Kruno Jurlina

September 25, 2025 3:42 pm Published by

In industrial practice, mindsets such as “Don’t touch what works”, “Keep it simple”, or “It had to be finished yesterday” often prevail. While practical, this mindset significantly complicates - and in some cases completely prevents - the application of fundamental cybersecurity principles in control systems. An additional challenge lies in the lack of official guidelines and real-world examples for secure PLC programming, leaving engineers to rely on ad-hoc solutions and improvisation.
To help bridge this gap, the professional community has developed the “Top 20 Secure PLC Coding Practices” document, with related guidelines on secure system architecture currently in preparation. This presentation will provide a concise overview of the most relevant and impactful recommendations from these guidelines, illustrated with real-world examples of both good and bad practices. The aim is to raise awareness and encourage the adoption of more secure development practices within OT environments.

Kruno Jurlina holds a master's degree in electrical engineering and has more than 20 years of experience in developing, integrating and maintaining supervisory control systems in diverse industrial sectors. Since 2016, he has specialized in the field of operational technology (OT) cybersecurity and, since 2018, has held the ISA/IEC 62443 Cybersecurity Expert certification.
He has participated in numerous projects related to the cybersecurity of critical infrastructure, with a strong focus on the application of international standards and best practices. He was actively involved in the global initiative "Top 20 Secure PLC Coding Practices" and is the author of the Croatian translation of these guidelines. He currently leads the Cybersecurity and Digital Transformation program at ATO Inženjering d.o.o., one of the region’s foremost system integrators and the market leader in OT cybersecurity.
From the very beginning, he has been engaged with the Croatian Institute for Cybersecurity, where he currently serves as the Chair of the Committee for Industrial Control Systems Cybersecurity.

Categorised in: 2025

This post was written by user_298812