SCADA security is not “one password on the HMI”. Build layers: unique user identity, role-based permissions, protected engineering access, network controls, backups, patch/change management and PLC-side validation of critical commands.
- Define roles and protected actions before creating user accounts.
- Use least privilege: users receive only the functions needed for their job.
- Protect critical writes in both WinCC and PLC logic; HMI security alone is not a process interlock.
- Test every role by attempting both allowed and denied actions during commissioning.
Practical WinCC Engineering Guide
This technical guide focuses on WinCC User Administrator, SCADA security and hands-on Siemens PLC / SCADA commissioning practices.
1. SCADA Security Model for WinCC
A practical security model separates identity, authorization and process validation. WinCC identifies the logged-in user and controls HMI permissions. The operating system/network protect the station and communications. The PLC still validates whether a command is permissible for the current machine state.
User Identity → WinCC Role/Permission → Screen/Command Authorization → PLC Permissive/Interlock → Audit/History
2. Define Roles Before Creating Accounts
Avoid assigning permissions one user at a time without a role model. Start with job functions and create a permission matrix.
| Role | Typical allowed actions | Typical restrictions |
|---|---|---|
| Operator | Start/stop permitted equipment, acknowledge alarms, select approved recipe | No engineering changes, no user administration |
| Maintenance | Diagnostics, manual maintenance functions, limited resets | No recipe master edits unless required |
| Supervisor | Production overrides defined by policy, recipe approval, reports | No project engineering by default |
| Engineer | Engineering/commissioning functions in controlled mode | Access limited to authorized personnel |
| Administrator | User/security administration | Not used as a routine operator account |
3. Map Permissions to HMI Actions
List every high-impact action and assign the minimum role required. Examples include motor start/stop, auto/manual selection, alarm reset, setpoint edit, recipe edit, maintenance bypass, report deletion, user management and Runtime exit.
For setpoints, use both authorization and range validation. A user may be permitted to edit temperature, but the PLC should still reject values outside the approved engineering range.
4. Configure WinCC Users, Groups or Roles
In WinCC Classic, user administration is commonly engineered with the User Administrator. Other WinCC generations use their own user/role engineering environment. Create groups/roles first, assign permissions, then add named user accounts.
- Use unique accounts instead of shared “operator/operator” credentials.
- Do not use the administrator account for routine operation.
- Apply the password/session rules available in the installed product and plant policy.
- Document account ownership and disable accounts that are no longer required.
5. Protect Screens, Buttons and Critical Commands
Authorization should be enforced at the action itself, not only by hiding a navigation button. A hidden button is a usability technique; it is not the entire security boundary.
- Protect recipe-edit controls.
- Protect maintenance/manual commands.
- Protect Runtime exit and engineering shortcuts.
- Protect user administration.
- Make denied actions clear to the operator without revealing sensitive configuration details.
6. Login, Logout and Session Behavior
Define what happens when no user is logged in, when a session times out and when a shift changes. Shared terminals should not remain indefinitely authenticated as an engineer. If automatic logout/session timeout is available and compatible with operations, use it according to plant policy.
7. Engineering and Maintenance Access
The engineering workstation and Runtime server deserve stricter control than a standard operator action. Restrict who can modify the WinCC project, download PLC changes, change network settings or install software. Maintain tested backups and a documented change-management process.
Remote access should be explicitly authorized, time-bounded where possible, and protected by the organization’s approved secure-access architecture rather than exposing SCADA services directly to the internet.
8. Network and Platform Security Controls
WinCC user permissions are one layer of an industrial cybersecurity program. Coordinate with OT/IT policy for network segmentation, host firewall rules, patch management, malware protection compatible with the control system, time synchronization, backups and account lifecycle management.
- Separate control networks from general office networks where architecture requires it.
- Allow only required communication paths and services.
- Keep engineering laptops controlled and scanned according to site policy.
- Protect backup media and restore procedures.
- Review third-party remote-support access.
9. Audit and Accountability
For critical operations, record who changed what and when using the audit/history capabilities available in the installed WinCC environment or the plant’s approved logging system. At minimum, important recipe changes, setpoint changes, alarm acknowledgements and security administration should have defined accountability where process requirements demand it.
10. Security Commissioning Test
- Log in as Operator and verify allowed production controls.
- Attempt a protected engineering or recipe-edit action and confirm denial.
- Log in as Maintenance and test the approved diagnostic/manual functions.
- Log in as Supervisor and test only the additional approved privileges.
- Verify administrator functions are inaccessible to operational accounts.
- Test logout/session behavior and what permissions remain when no user is logged in.
- Attempt an out-of-range setpoint as an authorized user and confirm PLC validation still rejects it.
11. Common WinCC Security Problems
| Problem | Likely cause | Check |
|---|---|---|
| User can see screen but button fails | Action permission missing | Control authorization and user role |
| Everyone uses one account | No role/account lifecycle process | Create named users and groups |
| Engineer stays logged in | No session discipline/timeout | Logout policy and supported timeout settings |
| HMI blocks edit but PLC accepts external write | Security only implemented at HMI | PLC validation and network/write paths |
| Cannot reconstruct parameter change | No audit/history requirement implemented | User/event logging design |
12. Hands-On Role-Based Access Lab
Create Operator, Maintenance, Supervisor and Engineer roles. Protect recipe editing, setpoint changes, maintenance mode and Runtime exit with different permissions. Test every role against an access-control matrix and document pass/fail evidence.
WinCC User Roles & Permissions Lab
Hands-on lab- Use a training or test system, not a live production plant.
- Document the starting PLC/WinCC state and expected result.
- Verify communication and backups before applying engineering changes.
Build role matrix
Define Operator, Maintenance, Supervisor and Engineer permissions.
Configure users
Create test users and assign only the planned rights.
Protect actions
Apply authorization to recipe edits, maintenance mode and Runtime exit.
Prove defense in depth
Try an invalid setpoint with an authorized account.
Frequently Asked Questions
What is WinCC User Administrator?
In WinCC Classic, User Administrator is used to configure users/groups and authorizations. Other WinCC generations use different user/role engineering interfaces.
What is least privilege in SCADA?
Least privilege means each user receives only the permissions needed for the assigned operational or engineering role.
Is hiding a button enough to secure a command?
No. Apply authorization to the action and keep process validation/interlocks in the PLC. Hiding a control is not a complete security boundary.
Should operators share one WinCC account?
Unique user identities are preferable where accountability is required. Shared accounts reduce traceability and make access revocation difficult.
Does WinCC security replace network security?
No. User permissions are one layer. Industrial security also requires controlled engineering access, network architecture, host security, backups and change management.