Antivirus

What is antivirus?

Antivirus software is a security application that checks files, processes and removable media on a computer in order to detect, block and remove malware such as viruses, worms, trojans and ransomware. It is one of the oldest layers of defence in cybersecurity and runs on workstations, laptops and servers, but also on Windows systems on the plant floor, such as HMIs, SCADA servers and engineering stations. In OT, antivirus is useful but not straightforward: updates, scans and exclusions have to suit a system that must run without interruption for years.

🧠 How does antivirus work?

Modern antivirus products combine several detection techniques:

• Signatures - the scanner compares files against a database of characteristics (hashes and code fragments) of known malware. Fast and reliable, but only for what is already known.
• Heuristics - the scanner looks for suspicious constructs in code, such as encrypted sections or instructions that point to self-replication, to recognise variants of known families.
• Behaviour monitoring - the product watches what a process does, for example encrypting large numbers of files, and intervenes during execution.
• Real-time scanning (on-access) - every file is checked at the moment it is opened, copied or executed.
• Scheduled and manual scans (on-demand) - a full scan of disks or of a USB stick at a set time.
• Cloud analysis and sandboxing - unknown files are checked against reputation data in the cloud or run in an isolated environment. This needs an internet connection or a local analysis server and is mainly found in business and “next-generation” products.

Signatures only work when they are current. Vendors therefore release new definitions very frequently, and a scanner with definitions that are months old misses everything that has appeared since.

🧱 What does antivirus protect?

Antivirus focuses on the places where malicious code enters a system or hides:

• Local files, email attachments and downloads - the classic infection route in the office, and via shared folders towards the plant as well.
• In-memory processes and startup scripts - malware that loads at boot or runs in memory.
• USB media and removable storage - one of the most important routes in OT, because vendors and technicians often bring files on a stick.
• Documents with macros or hidden scripts - office files that execute code when opened.
• OT workstations, HMIs and engineering laptops - Windows systems that are connected directly to the process or are temporarily plugged into it.

The strength of antivirus is fast, simple detection of known and common threats with little configuration for baseline protection. That is precisely why it is a baseline layer rather than a complete solution.

🔄 What is the difference between antivirus, application whitelisting and EDR?

Antivirus is rarely deployed on its own in OT. The three common endpoint controls complement each other:

Many modern EDR products include their own antivirus module, and XDR extends the correlation to network, email and cloud. Ideally, logs from all of these tools come together in a SIEM. Antivirus remains useful for one task that whitelisting does not cover: checking files on a USB stick or in a shared folder before anyone opens them.

🏭 Why is antivirus harder in OT than in IT?

An office laptop receives new definitions every day over the internet and may restart after an update. An HMI in a control room often has neither option:

• No internet connection - OT networks are segmented and sometimes nearly isolated, so definitions have to arrive via a central server in the DMZ or be delivered manually.
• Performance and determinism - a full scan, or scanning a historian database, can load the CPU and disk so heavily that screens slow down or communication stutters. Older hardware in particular has little headroom for this.
• Vendor compatibility - vendors such as Siemens test their SCADA and DCS software only with specific antivirus products and versions, and publish compatibility lists and configuration guides for them. An untested scanner can put warranty or support at risk.
• False positives - if the scanner quarantines an engineering tool or a runtime file, a process can stop. That risk weighs more heavily in OT than in IT.
• Outdated operating systems - on legacy systems running Windows XP or Windows 7, many products no longer receive support or updates.

That is why availability comes first: antivirus in OT is selected, tested and configured with the process in mind, not according to a standard office policy.

🔐 What do standards and regulations say about antivirus?

The standards do not prescribe a particular product. IEC 62443 lists anti-malware and whitelisting side by side and asks you to choose the measure that fits the control function. A well-reasoned choice for whitelisting on a static system therefore also complies.

🧭 How do you deploy antivirus in OT step by step?

1. Inventory the endpoints - which Windows systems are running (HMI, SCADA server, historian, engineering station), with which operating system and which vendor software?
2. Choose a product approved by the vendor - check the compatibility list of the SCADA or DCS vendor and stick to the versions it names.
3. Configure exclusions as the vendor specifies - exclude databases, archive folders and runtime files from real-time scanning where the vendor requires it, and document every exclusion.
4. Manage updates centrally - have definitions arrive on a management server in the DMZ and distribute them from there into the OT zone. For fully isolated systems, vendors offer offline packages; Microsoft, for example, publishes the mpam-fe.exe package for Defender Antivirus.
5. Test on a reference system first - new engine versions and definitions go to a test or spare HMI first and only then to production, in line with change management.
6. Schedule full scans outside critical production periods - for example during a maintenance shutdown or on a redundant server.
7. Set up a scanning station for USB media - a fixed kiosk that scans every stick before it is used on site, supported by USB Control on the endpoints themselves.
8. Forward alerts - detections belong in the central console and preferably in a SIEM or OT SOC, with an agreed route to incident response.
9. Verify that it works - the EICAR test file, a harmless 68-byte text file developed by EICAR and CARO, shows whether detection and alerting really work.

🚧 What are the limitations of antivirus?

• Known malware first - signature detection falls short against zero-days and malware built for a single target. Stuxnet was active for years before the Belarusian antivirus company VirusBlokAda discovered the worm in June 2010.
• No view of the network - antivirus does not see lateral movement between systems or the abuse of legitimate tools and protocols.
• No protection for controllers - a PLC does not run Windows and cannot run antivirus; there you need network segmentation and monitoring.
• No response - antivirus quarantines a file, but offers no investigation or recovery. That requires EDR, a SOC and an incident response process.
• Dependent on maintenance - outdated definitions or a disabled scanner create a false sense of security.

Antivirus is therefore one layer of defence in depth, alongside hardening, patch management, whitelisting and segmentation.

❓ Frequently asked questions

Do I still need antivirus if I have EDR?

A separate antivirus solution is usually unnecessary if your EDR product has its own anti-malware module, which is the case for many modern EDR products. In OT, do check whether the vendor of your SCADA or DCS software has approved that EDR agent. Without EDR, antivirus remains the baseline protection on Windows endpoints.

Can I use Microsoft Defender on an HMI?

Microsoft Defender Antivirus is built into modern Windows versions and appears, for example, on Siemens’ compatibility list for WinCC V7. That does not automatically apply to other products: even within one vendor, the approved scanners differ per product and version. Whether you may use it on your HMI depends on approval by the vendor of the HMI or SCADA software. Updates can be delivered centrally or through offline definition packages.

How do I update antivirus on an OT system without internet access?

Antivirus on an OT system without internet access works best with a central update server in the DMZ that fetches definitions and passes them on to the OT zone. For fully isolated systems, you can deliver offline definition packages after checking them, via a scanned medium or a data diode. Test new definitions on a reference system first.

Why does antivirus sometimes block my SCADA software?

Antivirus can slow down or block SCADA software when it scans database files or wrongly flags a runtime component as suspicious. Vendors therefore publish lists of folders and processes to exclude. Record such exclusions and limit them to what the vendor specifies.

Is application whitelisting better than antivirus in OT?

Application whitelisting is often more effective than antivirus on static OT systems, because it also stops unknown malware and needs no daily updates. Antivirus remains useful for scanning files and USB media that are not executed. Many organisations combine both.

Does IEC 62443 require antivirus?

IEC 62443 requires protection against malicious code, but not antivirus specifically. IEC 62443-3-3 lists anti-malware, whitelisting, removable media controls and integrity checks as possible measures. You choose what fits the function and constraints of the system.

📌 In summary

Antivirus software recognises and blocks known malware on Windows endpoints and therefore remains a baseline layer of endpoint security, on the plant floor too. In OT, antivirus only works well if the product is approved by the vendor, updates arrive centrally and tested, and scans do not disrupt the process. Against advanced attacks, complement it with application whitelisting, EDR, a SIEM, segmentation and Zero Trust.