Hello to all,
What will be the implications of European Cybersecurity resilience act in the Modbus RTU protocol?

 

Most Modbus devices doesn't have any encryption by default since its a simple DATA exchange between 2 devices.
The slave doesn't know who the master is, if a hacker has access to your Modbus network, he can behave like master and gain full control of any of your Modbus slave devices. (Remember STUXNET ??)

If you need more compliant one then switching to OPC UA is the most preferred way in the industry.

 

Modbus RTU is a serial protocol developed before external data security regimens existed. It does not have a structure that would support attainment of CRA compliance. Since the core data mechanisms are similar, Modbus/TCP on Ethernet faces similar compatibility issues to cybersecurity requirements. The briliance and success of these protocols relates to early origination in the market, simplicity, openness, and near ubiquitous support across vendors. The market would need solutions to encapsulate or emulate them within a secure shell to continue future viability.

 

Without knowing the details of the law/rule, it is very likely users will be forced to upgrade their RTU devices over to Modbus TCP.

Uses the same RTU packet, but encapsulated in a TCP packet which is secure.

There are already PLENTY of adapters for legacy instruments.

OR.....

They force everyone to use EtherNet/IP for everything lol

 

Agree on the general direction of mgirating towards Ethernet based to improve security, but taking issue with "TCP packet which is secure". Standard Modbus/TCP is not considered secure in the sense of ability to meet CRA and other evolving cybersecurity standards. The enhanced Ethernet version (Modbus/TLS) seems likely to fit that bill, but implementing backwardly compatible secure solutions seems far from trivial in the near term.

 

Hello to all,
What will be the implications of European Cybersecurity resilience act in the Modbus RTU protocol?

One practical point I’d add is that “moving to Ethernet” does not automatically make Modbus secure. For legacy OT environments, I usually look first at segmentation, access control, protocol exposure, remote access paths, and monitoring before thinking about protocol replacement. In many plants, compensating controls are more realistic than replacing every field device at once