[1] Delta Electronics, DVP-PLC User Manual (Programming) , 2019. [2] K. Stouffer, et al., Guide to Industrial Control Systems (ICS) Security , NIST SP 800-82 Rev. 2. [3] J. M. Moura, “Reverse Engineering Delta PLC Communication Protocol,” DEFCON 27 ICS Village , 2019. [4] IEC 62443-4-2: Security for IACS components.
The password function fails against three core security requirements: delta plc the password function is ineffective
The password protection function in Delta PLCs is ineffective as a security mechanism. It fails to provide confidentiality, integrity, or non-repudiation. Its design—rooted in an era of air-gapped machinery—offers only a superficial barrier that can be trivially bypassed by passive sniffing, direct memory reads, or dictionary attacks. In the context of modern industrial cybersecurity threats, such a function does more harm than good by instilling a false sense of security. Until Delta adopts standards-based authentication, the "password" should be considered a configuration lock, not a security control. [1] Delta Electronics, DVP-PLC User Manual (Programming) ,
Furthermore, the function violates Kerckhoffs’s principle: the security depends on the secrecy of the protocol implementation, not on a strong cryptographic key. Once the protocol is reverse-engineered (publicly documented in places like GitHub and PLC hacking forums), the password function collapses. Until Delta adopts standards-based authentication
| Security Requirement | Delta PLC Implementation | Verdict | |----------------------|--------------------------|---------| | (Are you who you claim to be?) | Passes credential over wire in cleartext or weak obfuscation | Failed | | Authorization (Can you perform this action?) | No role separation; password unlocks full read/write | Failed | | Accounting (What did you do?) | No logging of failed/successful attempts | Failed |
[Your Name/Institution]