In every industrial control system environment we have audited, there is a common thread that ties together incidents of unauthorized access, data exfiltration, and operational disruption. It is rarely a sophisticated zero-day exploit or a nation-state actor breaching the perimeter. More often, it is a shared administrative password for a Programmable Logic Controller (PLC) or a Human-Machine Interface (HMI) that has been passed around on sticky notes, in spreadsheets, or via unencrypted email for years.
When we conduct assessments across industrial organizations, the findings are consistently revealing. In our recent walkdowns, we have documented scenarios where incomplete asset inventories and missing or non-OT-specific security policies allowed shared credentials to persist in production environments for decades. One internal assessment record noted that every site visited had recurring issues involving undefined security roles and a lack of adopted security standards, which directly enabled the use of default or shared passwords.
This is not just a compliance checklist item; it is an operational reality. Shared credentials mean no accountability. If a contractor modifies a logic block in a Siemens S7-1500 or a Rockwell ControlLogix rack using a generic “Admin” account, there is no way to trace the change back to a human being. In the event of a safety incident or a production halt, you are flying blind.
The Operational Reality: Why You Cannot Just “Reset” Credentials
For IT professionals, rotating a shared password is a matter of updating a directory service and notifying users. For OT engineers, it is an operation that can literally stop the line. This is why we always start our foundational education with the principle that OT is not IT. The operational reality behind industrial cybersecurity is defined by availability and safety above confidentiality.
When you attempt to replace shared credentials on PLCs and HMIs at scale, you are not just changing a string of characters. You are potentially locking out legitimate users, invalidating existing engineering licenses, or triggering security policies that require a reboot of the control network. In many legacy environments, particularly those running older versions of Windows CE-based HMIs or proprietary protocols like Modbus TCP without authentication, there is no native mechanism to support unique user accounts.
Consider the case of a large manufacturing facility we recently assessed. The plant managers were eager to improve their security posture but had never considered the impact on their shift operators. When we reviewed the HMI configurations, we found that over 70% of the remote access points and local engineering stations relied on a single shared account with write privileges. This is a critical vulnerability, especially given recent intel from global cybersecurity agencies regarding credential exposure campaigns like FortiBleed, which targets firewalls and VPN gateways used to access these very networks.
Phase One: Asset Inventory and Risk Prioritization
Before you touch a single configuration file, you must know what you are dealing with. You cannot secure what you cannot see. This brings us back to why asset inventory is the first real security control in OT. Without a comprehensive list of all PLCs, HMIs, SCADA servers, and engineering workstations, any credential rotation project is a shot in the dark.
Identifying the Vulnerable Assets
Start by mapping all devices that support user authentication or have default credentials enabled. This includes:
- PLCs and PACs: Check Rockwell, Siemens, Schneider Electric, and ABB devices for supported security features. Many modern devices support IEC 62443-compliant access control, but older models may not.
- HMIs and TP/OP Panels: These are often the weakest link. They frequently run on outdated Windows versions with shared local administrator accounts.
- Engineering Workstations: These are the golden tickets for attackers. If they share credentials with production HMIs, you have a direct path from the shop floor to the engineering environment.
In one of our engagement findings, we noted that in 2 of 2 endpoint assessments from the same industrial organization, audit output reported an enabled local administrator account with PasswordRequired=False. While this is a specific flag requiring manual validation, it highlights the extent to which security can be neglected in OT environments. Do not assume these accounts are safe because they have “no password.” They are open doors.
Mapping Access Dependencies
Before changing any credentials, you must map who uses what and when. Interview shift supervisors, maintenance leads, and process engineers. Create a matrix that links each shared account to its specific users and intended use cases. This step is crucial for justifying the effort to plant managers and for ensuring that no critical function is left orphaned during the transition.
Phase Two: The Technical Strategy for Credential Rotation
2>
Replacing shared credentials cannot be done in a big-bang approach. It requires a phased, risk-based strategy that aligns with IEC 62443 and NIST SP 800-82 guidelines.
Step 1: Enable Native Authentication Where Possible
For modern devices, leverage native security features. Siemens TIA Portal, for example, allows for user management with individual accounts and roles. Rockwell Studio 5000 supports similar functionality. The goal is to replace the shared “Admin” account with unique IDs for each engineer and operator.
However, this is not always straightforward. Some legacy protocols, such as standard Modbus TCP or DNP3, do not support authentication at the protocol level. In these cases, you must rely on network-level controls, such as firewalls and unidirectional gateways, to restrict access until the devices can be upgraded.
Step 2: Implement a Privileged Access Management (PAM) Solution
For devices that cannot support individual accounts due to hardware or software limitations, you must implement a PAM solution. This involves routing all engineering access through a secure gateway that handles authentication and logging.
- Session Recording: Every action taken during an engineering session is recorded. If a valve is opened incorrectly, you have video evidence of who did it.
- Just-in-Time Access: Engineers receive temporary credentials that expire after the task is complete. This eliminates the need for persistent shared passwords.
- Approval Workflows: Changes to critical process logic require managerial approval, adding a layer of operational control.
This approach directly addresses the issue of insecure remote access configurations, which we know from recent research is a leading cause of unauthorized access in industrial control systems. By centralizing access through a PAM solution, you reduce the attack surface and ensure that all remote connections are monitored and secured.
Step 3: Handle Legacy and “Dumb” Devices
Not every device can be upgraded. You will encounter legacy PLCs from the 1990s and early 2000s that have no user management capability. For these assets, you must apply compensating controls.
This might include placing the device in a isolated VLAN with strict firewall rules, using hardware key fobs for physical access to engineering stations, or implementing network behavior anomaly detection (NBAD) to alert on any unauthorized communication from these legacy devices. Remember, the hidden cost of poor OT visibility is that you may not even know these devices are talking to unknown entities.
Phase Three: Change Management and Operational Continuity
The biggest hurdle in replacing shared credentials is not technical; it is human. Operators resist change because they fear losing access or breaking the process. You must communicate clearly that this initiative is about protecting their jobs and ensuring plant safety, not adding bureaucracy.
Testing and Validation
Never roll out new credentials to a live production environment without rigorous testing. Use a duplicate engineering workstation or a hardware-in-the-loop simulator to validate that the new authentication methods work as expected. Test failover scenarios: what happens if the PAM server is offline? What happens if the operator forgets their password?
In our assessments, we have seen cases where rushed credential changes led to lockouts, forcing engineers to use emergency access procedures that bypassed all security controls. This defeats the purpose of the entire initiative. Ensure that your emergency access process is documented, approved, and audited just like any other change.
Phased Rollout
Start with a pilot group of non-critical assets or a single production line. Gather feedback from the operators and engineers involved. Adjust your approach based on their experience. Once the pilot is successful, expand to the rest of the facility. This incremental approach minimizes risk and builds confidence among the stakeholders.
Conclusion: From Compliance to Operational Resilience
Replacing shared credentials on PLCs and HMIs at scale is a complex undertaking that requires careful planning, technical expertise, and strong change management. It is not just about meeting compliance requirements for NERC CIP or IEC 62443; it is about building operational resilience.
When you eliminate shared credentials, you restore accountability to your industrial network. You enable precise forensic analysis in the event of an incident. You reduce the risk of accidental or malicious changes to critical process logic. And most importantly, you demonstrate to your plant managers and CISOs that OT security is not a cost center, but a vital component of operational excellence.
If you are struggling to identify shared credentials in your environment or need help developing a plan to replace them without disrupting production, Red Trident is here to help. We specialize in OT cybersecurity assessments that provide actionable insights tailored to your specific industrial landscape.
Take the first step towards a more secure and accountable OT environment. Contact us today for a free OT security assessment consultation.
