Securing Modbus Networks: 12 Best Practices for OT & Industrial Cybersecurity

Modbus was designed in 1979 with no built-in security, no authentication, no encryption and no integrity checking. It was the right product with the right features for its time.

Today, many Modbus devices carry non-critical data and cybersecurity is not an immediate priority. But when a compromised Modbus network can threaten safety, disrupt production or cause financial harm, strict security measures are required.

Follow these 12 best practices to harden your Modbus (RTU and TCP) architecture against common industrial cybersecurity vectors.

1. Physically Secure Your Modbus RTU Network

Modbus RTU networks can be compromised in two primary ways:

• An unauthorized node inserted directly onto the physical line to capture or inject traffic
• A direct compromise of the Modbus RTU Master device

Because Modbus RTU traffic is unencrypted and easily decoded, physical security is your first line of defense. Keep all Modbus serial devices, cabling and master controllers inside locked cabinets or other locations not accessible to an attacker.

2. Harden The Modbus RTU Master Device

A Modbus RTU Master in a critical application should be an IEC 62443-4-1 compliant device. IEC 62443 is the international benchmark standard for the cybersecurity of Industrial Automation and Control Systems (IACS). Using compliant hardware ensures the device was built using secure development processes and integrated security controls, which lowers your cybersecurity risk.

3. Use Secure Modbus TCP Connections Over Port 802

Traditional Modbus TCP communicates over TCP port 502 with no encryption or authentication. Modbus Security adds Transport Layer Security (TLS) protection to Modbus TCP. This standard uses mutual X.509 certificate authentication and shifts traffic to TCP port 802 to encrypt data in transit.

4. Isolate Modbus TCP Networks from Enterprise and IT Systems

Modbus TCP is not a secure protocol. It should never be connected to the Internet or even an Enterprise network. A Modbus TCP network is used to collect and manage devices in a production control system. It is not designed to cooperatively exist on a larger, IT-type network.

Besides the lack of authentication or encryption, Modbus devices are often fragile and not designed for other kinds of traffic. Unexpected traffic can cause havoc with some of these devices.

5. Configure Firewall Rules to Only Allow Authorized Traffic

Firewalls offer varying levels of security. Standard IT firewalls can block unauthorized IP addresses, but OT firewalls offer Deep Packet Inspection (DPI) at line speeds, offering the most protection by inspecting Modbus payload data directly.

6. Restrict Modbus Function Codes and Write Commands

Only permit the Modbus function codes required by the application. If a monitoring application only requires data acquisition, permit only read operations:

• Read Coils (FC 01)
• Read Discrete Inputs (FC 02)
• Read Holding Registers (FC 03)
• Read Input Registers (FC 04)

Block any write functions, such as Write Single Coil/Register (FC 05) and Write Multiple Coils/Registers (FC 16), unless they are specifically required. Better firewalls and gateways can enforce this at the Modbus application layer.

This is a strict rule because an attacker who can read temperatures is annoying. An attacker who can write setpoints or coils can affect the process. NIST guidelines specifically recommend application-layer filtering and least privilege communications for industrial networks.

7. Prohibit Pass-Through Commands

Many developers like the flexibility of using a Modbus Client or Master device that supports pass-through commands. A pass-through feature allows a user to send any Modbus command through the device at any time. The Master or Client simply puts it directly on the Modbus network.

Of course, while it provides flexibility for the developer, it also offers unlimited opportunities for an attacker to put commands on the Modbus network. Eliminate this attack vector by disabling any pass-through feature on your Modbus Master or Client.

8. Strictly Control Remote Access to Modbus Networks

Never permit direct remote access to Modbus devices. Vendor and engineering access should go through a controlled access point using multi-factor authentication (MFA), encrypted VPN sessions and time-bound, access-on-demand permissioning.

The United States Cybersecurity and Infrastructure Security Agency (CISA) specifically identifies secure configuration and management of remote access as an important ICS security practice.

9. Disable Unused Ethernet Switch Ports

An open, unpopulated switch port is an invitation for an attacker. Disable these ports in software, or better yet, use a hardware lock to make sure they can’t be used.

10. Monitor Modbus Traffic for Unexpected Activity

Establish a baseline of normal Modbus network communications and continuously monitor for operational deviations. Key indicators of compromise include:

• New or unknown Modbus Client IP addresses
• Unexpected function codes or write requests
• Queries directed to abnormal register ranges
• Rapid Unit ID scanning or abnormal polling frequencies
• Communication from unauthorized IP addresses

Early detection allows operators to isolate misconfigurations or malicious activity before it impacts the physical process.

11. Use A Data Diode On Monitoring-Only Networks

If your system only requires monitoring of Modbus data, using a data diode provides excellent protection. A data diode is a cybersecurity hardware device that enforces unidirectional data flow. This means that data travels in a single direction with no possibility of return traffic.

In these applications, connect a data diode to the device collecting Modbus data and use it to publish data outside the zone you want to keep secure.

12. Don’t Use a Modbus Client on an Unhardened Computer

Standard Windows PCs are not only attacked more often but go through update and reboot cycles that can interrupt Modbus TCP network polling.
Critical Modbus client applications should be run on dedicated, hardened industrial hardware. Strip unnecessary OS services, lock down administrative privileges, restrict outbound network access and enforce strict patching schedules.

Harden Modbus Architectures with RTA Gateways

Legacy Modbus RTU and TCP devices rarely support modern security features like TLS or role-based access natively. RTA Modbus RTU gateways and Modbus TCP gateways bridge the gap between legacy field devices and modern OT networks without exposing your process to risk. RTA Modbus gateways:

• Act as a firewall between networks, physically and logically separating them
• Convert data internally rather than passing raw pass-through commands
• Run optimized firmware designed to eliminate general-purpose OS vulnerabilities

Contact the RTA Enginerds to find the right Modbus gateway for your application. Email solutions@rtautomation.com or call and speak to an Enginerd at 800.249.1612.