What is an Engineering Network?
An Engineering Network is a separated network segment within an industrial OT architecture through which engineers use engineering stations to program, configure, diagnose and update the PLCs, HMIs, SCADA systems, drives and network components of an installation. It separates changing an installation from operating it: operators work on the supervisory network, controllers talk to each other on the control network, and new control logic or firmware only enters through the engineering network. Because whoever controls this network can change the behaviour of the physical plant, it is one of the most critical segments in industrial automation.
🧠 How does an Engineering Network work?
An engineering network connects three kinds of systems:
- Engineering workplaces - fixed engineering stations or engineering laptops running software such as TIA Portal and STEP 7 (Siemens), Studio 5000 (Rockwell Automation), Unity Pro, now EcoStruxure Control Expert (Schneider Electric), or CODESYS.
- Target systems - controllers, HMI panels, SCADA servers, variable frequency drives, IO modules, switches and industrial firewalls that need configuring.
- Supporting services - version control of project files, backups, licence servers, asset management and a jump server as the single point of entry from outside.
Communication uses vendor-specific protocols. Siemens uses S7 Comm Plus over TCP port 102, Rockwell uses CIP over EtherNet/IP (TCP 44818), and safety controllers often have a protocol of their own, such as TriStation over UDP for Triconex. Protocols such as Modbus (TCP 502) and OPC UA (TCP 4840) also run over Ethernet for diagnostics and testing, but they are meant for process data, not for downloading programs.
There are three common designs:
- Physically separated - dedicated switches and cabling, often in installations with a high security level
- Logically separated - a dedicated VLAN routed through a firewall, the most common design
- On demand - no permanent connection; an engineer gets temporary access through a VPN or jump server during commissioning, faults or planned changes
🔄 How does the Engineering Network relate to other OT networks?
In the Purdue Model, engineering workstations usually sit at level 2, close to the controllers they program. Placing them in a zone of their own keeps the traffic flows to the controllers limited and controllable.
| Network | Function | Typical users | Traffic |
|---|---|---|---|
| Engineering network | Programming, configuration, firmware updates | Authorised engineers and vendors | Downloads, uploads and online diagnostics, irregular |
| Supervisory network | Monitoring, alarming, operation | Operators, process engineers | Continuous polling of tags |
| Control network | Real-time control between controllers and IO | Controllers, IO and drives; engineers only via controlled paths | Cyclic, deterministic |
| IDMZ | Controlled exchange with IT | Historian replicas, patch servers, jump servers | Only through brokers and proxies |
The main difference is the kind of action. Supervisory traffic reads values and writes setpoints, while engineering traffic can replace the logic itself. That is why the engineering network usually gets its own zone with stricter requirements in a zones and conduits model.
🏭 What is an Engineering Network used for?
- Commissioning - the first start-up of an installation, when programs, parameters and network settings are loaded
- Changes - modifying PLC programs and updating HMI screens and SCADA projects within change management
- Maintenance - updating the firmware of controllers, switches and drives, and managing firewall rules
- Troubleshooting - monitoring running logic online and forcing variables
- Remote maintenance - vendors and machine builders providing support over a controlled connection
- Testing - test and acceptance environments following an OTAP (DTAP) approach, so changes are not tested directly in production
🔐 Why is the Engineering Network a favourite attack target?
Whoever takes over an engineering workstation holds the keys to the plant. Two well-known attacks show this:
- Stuxnet (discovered in 2010) replaced the STEP 7 communication library and infected STEP 7 project files. As soon as an engineer opened such a project the attack ran, and anyone who copied the project to another network spread the infection further.
- TRITON (described in December 2017) started with an initial foothold in the DCS network, after which the attackers gained remote access to an engineering workstation of the safety instrumented system (SIS). From there the attackers reprogrammed Triconex controllers via the TriStation protocol.
MITRE ATT&CK for ICS describes this pattern as Project File Infection (T0873). The mitigations it lists are hash checks of project files against a trusted version, code signing, encryption and restricted file permissions.
🔧 How do you secure an Engineering Network?
| Measure | Implementation | Why |
|---|---|---|
| Own zone | Segmentation with an industrial firewall; only the required ports to specific controllers | Limits what an infected workstation can reach |
| No dual-homing | A workstation is never on the engineering network and the office network at the same time | Explicitly recommended after TRITON for workstations that program SIS controllers |
| Controlled access | Remote access only through a jump server with MFA and session recording | Every action is traceable |
| Least privilege | Access control per role and per installation, opened temporarily | Vendors only see their own machine |
| Project integrity | Version control with hashes and comparison between offline project and controller | Detects unauthorised changes |
| Media and software | USB Control, hardening and verification of firmware before rollout | Prevents infection via laptops and USB sticks |
| Monitoring | Network monitoring that recognises downloads, mode changes and firmware updates, linked to a SIEM | Changes outside a change window stand out |
| Physical key | Leave controllers with a key switch in RUN and audit the position | Programming requires a deliberate action |
The SANS ICS Five Critical Controls from 2022 align with this: a defensible architecture that collects logs from engineering workstations, and secure remote access through a jump host, are two of the five core measures.
🧱 How do you set up an Engineering Network step by step?
- Take inventory of all engineering workstations, laptops, software versions and the controllers they manage (asset inventory).
- Map the traffic flows: which workstation needs to reach which controller on which port?
- Design zones and conduits following IEC 62443-3-2 and select the requirements from IEC 62443-3-3 that match the target security level.
- Place a jump server in the IDMZ as the only entry point from outside, with MFA and session recording.
- Manage project files centrally and periodically compare the version in the controller with the approved version.
- Record all engineering sessions and changes through logging and security monitoring.
- Test recovery: can you restore a controller from a backup of the project if the workstation can no longer be trusted?
In the Netherlands this is no longer optional. The Cybersecurity Act, the Dutch transposition of NIS2, has applied since 15 August 2026. Article 21 of NIS2 explicitly names access control policies, asset management and the use of multi-factor authentication as measures, and these apply directly to the engineering network.
❓ Frequently asked questions
What is the difference between an Engineering Network and an engineering station?
An engineering station is the workstation running the programming software, while an Engineering Network is the network segment through which that workstation reaches the controllers. The engineering network therefore determines which stations are allowed to change which systems.
Does an Engineering Network have to be physically separated?
An Engineering Network does not always have to be physically separated; a dedicated VLAN behind a firewall is sufficient in most installations. For safety systems and installations with a high security level, organisations more often choose physical separation or a network that is only connected during planned changes.
Can a vendor log in directly to the Engineering Network?
A vendor should not log in directly to the Engineering Network. Access goes through a jump server with MFA, only to the vendor’s own machine and only within an agreed time window, so the session is recorded and can be terminated.
Which protocols run over an Engineering Network?
An Engineering Network mainly carries vendor protocols for programming, such as Siemens S7comm-plus on TCP port 102 and CIP over EtherNet/IP on TCP port 44818. Modbus TCP, OPC UA, SNMP and web interfaces for configuring network components also appear.
How do you detect an unauthorised change made through the Engineering Network?
An unauthorised change stands out when OT network monitoring detects program downloads, mode changes and firmware updates and compares them with approved changes. In addition, comparing the project in version control with the logic in the controller shows whether anything was changed outside the process.
📌 In summary
The Engineering Network is the segment through which engineers change the logic and configuration of an industrial installation, which makes it one of the most critical zones in OT. With a zone of its own, access through a jump server with MFA, version control of project files and monitoring of every download, you keep that power under control, in line with network segmentation, IEC 62443 and the duty of care under the Cybersecurity Act.