Value of PLC Key Switch Monitoring to Keep Critical Systems More Secure

This report addresses the security risk posed by PLC/SIS physical and logical key switch positions, highlighting the 2017 XENOTIME/TRISIS compromise that leveraged a controller left in Program mode, and provides practical detection and mitigation guidance—such as embedding key-state detection logic in PLC function blocks, using GSV/predefined attributes and configuring HMI alarms—to enable operations and SOC teams to detect and respond to unauthorized mode changes.