Building NIS2-ready security into a machine that was never designed to be attacked
This engagement turned a system that was functionally solid but had grown organically over years - like most industrial control software - into one with a documented, prioritized path toward NIS2 compliance. Behind it is ERKO’s own attitude: awareness of the threats, a mature approach to security, and a sense of responsibility for its product and for the customers who run ERKO machines every day. Close cooperation between the ERKO and 54Soft teams paid off, raising the security of the solution both on the hardware side - the PLC and its configuration - and in the BPS software that works with it.
- 24vulnerabilities and security gaps fixed, critical ones first
- AES-256encrypted, certificate-pinned OPC UA link between BPS and the PLC
- 0known-vulnerable dependencies after upgrading the package tree
Overview
- BPS, ERKO's own purpose-built application, communicates directly with a production PLC over OPC UA, putting it squarely inside NIS2's scope for OT/industrial control systems.
- Combined static analysis (SAST), black-box dynamic fuzzing (DAST), and manual architecture review, benchmarked against IEC 62443 alongside NIS2 Article 21
- Generated a full software bill of materials (SBOM) and cross-checked every component against multiple public vulnerability databases
- Identified a mix of critical, high, and medium-severity findings, risk-ranked so remediation could start with what mattered most
- Folded SAST, dependency scanning, native code analysis, and SBOM generation into the SDLC process, running on every pull request
- Rebuilt the BPS-to-PLC link on OPC UA with AES-256 encryption, mutual certificate trust, PLC certificate pinning and authenticated login
- Reviewed the access management policy and upgraded the dependency tree to zero known-vulnerable packages
BPS is ERKO's own Busbar Processing Software, and it doesn't just design and animate busbar geometry - it talks directly to the machine's PLC over OPC UA to drive the bending and punching of Al/Cu busbars. That direct link to physical production equipment is exactly what pulls BPS into NIS2's Article 21 requirements for OT/industrial-control security: risk management, incident handling, business continuity, supply-chain security, secure development, cryptography, access control, and secure communications all have to be demonstrably in place. 54Soft ran a full security assessment of BPS to find out where it actually stood against that bar, and what it would take to close the gap.
How it works
Scope
BPS drives a production PLC over OPC UA, which puts it inside NIS2 Article 21 for OT/industrial control systems.
Assess
Static analysis of the C# and native C/C++ code, black-box dynamic fuzzing and a manual architecture review, plus a full SBOM checked against public vulnerability databases.
Prioritise
Critical, high and medium findings consolidated into one risk register, so remediation starts with what matters most.
Harden
Encrypted, certificate-pinned PLC link, hardened credential storage and upgraded dependencies, with security checks on every application release.
- SAST
- DAST / fuzzing
- SBOM
- OPC UA
- open62541 / OpenSSL
- IEC 62443
- NIS2 Article 21
Solution & Result
We combined three angles: static analysis of the C# and native C/C++ code against OWASP Top 10 and CWE Top 25 rules, black-box dynamic fuzzing across hundreds of automated runs, and a manual review of the architecture and source directly in the repository, benchmarked against IEC 62443's security levels alongside NIS2. In parallel we generated a complete software bill of materials and checked every one of BPS's components - direct and transitive - against public vulnerability and advisory databases. Across all three methods, the assessment turned up a mix of critical, high, and medium-severity findings, consolidated into a single risk register so ERKO had a clear, prioritized view of what to fix first rather than a long undifferentiated list.
Remediation started with the highest-severity findings, and the biggest of them was the PLC link itself. The native OPC UA client was rebuilt on current open62541 and OpenSSL and now accepts only an encrypted, signed channel (Aes256_Sha256_RsaPss) with a user login to the controller. Every workstation gets its own certificate that the PLC must explicitly trust, and BPS pins the PLC's certificate after a service technician confirms its fingerprint, so a swapped or spoofed controller is blocked. The link reconnects on its own after an outage, and any weakened test setting is always flagged on screen. In the application we reviewed how secrets and access are managed, added authenticated encryption for stored settings and credentials, and moved secret comparisons to constant time. A dependency upgrade replaced 38 outdated packages and removed the last known-vulnerable one, backed by 45 new regression tests. SAST, dependency (SCA) scanning, native code analysis and SBOM generation run on every pull request. They still run in reporting mode for now; switching them to blocking mode is the next step, alongside a signed, authenticated update channel for the application.
What the client says
I wholeheartedly recommend working with 54Soft, who demonstrated a high level of professionalism, commitment, and flexibility throughout the execution of the tasks entrusted to them.
Read the full recommendation
Throughout the collaboration, all agreed fixes and modifications were delivered on time, and the response to emerging changes and new requirements was quick and effective.
The team showed great openness to dialogue, while also proposing solutions that supported achieving the project's goals.
The way the work was documented deserves particular recognition.
The scope of the changes made was prepared in a clear, complete way that matched the agreed requirements, which significantly simplified tracking progress and making project decisions.
I also rate the culture of collaboration and communication highly. Meetings were conducted professionally, efficiently, and to the point, and information flowed smoothly at every stage of the project.
As a result, the collaboration was marked by a high degree of transparency and mutual trust.
The company is a reliable and trustworthy business partner, whom I can wholeheartedly recommend for projects that require punctuality, flexibility, high-quality documentation, and a professional approach to the client.
Sławomir MichalskiHead of the Construction Department, ERKO
