Sanitized in the Source: Removing Embedded Objects from PLC Projects with CDR

Industry reports on security trends continue to show that malware is infiltrating Industrial Control Systems (ICS) and Operational Technology (OT) environments. These environments contain specialized machines that mechanically operate our world.

Programmable Logic Controllers (PLC) are the central nervous system of those machines and are responsible for making real-time decisions. As with people, it is essential to keep infections out. Prevention measures, such as Content Disarm and Reconstruction (CDR), exist to remove malicious code from sanitizable files.

However, Programmable logic controllers are sensitive to changes in the files that power their logic, and those changes can have real-world consequences. Little academic research has been conducted on CDR, and even less on the effects of CDR sanitization on ICS/OT files.

This research seeks to outline a methodology to sanitize supported PLC project files for security while also confirming their operational reliability.