Rockwell Automation recommends upgrading to ISaGRAF Runtime 5 version 5.72.00.

Customers should ensure that the least-privilege user principle is followed, and user/service account access to Runtime’s folder location is granted with a minimum amount of rights as needed.

For ISaGRAF, customers are encouraged to restrict or block traffic on TCP 1131 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by ISaGRAF refer to product documentation.

For AADvance controllers, customers are encouraged to restrict or block traffic on TCP 1132 from outside of the industrial control system network zone.

For Micro800 family, to reduce risk, customers are encouraged to protect the controller with a password. Additionally, customers deploying Micro870, Micro850, or Micro830 controllers are encouraged to put the controller’s mode switch to “RUN”. Customers are encouraged to restrict or block traffic on TCP 44818 from outside the industrial control system network zone.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

Customers should also confirm they are employing proper network segmentation and security controls. Specifically, network exposure for all control system devices should be minimized, and control systems should be behind firewalls and isolated from other networks when possible.¹