What is an Engineering Station?
An Engineering Station (also called an engineering workstation or EWS) is a computer running the programming and configuration software that engineers use to program, configure, test and diagnose PLCs, DCSs, safety instrumented systems (SIS), SCADA systems, HMIs and field devices. It is where control logic, process graphics, network settings and firmware updates are created and loaded into the plant. Because an Engineering Station by definition holds the rights to change how an OT installation behaves, it is also one of the most valuable targets for attackers in industrial automation.
🧠 What does an Engineering Station do?
An Engineering Station is the automation engineer’s toolkit. Typical tasks:
- Programming - writing, compiling and downloading PLC programs in the IEC 61131 languages (ladder, FBD, ST, SFC)
- Configuration - setting up hardware configurations, fieldbuses and IO modules, and building SCADA visualisations and HMI screens
- Diagnostics - monitoring running logic online, forcing variables and troubleshooting faults
- Maintenance - updating the firmware of controllers and components
- Administration - managing project files, documentation and versions as part of governance through change management and version control
In the Purdue Model, the Engineering Station usually sits at level 2 or in a separate engineering network, close to the controllers it programs. It comes in two forms: a fixed workstation in the control room or server room, and a mobile engineering laptop that an engineer carries to the machine.
🔧 Which software runs on an Engineering Station?
Every vendor has its own engineering software, and an Engineering Station often holds several packages and versions side by side so that older installations can still be maintained.
| Vendor | Engineering software | Typical systems |
|---|---|---|
| Siemens | TIA Portal (STEP 7, WinCC), SIMATIC Manager | S7-1200, S7-1500, S7-300/400 |
| Rockwell Automation | Studio 5000 Logix Designer (RSLogix 5000 up to v20) | ControlLogix, CompactLogix |
| Mitsubishi Electric | GX Works | MELSEC iQ-R, iQ-F |
| Various brands | CODESYS | Multi-vendor IEC 61131-3 controllers |
| Schneider Electric | TriStation 1131 | Triconex safety systems |
| DCS vendors | DeltaV, System 800xA, Experion, CENTUM VP, PCS 7 | Distributed process control |
Besides the programming software, an Engineering Station has a set of standard components:
| Component | Function |
|---|---|
| Programming software | Creating and downloading logic and configuration |
| Drivers and communication libraries | Connecting to controllers over, for example, ProfiNET or EtherNet/IP |
| Backup and recovery tools | Safeguarding project data and controller contents |
| Simulation tools | Testing logic offline before it goes live |
| Security measures | Authentication, logging, allowlisting and network segmentation |
🎯 Why is an Engineering Station such an attractive target?
Whoever controls the Engineering Station can push legitimate-looking changes into controllers. The traffic to the PLC looks normal, because it comes from the system that always sends it. Three well-known attacks illustrate this:
| Attack | Year | Target | Role of the Engineering Station |
|---|---|---|---|
| Stuxnet | discovered 2010 | Siemens S7 controllers driving centrifuges in Iran | Infected STEP 7 project files and replaced the communication library, so manipulated code reached the PLC unnoticed |
| TRITON | 2017 | Triconex safety system at a Saudi petrochemical plant | Attackers gained access to the SIS engineering workstation and reprogrammed the safety controllers from there |
| PIPEDREAM | 2022 | Schneider Electric and Omron PLCs and OPC UA servers | Toolkit compromises Windows engineering workstations through a vulnerable ASRock driver (CVE-2020-15368) |
In the TRITON case the malware was disguised as trilog.exe, a name resembling a legitimate
Triconex utility. The attack only worked because the controller’s keyswitch was left in PROGRAM mode. A
mistake by the attackers caused the safety system to shut the plant down safely, which led to the
discovery. These cases make clear that an Engineering Station must be treated as a crown jewel within a defence-in-depth strategy.
🔐 How do you secure an Engineering Station?
Hardening an Engineering Station combines technical and organisational measures:
- Dedicated use - engineering software only; no office applications, no internet and no email on the station
- Application allowlisting - only approved programs and drivers may run, which also blocks unknown kernel drivers like the one PIPEDREAM used
- Strong authentication - personal accounts, MFA and least privilege; no shared “engineer” accounts
- USB control - USB ports disabled or limited to scanned, registered media
- Backups - project files and controller contents saved after every change, with one copy offline
- Logging and monitoring - logons, downloads to controllers and driver installations recorded and forwarded to a SIEM
- EDR or integrity monitoring - where the vendor supports it, with detection of unusual processes
- Patch management - updates only after vendor approval, tested on a reference system first
- Physical safeguards - keyswitches on controllers and safety PLCs, where fitted, left in RUN by default, and the station kept in a locked room
💻 How do you handle vendor engineering laptops?
Mobile laptops are the biggest risk: they visit other networks, are used for email and travel to other customers. A sound policy covers:
- Owner-managed laptops - ideally an external engineer works on a laptop or virtual workstation provided by the asset owner, not on their own device
- No direct connection - vendor laptops are not simply plugged into the OT network; access goes through a jump server or a separate maintenance segment
- Controlled remote access - sessions on request, with MFA, a time limit and session recording
- Scanning station - files and USB media are scanned before they enter the OT domain
- Contractual requirements - base your requirements on IEC 62443-2-4, which sets out security requirements for integrators and maintenance service providers
📏 What does IEC 62443 say about the Engineering Station?
The IEC 62443 series does not have a dedicated chapter on the Engineering Station, but many requirements apply to it directly. In IEC 62443-4-2 the station falls under the host device component type (a device with a general-purpose operating system such as Windows), and the engineering software under software application.
| IEC 62443-3-3 requirement | Subject | Application to the Engineering Station |
|---|---|---|
| SR 1.1 | Human user identification and authentication | Personal accounts, MFA |
| SR 2.3 | Use control for portable and mobile devices | Policy for USB and engineering laptops |
| SR 3.2 | Malicious code protection | Allowlisting, antivirus or EDR |
| SR 3.4 | Software and information integrity | Checks for modified projects and firmware |
| SR 7.3 | Control system backup | Regular backups of projects and controllers |
| SR 7.7 | Least functionality | No unnecessary software, services or ports |
Through the zoning approach of IEC 62443-3-2, the Engineering Station also gets its own zone or a place in the zone of the controllers it manages, and IEC 62443-3-3 determines which requirements apply to that zone per security level. For organisations in the EU that fall under NIS2, such as Dutch essential and important entities under the Cyberbeveiligingswet in force since 15 August 2026, these measures form part of the duty of care.
🧭 How do you approach security step by step?
- Inventory - map all fixed stations, laptops and virtual engineering workstations, with software versions and the controllers each one can reach.
- Segment - place stations in their own zone with firewall rules that allow only the required engineering protocols to the target controllers.
- Harden - remove unnecessary software, enable allowlisting and lock down USB.
- Control access - personal accounts, MFA and time-limited rights for third parties.
- Keep a golden baseline - after every approved change, store a reference version of the PLC program and compare the running code against it periodically.
- Monitor - have an OT monitoring system alert on downloads, mode changes or firmware updates outside a planned change.
- Practise recovery - test at least once a year whether you can restore a station and a controller from backup.
🏭 What does this look like in practice?
- An engineer programs a PLC for a new production line and loads the logic during a planned shutdown.
- A software update for an HMI is rolled out from the Engineering Station after approval in the change process.
- Network configurations for redundant systems are adjusted and recorded in version control.
- Faults are analysed by monitoring the logic online, without changing the program.
❓ Frequently asked questions
What is the difference between an Engineering Station and an HMI?
An Engineering Station is used to create control logic and configurations and load them into controllers. An HMI or operator station is used to operate and monitor a running process. An operator can change setpoints through an HMI, but the program in a PLC is changed with the engineering software on an Engineering Station.
Should an Engineering Station have internet access?
An Engineering Station should have no direct internet access and no email. Software updates and licences are delivered through a controlled route, for example a patch server in the DMZ. This prevents phishing or drive-by downloads from landing straight in the OT environment.
Why did TRITON and Stuxnet target the Engineering Station?
An Engineering Station legitimately has the rights and software to reprogram controllers. Stuxnet abused STEP 7 projects to send manipulated code to Siemens PLCs, and TRITON used a compromised SIS engineering workstation to modify Triconex safety controllers. By taking over the Engineering Station, attackers do not have to crack the industrial protocol themselves.
How often should you back up an Engineering Station?
Project files on an Engineering Station should be backed up after every approved change, supplemented by a periodic full image of the station. Keep at least one copy offline so that ransomware cannot encrypt it. Test restores regularly, because old software versions and licences often make recovery difficult.
May a vendor connect their own laptop to the OT network?
A vendor laptop should preferably not be connected directly to the OT network, because you do not know the state of that device. It is better for the vendor to work on a managed Engineering Station or through a jump server with MFA and session recording. Set out the requirements in the contract, for example based on IEC 62443-2-4.
Is a virtual Engineering Station more secure?
A virtual Engineering Station can be more secure, because you manage it centrally, can restore it quickly from a snapshot and can route access through a jump server. The security of the virtualisation platform itself then becomes critical. Not all engineering software supports virtualisation or USB passthrough for licence dongles, so check this with the vendor.
📌 In summary
An Engineering Station is the workstation engineers use to program and configure PLCs, DCSs, safety systems and HMIs, making it the key to how an industrial plant behaves. Stuxnet, TRITON and PIPEDREAM show that attackers deliberately seek out this station. Treat it as a crown jewel: dedicated, without internet or email, with allowlisting, MFA, USB control, backups and logging, and with strict rules for vendor laptops in line with IEC 62443.