 list access to a shared folder as a route to exploitation. Remove unnecessary shares, restrict share and file permissions to named accounts and audit access.
• One-way data: where business systems only need to read data, publish it through a DMZ server or data diode rather than giving them a path into the control network. See the Data Diodes and Unidirectional Gateways Guide.
• Safety system boundary: ProSafe-RS shares Vnet/IP and engineering tools with CENTUM VP in integrated designs, so treat SIS engineering access as the most privileged access in the plant. See the Safety Instrumented Systems Security Guide.

Recent advisories and what to do

Yokogawa asks customers to decide timing through a risk assessment, and notes that service work for some countermeasures is billable. Build these into your outage plan and budget. For triage across vendors, see the ICS Advisory Triage and OT Vulnerability Management Guide.

Logging and detection

• Windows security logs: on every HIS, ENG and server, collect logon events, account and group changes, service installs and process creation, and forward them to the OT SIEM. Windows Authentication Mode makes these logs meaningful because each user is individual.
• DCS system alarms and operation history: collect system alarms, including the alarm CENTUM VP raises when the cyclic redundancy check finds a change in FCS programs or databases, and operator and engineering change history.
• Shared folder and file monitoring: alert on writes to CENTUM program directories, DLL changes on CAMS servers and access to password or configuration files.
• Network monitoring: passive monitoring of the plant and control networks for new hosts, engineering traffic outside change windows and malformed traffic to Vnet/IP devices. See the OT Network Security Monitoring Guide.
• Alarm integrity: watch for unexpected changes to alarm settings or suppression, given the history of alarm manipulation issues.

Metrics:

1. Percentage of HIS and ENG stations in Windows Authentication Mode.
2. Percentage of Vnet/IP firmware and interface packages at the fixed revisions in YSAR-26-0002.
3. Percentage of stations hardened with the vendor's CIS-based settings and covered by allowlisting.
4. Number of shared folders on DCS hosts, and how many are restricted to named accounts.
5. Percentage of engineering downloads matched to approved changes.

Hardening baseline

Yokogawa's advisories recommend a full security programme covering patch updates, anti-virus, backup and recovery, zoning, hardening, whitelisting and firewalls. Yokogawa states that its IT Security Tools, which apply hardening settings to Windows computers running CENTUM VP, ProSafe-RS and other system products, are certified by CIS against CIS Benchmarks. Use the vendor tool rather than generic baselines, because generic settings can break DCS functions.

1. Inventory: list every station, server, FCS, Vnet/IP card and switch with CENTUM revision, Windows version, firmware and authentication mode.
2. Zone: place Vnet/IP, the HIS and ENG network and integration servers in separate zones behind firewalls, with a DMZ for business access. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
3. Harden hosts: apply the vendor's IT security settings, disable unused services and shares, and control USB use.
4. Allowlist applications: use application allowlisting on HIS and ENG stations so tampered binaries and DLLs cannot run. See the Application Allowlisting Guide.
5. Change authentication mode: plan the switch to Windows Authentication Mode with Yokogawa, starting with one HIS in a test or simulation environment.
6. Patch with validation: apply Yokogawa-validated Windows and CENTUM patches and Vnet/IP firmware during planned outages, testing first on a simulator or spare station.
7. Back up: keep offline, tested backups of engineering databases, FCS applications and station images so you can restore after a failed change or an incident. See the OT Backup and Recovery Guide.

Decision guidance

• Supported VP R6 or R7: patch to the fixed revisions and move to Windows Authentication Mode in the next planned outage.
• VP R4 or R5 and CS 3000: some issues have no patch. Apply strict host hardening, allowlisting, share restrictions and zoning now, and put migration on the capital plan.
• Small sites with one DCS: a Yokogawa-supported workgroup with Windows Authentication Mode may be simpler than a domain; larger sites benefit from a dedicated DCS domain with central policy and logging.

Framework mapping

Common misconfigurations

• CENTUM Authentication Mode kept for convenience: the mode named in two advisories stays in place because the change needs vendor engineering time.
• Shared operator logins: one account per console shift, so actions cannot be attributed and leavers keep access.
• Open shares on stations: broad read and write shares used for file transfer give an attacker the access several advisories require.
• Corporate domain trust: DCS hosts joined to, or trusted by, the corporate domain, so corporate credential theft reaches the control system.
• Vnet/IP firmware never updated: controller and interface card firmware left at commissioning revisions.
• Generic hardening applied: non-validated settings break HIS functions, are rolled back, and the station ends up unhardened.

Practitioner checklist

• Inventory CENTUM revisions, authentication modes, Windows versions and Vnet/IP firmware.
• Plan and complete the move to Windows Authentication Mode with Yokogawa.
• Confirm built-in accounts such as PROG keep minimal permissions and disable unused accounts.
• Apply YSAR-26-0002 fixes to Vnet/IP packages and firmware, and YSAR-24-0002 patches on R6.
• Harden stations with the vendor's CIS-based IT security settings and application allowlisting.
• Remove unnecessary shared folders and restrict the rest to named accounts.
• Keep the DCS domain separate from corporate identity and broker vendor access.
• Forward Windows logs, DCS system alarms and change history to the OT SIEM.
• Keep offline, tested backups and plan migration off unsupported revisions.

Standards and references

• Yokogawa: Security Advisory Report List
• Yokogawa: YSAR-26-0003 Hardcoded Password Vulnerability in CENTUM
• Yokogawa: YSAR-26-0002 Vulnerabilities in Vnet/IP related products
• Yokogawa: YSAR-24-0002 DLL Hijacking Vulnerability in CENTUM CAMS Log server
• Yokogawa: YSAR-23-0001 Elevation of Privilege Vulnerability in CENTUM Authentication Mode
• Yokogawa: CENTUM VP and ProSafe-RS cybersecurity certifications (2026)
• Yokogawa: Enhanced cybersecurity and safety for the OpreX Control and Safety System lineup (2022)
• MITRE ATT&CK: Modify Alarm Settings (ICS)

Related NHI Mgmt Group resources: OT Security Guide · HMI and SCADA Server Hardening Guide · Oil and Gas Cybersecurity Guide · Engineering Workstation Security Guide