Deploying CrowdStrike Falcon Sensor and EDR Software in SIMATIC PCS 7 Environments

Running CrowdStrike Falcon Sensor or modern Endpoint Detection and Response (EDR) software on SIMATIC PCS 7 stations (OS Servers, OS Clients, ES, and Process Historian) is possible but requires strict engineering controls to prevent industrial process disruption. While Siemens officially qualifies specific signature-based antivirus suites in PCS 7 Compendium Part F, cloud-native EDR platforms inspect kernel-level memory and network sockets. To deploy CrowdStrike safely, start in Detection-Only (Audit) mode, apply comprehensive exclusions for Siemens directories, SQL databases, and runtime binaries, exclude real-time industrial communication drivers (Hardnet CP 1623), and validate operation in a staging testbed prior to production rollout.

Industrial Cybersecurity: Antivirus vs Cloud-Native EDR Architecture

Modern industrial automation security mandates, such as IEC 62443 and NIS2, frequently require enterprise IT security teams to extend Endpoint Detection and Response (EDR) agents to Operational Technology (OT) networks. CrowdStrike Falcon Sensor is a cloud-managed EDR agent that operates via a lightweight kernel driver (CSAgent.sys) to provide continuous behavioral analysis, machine-learning threat detection, and automated threat isolation.

In traditional PCS 7 architectures, Siemens qualifies specific antivirus suites (such as Trend Micro Apex One, McAfee Endpoint Security, or Symantec Endpoint Protection) using published compatibility lists and tested exclusion profiles documented in SIMATIC PCS 7 Compendium Part F - Industrial Security. Because CrowdStrike Falcon does not rely on classic static virus signature files, deploying it requires an understanding of how behavioral heuristic blocking interacts with industrial control system middleware.

Risks of Kernel-Level EDR Agents on SIMATIC PCS 7 Operations

SIMATIC PCS 7 relies heavily on deterministic, low-latency inter-process communications, proprietary device drivers, and high-throughput database transactions:

Real-Time Network Latency: Industrial Ethernet communication via CP 1623 (6GK1162-3AA00) or Intel BCE drivers uses specialized NDIS protocol drivers (s7wn_ndx.sys). Real-time network filtering or packet interception by EDR can cause communication timeouts on the Plant Bus, triggering spurious AS-OS disconnects or redundant server failovers.
Microsoft SQL Server Locking: WinCC and Process Historian continuously commit fast-cycling historical tags and alarm messages into SQL Server data files (*.mdf, *.ldf). Synchronous I/O hooks by EDR agents can lock database headers, leading to WinCC archive buffer overflows or slow picture opening times.
Process Injection False Positives: WinCC runtime processes (e.g., CCProjectMgr.exe, CCDataServer.exe, PdlRuntime.exe, Script.exe) use dynamic shared memory and internal API hooks to exchange process tags. Aggressive EDR behavioral policies may classify these memory hooks as process injection attacks, terminating WinCC runtime abruptly.

Comparison of Traditional AV vs EDR in SIMATIC PCS 7

The following table compares certified signature-based antivirus solutions with cloud-native EDR platforms in PCS 7:

Operational AttributeCertified Signature-Based AntivirusCloud-Native EDR (e.g. CrowdStrike Falcon)Siemens Qualification StatusTested and whitelisted in PCS 7 Compendium Part FEvaluated under customer responsibility (not vendor-certified)Detection MechanismFile signature hashes and scheduled static scansContinuous behavioral telemetry, kernel hooks, AI heuristicsCloud ConnectivityOffline signature updating supported via local serverRequires outbound TLS telemetry to cloud or dedicated proxyAutomated RemediationQuarantine or delete infected filesAutomated process termination, process freeze, network isolationCPU / Memory FootprintHigh disk I/O during scheduled scan windowsLow disk I/O; continuous low-overhead kernel telemetryOperational Risk to OTLow (when standard Siemens exclusions are applied)High if automated prevention/containment policies are active

Mandatory Exclusion Rules and Deployment Strategy for CrowdStrike Falcon

To deploy CrowdStrike Falcon Sensor safely across PCS 7 Engineering Stations, OS Servers, and OS Clients, follow this strategy:

Policy Phasing (Audit Mode First):
- Assign all PCS 7 assets to a dedicated CrowdStrike Host Group with a custom Prevention Policy.
- Configure all detection and prevention toggles to Detect Only (Disable 'Block', 'Quarantine', and 'Sensor-based ML Prevention') for at least 30 days.
- Monitor the CrowdStrike Falcon Console for false-positive alerts triggered by WinCC, SQL Server, or STEP 7.
Configure Mandatory Path and Directory Exclusions:
- Exclude core Siemens installation directories from file inspection:
- C:\Program Files (x86)\Siemens\*
- C:\Program Files (x86)\Common Files\Siemens\*
- C:\ProgramData\Siemens\*
- WinCC Project directories containing *.mcp, *.pdl, *.pas, *.fct.
Exclude Database and Archive Extensions:
- File extension exclusions: *.mdf, *.ldf, *.pcf, *.dcf, *.csv.
- Exclude SQL Server executable: C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Binn\sqlservr.exe.
Disable Network Containment and Threat Isolation:
- Disable the CrowdStrike 'Network Containment' feature for all industrial controllers, servers, and clients. An accidental network quarantine of an OS Server severs operator visibility to the physical plant.

Verification

Verify system stability and communication integrity after agent deployment:
1. Check the WinCC System Log (C:\Program Files (x86)\Siemens\WinCC\Diagnose\WinCC_Sys_*.log) for any CCDataServer communication errors or database lock warnings.
2. In WinCC Explorer, verify that the Redundancy status (@RedundancyServerState) remains stable without intermittent split-brain states.
3. Monitor CPU utilization and memory footprint via Windows Performance Monitor (perfmon.msc); ensure CSFalconService.exe consumes < 2% CPU during peak alarm bursts.
4. Open complex plant graphics on OS Clients; confirm picture open times remain within the standard < 2 second baseline.

Limitations and Operational Precautions

Never Enable Autonomous Network Containment: Automated host isolation must be strictly disabled on all OT nodes. Isolating an OS server during an operational disturbance can compromise emergency shutdown oversight.
Cloud Connectivity Restrictions: In isolated OT architectures (Purdue Model Level 2/3) without direct internet access, CrowdStrike requires an outbound proxy or Falcon Proxy Gateway to transmit telemetry.
Vendor Supportability: In the event of an unexplained PCS 7 crash or WinCC freeze, Siemens Customer Support will require temporarily disabling third-party non-certified kernel drivers before investigating core dump logs.

Engineer FAQ

Does Siemens officially certify CrowdStrike Falcon Sensor for PCS 7?

No. Siemens officially qualifies specific antivirus solutions (e.g. Trend Micro, McAfee, Symantec) in PCS 7 Compendium Part F. CrowdStrike Falcon is classified as customer-provided endpoint security software and is deployed under user responsibility with proper exclusion tuning.

Can CrowdStrike cause an OS Server redundancy switchover?

Yes. If the sensor driver delays inter-server heartbeat packets across the Terminal Bus or delays SQL Server archive commits, the standby server may assume the master has failed, triggering an unwanted redundancy switchover.

How should CrowdStrike Falcon updates be managed in an OT environment?

Sensor version upgrades must be configured to 'Auto-update disabled' or set to a controlled sensor update policy in the Falcon cloud console. Upgrades should only be released to OT stations during scheduled plant maintenance windows.