SINUMERIK 840D sl. Training. Operate - Turning (2016-2020)

Table of contents

Preface

Fundamental safety instructions

1.1

General safety instructions

1.2

Warranty and liability for application examples

1.3

Security information

What is industrial security?

Why is industrial security so important?

3.1

Networking and wireless technology

3.2

Possible corporate security holes

Security measures in automation and drive technology

4.1

Security measures

4.2

Siemens Industrial Holistic Security Concept

4.3

Standards and regulations

Security management

General security measures

6.1

Defense in depth concept

6.2

Plant safety

6.2.1

Physical protection of critical production areas

6.3

Network security

6.3.1

Network segmentation

6.3.1.1

Separation between production and office networks

6.3.1.2

Network segmentation with SCALANCE S

6.3.2

Cloud Security

6.4

System integrity

6.4.1

System hardening

6.4.1.1

Services and ports

6.4.1.2

User accounts

6.4.1.3

PC/notebooks and mobile devices in an industrial environment

6.4.1.4

Data storage

6.4.1.5

Transporting data

6.4.1.6

Passwords

6.4.1.7

Product security notifications

6.4.1.8

Virus scanner

6.4.1.9

Whitelisting

6.4.2

Patch management

6.4.2.1

Product software

6.4.3

Data integrity

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Table of contents

6.4.4

Disposal

Product-specific security measures

7.1

SINUMERIK

7.1.1

Firewall and networking

7.1.2

Physical protection of the NCU

7.1.3

Machine control panels - SINUMERIK (MCP/MPP)

7.1.4

System hardening

7.1.4.1

Deactivating hardware interfaces

7.1.4.2

Communication services and used port numbers

7.1.4.3

Secure Boot with SINUMERIK ONE

7.1.5

Virus protection

7.1.5.1

Whitelisting

7.1.5.2

Virus protection / memory card

7.1.6

Security updates / patch management

7.1.7

Account management

7.1.7.1

Definition of access levels

7.1.7.2

Safety Integrated password

7.1.7.3

CNC lock function

7.1.7.4

Deleting the preinstalled SSH key

7.1.7.5

PLC web server

7.1.7.6

Access levels for softkeys

7.1.7.7

BIOS and AMT access protection

7.1.7.8

Password protection for Create MyConfig (CMC)

7.1.8

Know-how protection

7.1.8.1

SINUMERIK Integrate Lock MyCycles

7.1.8.2

SINUMERIK Integrate Lock MyPLC

7.1.8.3

OPC UA

7.1.8.4

User administration in the TIA Portal

7.1.8.5

SIMATIC Logon

7.1.9

Data backup

7.1.10

Disposal

7.2

CNC Shopfloor Management Software

7.2.1

System overview

7.2.2

Cloud applications (In Cloud)

7.2.2.1

Manage MyMachines /Remote

7.2.3

PC/Server/Desktop applications (In Line)

7.2.3.1

SINUMERIK Integrate 4.1

7.2.3.2

Cloud mode

7.2.4

Controller-related applications (In Machine, SINUMERIK Edge)

7.2.4.1

SINUMERIK Edge

7.3

SIMOTION

7.3.1

System hardening

7.3.1.1

Port security

7.3.1.2

Virus scan, Windows security patches, SIMOTION P

7.3.2

Secure project storage

7.3.3

Know-how protection

7.3.3.1

Secure access control with SIMATIC Logon

7.3.3.2

Know-how protection in engineering

7.3.3.3

Copy protection for the configuration on the control system

7.3.4

Offline/online comparison

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Table of contents

7.3.5

SIMOTION IT Web server

7.3.6

OPC UA server

7.3.7

Disposal

7.4

SINAMICS

7.4.1

Network security

7.4.2

Know-how protection

7.4.3

Parameters: Access levels and password

7.4.4

Using the memory card

7.4.5

Safety Integrated

7.4.6

Communication services and used port numbers

7.4.7

Integrated web server

7.4.7.1

Certificates for the secure data transfer

7.4.8

Information about individual interfaces

7.4.9

Disposal

7.4.10

SINAMICS Startdrive and TIA Portal

7.4.10.1

Malfunctions of the machine as a result of incorrect or changed parameterization

7.4.10.2

SINAMICS Startdrive

7.4.10.3

SINAMICS STARTER

7.4.11

SINAMICS Drive Control Chart (DCC)

7.4.11.1

Industrial security with SINAMICS DCC

7.4.11.2

Use write and know-how protection

7.4.12

SINAMICS Smart Access Module

7.5

SIMOCRANE

References

101

Glossary

105

Index

111

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Fundamental safety instructions

1.1

General safety instructions

WARNING

Danger to life if the safety instructions and residual risks are not observed

If the safety instructions and residual risks in the associated hardware documentation are not

observed, accidents involving severe injuries or death can occur.

● Observe the safety instructions given in the hardware documentation.

● Consider the residual risks for the risk evaluation.

WARNING

Malfunctions of the machine as a result of incorrect or changed parameter settings

As a result of incorrect or changed parameterization, machines can malfunction, which in turn

can lead to injuries or death.

● Protect the parameterization against unauthorized access.

● Handle possible malfunctions by taking suitable measures, e.g. emergency stop or

emergency off.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Fundamental safety instructions

1.2 Warranty and liability for application examples

1.2

Warranty and liability for application examples

Application examples are not binding and do not claim to be complete regarding configuration,

equipment or any eventuality which may arise. Application examples do not represent specific

customer solutions, but are only intended to provide support for typical tasks.

As the user you yourself are responsible for ensuring that the products described are operated

correctly. Application examples do not relieve you of your responsibility for safe handling when

using, installing, operating and maintaining the equipment.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Fundamental safety instructions

1.3 Security information

1.3

Security information

Siemens provides products and solutions with industrial security functions that support the

secure operation of plants, systems, machines and networks.

In order to protect plants, systems, machines and networks against cyber threats, it is

necessary to implement - and continuously maintain - a holistic, state-of-the-art industrial

security concept. Siemens’ products and solutions constitute one element of such a concept.

Customers are responsible for preventing unauthorized access to their plants, systems,

machines and networks. Such systems, machines and components should only be connected

to an enterprise network or the internet if and to the extent such a connection is necessary and

only when appropriate security measures (e.g. firewalls and/or network segmentation) are in

place.

For additional information on industrial security measures that may be implemented, please

visit

https://www.siemens.com/industrialsecurity https://www.siemens.com/industrialsecurity ).

Siemens’ products and solutions undergo continuous development to make them more secure.

Siemens strongly recommends that product updates are applied as soon as they are available

and that the latest product versions are used. Use of product versions that are no longer

supported, and failure to apply the latest updates may increase customer’s exposure to cyber

threats.

To stay informed about product updates, subscribe to the Siemens Industrial Security RSS

Feed under

https://www.siemens.com/industrialsecurity https://new.siemens.com/global/en/products/

services/cert.html#Subscriptions).

Further information is provided on the Internet:

Industrial Security Configuration Manual (https://support.industry.siemens.com/cs/ww/en/

view/108862708)

WARNING

Unsafe operating states resulting from software manipulation

Software manipulations, e.g. viruses, Trojans, or worms, can cause unsafe operating states

in your system that may lead to death, serious injury, and property damage.

● Keep the software up to date.

● Incorporate the automation and drive components into a holistic, state-of-the-art industrial

security concept for the installation or machine.

● Make sure that you include all installed products into the holistic industrial security concept.

● Protect files stored on exchangeable storage media from malicious software by with

suitable protection measures, e.g. virus scanners.

● On completion of commissioning, check all security-related settings.

● Protect the drive against unauthorized changes by activating the "Know-how protection"

converter function.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

What is industrial security?

Definition of industrial security

Generally, industrial security is understood to be all of the measures for protecting against the

following:

● Loss of confidentiality due to unauthorized access to data

● Loss of integrity due to data manipulation

● Loss of availability (e.g. due to destruction of data or Denial-of-Service (DoS))

Objectives of industrial security

The objectives of industrial security encompass:

● Fault-free operation and guaranteeing of availability of industrial plants and production

processes

● Preventing hazards to people and production due to cyber security attacks

● Protection of industrial communication from espionage and manipulation

● Protection of industrial automation systems and components from unauthorized access and

loss of data

● Practicable and cost-effective concept for securing existing systems and devices that do not

have their own security functions

● Utilization of existing, open, and proven industrial security standards

● Fulfillment of legal requirements

An optimized and adapted security concept applies for automation and drive technology. The

security measures must not hamper or endanger production.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Why is industrial security so important?

3.1

Networking and wireless technology

Overview

There are many new trends which affect industrial security:

● Cloud computing in general

The number of network connections across the world is constantly increasing. This enables

innovations such as cloud computing and the applications that go hand in hand with it. In

conjunction with cloud computing, there has been a massive increase in the number of

mobile devices, such as cell phones and tablet PCs.

● Wireless technology

On the other hand, the increasing use of mobile devices has only become possible thanks

to the ubiquitous availability of mobile networks. Wireless LAN is also becoming

increasingly available.

● Worldwide remote access to plants, machines and mobile applications

● The Internet of Things (IoT)

Millions of electronic devices are becoming network-capable and are communicating via the

Internet, such as onboard computers in cars, which transmit warranty information to

dealers, or water meter sensors that transmit water consumption data to municipal water

suppliers via radio.

However, in order for everything from cloud computing to the Internet of Things to function

disturbance-free, you require a reliable network infrastructure and applications that are well

protected against attacks from malware and hackers.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Why is industrial security so important?

3.2 Possible corporate security holes

3.2

Possible corporate security holes

Possible security holes or weak points

The security chain of a company is only as strong as its weakest link. Security holes can exist

at numerous points. The following list gives only a few examples:

● Employees / external companies

● Production plants

● Network infrastructure

● Data centers / PC workstations

● Laptops/tablets

● Printers

● Smartphones/smartwatches

● Mobile data storage media

For this reason, a holistic approach is required to deal with the issue of security. Coordinated

guidelines and regulations are required that cover all areas: Devices, systems, processes and

employees.

The topic of data security and access protection (security) is becoming more and more

important in industrial environments. The following technologies results in higher requirements

placed on protecting and securing industrial plants and systems:

● The ongoing networking of complete industrial plants and systems

● The vertical integration and networking of various company levels

● New techniques, e.g. remote maintenance and/or remote access

The threats are diverse and the consequences are far-reaching:

Possible threats:

Potential threats come from the industry environment and involve the topic of confidentiality,

integrity and availability. Examples of threats include the following:

● Espionage of data, recipes, etc.

● Sabotage of production plants

● System stoppage, e.g. due to virus infection and malware

● Manipulation of data or application software

● Unauthorized use of system functions

Possible effects of a security incident

● Loss of intellectual property

● Loss of production or reduced product quality

● Negative company image and economic damage

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

Siemens automation and drive technology concerns itself with security aspects at the following

levels:

● Application security refers to products and functions that take into consideration the needs

of industrial security in the field of automation. This involves particular consideration of the

application and task at hand, as well as the people performing the actions in an automated

plant. This allows industrial security to be easily implemented in production processes.

● Security support provides support during the analysis, planning, implementation, testing

and optimization of industrial security - by means of specialists with special knowledge of

networks and the industry. These services lead to the highest possible level of industrial

security and operating capacity of the production plant.

Siemens offers comprehensive customer support based on the "Implement Security"

service: With this service you can implement protective measures to increase the security

level of plants and production facilities. You can find more information about the entire

"Implement Security" portfolio on the Internet.

industrial-security/implementation.html)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.1 Security measures

4.1

Security measures

With increasing digitalization, comprehensive security in the automation system is becoming

ever more important. For this reason, industrial security is a core element of every product that

can be networked.

Integration of security into the products

As manufacturer of automation and drive products, Siemens supports secure operation for its

customers by integrating security into its products:

● All of the measures involving automation and drive technology are stored in the Product

Lifecycle Management (PLM) process, which is certified by the German Technical

Inspectorate (TÜV) based on IEC 62443-4-1.

● Analytically potential attack threats are detected and evaluated using Threat and Risk

Analyses (TRA). Identified critical threats are implemented in the product as necessary

basic functions, based on the motto "Security by Design".

● Siemens regularly performs code analyses in order to identify and correct possible errors at

an early stage during the formal check.

● In its products and its manufacturing process, Siemens has implemented measures to

secure integrity to indicate any changes to the integrity.

● Siemens constantly checks the measures relating to hardening:

- Operating systems are configured in such a way that points of attack (e.g. via ports,

unneeded services) are minimized.

- Siemens tests its products to detect weak points at an early stage.

- Siemens offers a specific hotfix/patch management.

Protection of the development infrastructure and supply chain

As manufacturer of automation and drive products, Siemens supports secure operation for its

customers by securing the development infrastructure and supply chain:

● The Siemens ProductCERT (https://www.siemens.com/cert/en/cert-security-

advisories.htm) (Cyber Emergency Readiness Team) is the central department for security-

related incidents in the Siemens product and solution environment. Siemens ProductCERT

supports development work with consulting and other services. ProductCERT provides

information about current threats and vulnerabilities as well as the appropriate

countermeasures.

● Industrial security is a dynamic and complex subject that requires continuous monitoring

and adaptation of new security measures. Information on how Siemens protects its products

and solutions against cyber attacks and how industry profits from the competence of

Siemens can be found on the Internet (https://new.siemens.com/global/en/products/

automation/topic-areas/industrial-security/always-active.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.1 Security measures

Provision of patches, security components, and appropriate services

As manufacturer of automation and drive products, Siemens supports secure operation for its

customers through direct support of integrators and operating companies by providing patches,

security components and the appropriate services:

● SIEMENS offers monitoring through a SIEM system to monitor residual risk. SIEM stands

for Security Information and Event Management and has become an established term in IT

security. Such systems are able to identify and evaluate security-relevant events and notify

the administrator.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.2 Siemens Industrial Holistic Security Concept

4.2

Siemens Industrial Holistic Security Concept

Siemens places great emphasis on protecting the integrity and guaranteeing the confidentiality

of the processed data for its own products. Intellectual property and know-how of the Siemens

products are also in focus.

To achieve this, the Siemens Industrial Holistic Security Concept (SI HSC) is applied which

protects development departments and production plants (see the following diagram). Multi-

level security systems and basic security improvements of the IT infrastructure are

implemented. In parallel, process improvements have been introduced and training in security

awareness provided in the development and production. These measures are being performed

continuously by Siemens and clearly demonstrated by the security levels reached.

SI HSC also benefits the customers who Siemens has selected as partners for their industrial

solutions, or who want to orientate themselves on the concept. Siemens suppliers are also

considered with regard to security so that Siemens already applies the same security standards

when purchasing as for the manufacture of its own products.

0RQLWRULQJ RI

5HVLGXDO 5LVN

3URWHFWLRQ

&RQFHSW

0RQLWRULQJ RI WKH

7DUJHW

UHVLGXDO ULVN LQ RUGHU WR

LPSURYH WKH VHFXULW\

3URWHFWLRQ

6HOHFWLRQ DQG

FRQFHSW ZKHQ UHTXLUHG

/HYHO

LPSOHPHQWDWLRQ RI

%XVLQHVV

H J ZKHQ QHZ WKUHDWV

VXLWDEOH PHDVXUHV LQ

DSSHDU

,PSDFW

6HFXULW\ UHTXLUHPHQWV

RUGHU WR IXOILOO WKH

$VVHVVPHQW

PXVW EH IXOILOOHG E\ WKH

VWLSXODWHG UHTXLUH

,7 LQIUDVWUXFWXUH DQG

PHQWV H J FHOO

6FRSH

6LJQLILFDQFH RI

,7 SURFHVVHV EDVHG

SURWHFWLRQ FRQFHSW

NQRZ KRZ SURWHFWLRQ

RQ LQWHUQDWLRQDO

DQG SURGXFW LQWHJULW\

VWDQGDUGV ,(&

3URGXFWV DQG

IRU WKH FRPSDQ\

DQG ,62

EXVLQHVV DUHDV WDNHQ

LQWR DFFRXQW LQ WKH

+ROLVWLF 6HFXULW\

&RQFHSW

Figure 4-1

SI HSC security management process

Further information

Further information on the Siemens Industrial Holistic Security Concept is available on the

Internet on page Always active (https://new.siemens.com/global/en/products/automation/

topic-areas/industrial-security/always-active.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.3 Standards and regulations

4.3

Standards and regulations

Siemens takes the applicable Industrial Security standards and regulations into consideration

throughout the entire development process:

● ISO 2700X: Management of information security risks

● IEC 62443: IT security for industrial higher-level control systems - network and system

protection

Further information on certifications and standards in the Industrial Security field can be found

on the Internet (https://new.siemens.com/global/en/products/automation/topic-areas/

industrial-security/certification-standards.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security management

The security management process as a basis

Protect your system and your company. Security management according to IEC 62443 and

ISO 27001 forms the basis for the successful implementation of industrial security.

The security management process is shown in the following:

5LVN DQDO\VLV

9DOLGDWLRQ DQG

*XLGHOLQHV RUJDQL]D

LPSURYHPHQW

WLRQDO PHDVXUHV

7HFKQLFDO PHDVXUHV

Figure 5-1

Security management process

1. Carry out a risk analysis. Determine all possible risks and define countermeasures for

reducing the risk to an acceptable level. In detail, a risk analysis encompasses the following

steps:

- Identification of threatened objects

- Analysis of value and potential for damage

- Threat and weak point analysis

- Identification of existing security measures

- Risk evaluation

- Evaluation of the effects with regard to the protection goals of confidentiality, integrity,

and availability

2. Define guidelines and introduce coordinated, organizational measures. To this end, the

awareness of the importance of industrial security must be borne by all levels of the

company. In addition, define guidelines and processes in order to achieve a uniform

procedure and to support compliance with the defined industrial security concept.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security management

3. Introduce coordinated technical measures. You can find a list of general measures that help

to protect your plant against threats in Section General security measures (Page 27). You

can find measures to be considered for SINUMERIK, SIMOTION and SINAMICS

environments in Chapter Product-specific security measures (Page 43).

4. A security audit must ensure that all of the measures have been implemented and that they

have also eliminated or reduced the identified risks.

Note

Continuous process

Due to constantly changing security threats, this process must be continuously repeated in

order to guarantee the security of your plant. For this reason, the security management

process must be seen as a continuous process.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.1 Defense in depth concept

6.1

Defense in depth concept

To protect industrial plants and systems comprehensively against cyber attacks, measures

must be applied simultaneously at all levels. From the operational up to the field level - from

access control to copy protection. For this purpose, we use "Defense in Depth" as a general

protection concept, according to the recommendations of ISA99 / IEC 62443, the leading

standard for security in industrial automation.

'HIHQ

VH LQ GH

3ODQW VHFXULW\

3K\VLFDO DFFHVV SURWHFWLRQ

SURFHVVHV DQG VHFXULW\ VHUYLFH

JXLGHOLQHV IRU WKH SURWHFWLRQ RI

SURGXFWLRQ SODQWV

1HWZRUN VHFXULW\

6HF

XULW

VNV GHPDQ

&HOO SURWHFWLRQ

LRQ

SHULPHWHU QHWZRUN

ILUHZDOOV DQG 931

6\VWHP LQWHJULW\

6\VWHP KDUGHQLQJ

DXWKHQWLFDWLRQ DQG XVHU

DGPLQLVWUDWLRQ SDWFK

PDQDJHPHQW GHWHFWLRQ

RI DWWDFNV

,QWHJUDWHG DFFHVV SURWHFWLRQ

LQ WKH DXWRPDWLRQ

Figure 6-1

Defense in depth strategy

Further information on the defense in depth concept and the planning of a protection concept

for industrial plants can be found on the Internet (https://new.siemens.com/global/en/products/

automation/topic-areas/industrial-security/planning.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.1 Defense in depth concept

Protection levels

A defense in depth model has a three level structure:

● Plant security

Plant security represents the outermost protective ring. Plant security includes

comprehensive physical security measures, e.g. entry checks, which should be closely

coordinated with protective measures for IT security.

● Network security

The measures, grouped under the keyword "Network security", form the core of the

protective measures. This refers to the segmentation of the plant network with limited and

secure communication between subnetworks ("secure islands") and the interface check

with the use of firewalls.

● System integrity

"System integrity" represents the combination of two essential protection aspects. PC-

based systems and the control level must be protected against attacks. Steps include the

following measures:

- Integrated access protection mechanisms in the automation components to prevent

unauthorized changes via the engineering system or during maintenance

- The use of antivirus and whitelisting software to protect PC systems against malware

- Maintenance and update processes to keep the automation systems up-to-date

(e.g. patch management, firmware updates, etc.)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.2 Plant safety

6.2

Plant safety

$QODJHQVLFKHUKHLW

Unauthorized persons may be able to enter the production site/building and damage or alter

production equipment as a result of gaps in a company's physical security. Confidential

information can also be lost. This can be prevented if both the company's site and the

production areas are protected accordingly.

6.2.1

Physical protection of critical production areas

Company security

The company's physical security can be ensured via the following measures:

● Closed off and monitored company premises

● Entry control, keys / card readers and/or security personnel

● Escorting of external personnel by company employees

● Security processes in the company are taught and followed by all employees

Physical production security

The physical security of a production location can also be ensured via the following measures:

● Separate access control for critical areas, such as production areas

● Installation of critical components in lockable control cabinets / switching rooms including

monitoring and alarm signaling options. The control cabinets/contact chambers must be

secured by a cylinder lock. Do not use simple locks, such as universal, triangular/square or

double-bit locks.

● Configuration of the radio field to restrict the WLAN range so that it is not available outside

the defined areas (e.g. factory building).

● Guidelines that prevent the use of third-party data storage media (e.g. USB sticks) and IT

devices (e.g. notebooks) classified as insecure on systems.

Further information

Further information on integrated Siemens security solutions can be found on the Siveillance

page (https://new.siemens.com/global/en/products/buildings/security/security-

management.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

6.3

Network security

1HWZRUN VHFXULW\

Network security includes all measures taken to plan, implement and monitor security in

networks. This includes the control of all interfaces, e.g. between the office network and plant

network, or remote maintenance access via the Internet.

6.3.1

Network segmentation

6.3.1.1

Separation between production and office networks

One important protective measure for your automation or drive system is the strict separation

of the production networks and the other company networks. This separation creates

protection zones for your production networks.

Note

The products described in this manual must only be operated in defined protection zones.

Separation by means of a firewall system

In the simplest scenario, separation is achieved by means of an individual firewall system which

controls and regulates communication between networks.

See also Network segmentation with SCALANCE S (Page 32)

Separation via a DMZ network

In the more secure variant, the coupling is established via a separate DMZ network. In this

case, direct communication between the production network and the company network is

completely prevented by firewalls and only takes place indirectly via servers in the DMZ

network.

Note

The production networks should also be divided into separate automation cells in order to

protect critical communication mechanisms.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

General security measures

Observe the general security measures even within protection zones, for example as listed

in System hardening (Page 36):

6.3.1.2

Network segmentation with SCALANCE S

Siemens provides SCALANCE S security modules to meet network protection and network

segmentation requirements. Further information on SIEMENS SCALANCE S can be found on

the Internet (https://siemens.com/scalance-s ).

SCALANCE S security module

SCALANCE S security modules with Security Integrated provide:

● Stateful inspection firewall

In order to implement user-specific control and logging, firewall rules can also be specified

that only apply to certain users.

● VPN via IPsec (data encryption and authentication)

This establishes a secure tunnel between authenticated users whose data cannot be

intercepted or manipulated. The most important aspect is the protection against external

access via the Internet.

● NAT/NATP (address translation)

● Router functionality (PPPoE, DDNS) for broadband Internet access (DSL, cable)

● SCALANCE S623 with additional VPN port (DMZ) enables the secure connection of an

additional network for service and remote maintenance purposes. S623 also permits the

secure, redundant connection of subordinate networks by means of routers and firewall

redundancy.

● SCALANCE S615 has five Ethernet ports with which different network topologies can be

protected by means of a firewall or Virtual Private Network VPN (IPsec and OpenVPN), and

security concepts implemented flexibly.

Requirement

NOTICE

Data misuse

Long distances between the device to be protected and the upstream security modules

represent an invitation for data misuse.

● Note that upstream security modules, such as SCALANCE S, must be installed close to the

device to be protected in a locked control cabinet. This ensures that data cannot be

manipulated here without notice.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

2EMHFW VHFXULW\

6HFXULW\ PDQDJHPHQW

2IILFH QHWZRUN

'0=

*356

6&$/$1&(

8076

'RPDLQ

3& ZLWK

6HUYHU

FRQWUROOHU

6,0$7,&

ZLWK

,QWHUQHW

66&

URXWHU

&HQWUDO

6&$/$1&(

:HE

DUFKLYH

,QWHUQHW

6,0$7,& ILHOG 3*

VHUYHU

ZLWK 62)71(7

VHFXULW\ FOLHQW

6&$/$1&(

,QGXVWULDO (WKHUQHW

6&$/$1&( 6

3URGXFWLRQ QHWZRUN

3URGXFWLRQ

6,180(5,.

6,0$7,&

' VO

6,0$7,&

ZLWK

&60

$GYDQFHG

6,0$7,&

352),1(7

6,0$7,&

.73

&RPIRUW

6,0$7,&

6,1$0,&6

6,0$7,&

6,1$0,&6

6,0$7,&

6,027,21 ' [ ZLWK

6,1$0,&6

Figure 6-2

SCALANCE S application example

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

VPN access

Note

Note that a SCALANCE S security module must always be used for VPN access.

6.3.2

Cloud Security

Since cloud applications are becoming increasingly common and the cloud continues to grow

in its significance, the issue of security in the cloud environment is also becoming more and

more important.

The following addresses are designed to give you an idea of how you can make your system

safe in the cloud environment. Inform yourself about the applicable requirements and tried and

tested solutions/best practices.

Further information

● Companion Guide for Cloud - CIS Organization (https://www.cisecurity.org/press-release/

cis-controls-companion-guide-for-cloud-now-available/)

● Questionnaire Cloud Security - CSA Organization (https://cloudsecurityalliance.org/

artifacts/consensus-assessments-initiative-questionnaire-v3-0-1/)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4

System integrity

6\VWHP LQWHJULW\

System integrity is understood to mean the "integrity" or "correctness" of the data or the correct

response of the system. Thus, the following measures for protecting the system integrity should

ensure that the data/functionality of the system cannot be manipulated by unauthorized

persons or that manipulations can be detected.

6.4.1

System hardening

6.4.1.1

Services and ports

Activated services and ports represent a risk. To minimize the risk, only the necessary services

for all of the automation components should be activated. Ensure that all activated services are

taken into account (especially Web servers, FTP, remote maintenance, etc.) in the security

concept.

A description of all of the ports used can be found in the Equipment Manuals/Function Manuals

of the respective products.

6.4.1.2

User accounts

Any active user account that allows access to the system is thus a potential risk. Therefore, take

the following security measures:

● Reduction of configured/activated user accounts to the actually needed minimum

● Use of secure access data for existing accounts. This also involves assigning a secure

password.

● Regular checks, especially of the locally configured user accounts

● Regular change of passwords

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.1.3

PC/notebooks and mobile devices in an industrial environment

The terminal devices used in industrial environments (PCs, notebooks and mobile devices)

must meet the generally applicable security requirements. Therefore, take the following

measures:

● The terminal device that is used is set up, administered, regularly checked and patched by

the appropriate departments. This ensures it is always kept up-to-date. This also means that

software and operating systems which are supported and maintained by the manufacturer

are always installed.

● A current virus scanner, which is adapted to the operating system used, must be installed

on the terminal device that is used. Both the virus patterns and the software itself must be

regularly updated. Or, alternatively, work with the Whitelisting (Page 40) method.

● Activate a firewall with appropriate settings on the terminal device that is used.

● Use a configuration without admin. rights on the terminal device that is used.

● Encrypt all of the hard drives or mass storage units (e.g. eMMC or SSD) of the terminal

device that is used to protect sensitive data against unauthorized access.

● Do not use the terminal device for other tasks, e.g. in the office network. This is part of the

separation of networks dealt with in Chapter "Separation between production and office

networks (Page 31)".

● Secure terminal devices from data theft using a physical lock (e.g. Kensington lock) or do

not leave them unmonitored.

● If you leave protected terminal devices at the workstation, always activate the lock mode of

the operating system. This prevents access to the terminal device and the contents of the

screen can no longer be read.

● Set up user accounts (Page 36) for the access rights accordingly.

● Take appropriate measures to protect unneeded interfaces (e.g. USB, network, etc.) to

prevent unauthorized access. This can be done physically using commercially available

USB port locks or via corresponding software measures.

6.4.1.4

Data storage

Note

When you store security-relevant data on your PC, you are responsible for secure data storage.

These include, for example, the following measures:

● Consequent marking of your documents according to confidentiality levels by introducing a

document classification.

● Protection of your encrypted storage locations, such as sharepoints, against manipulation.

● If absolutely necessary, only store your confidential or security-relevant data encrypted on

your PC / systems or the network.

Security-relevant data includes sensitive data, such as archives, passwords, or executable

files (*.exe).

● Regularly back up your security-relevant data and carefully protect it against loss and

manipulation.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.1.5

Transporting data

Note

Apply the following measures when transporting data:

● Always encrypt your emails if you send confidential and/or security-relevant data by email.

● If you wish to transport confidential and/or security-relevant data on a data storage medium

(USB flash drive, hard disk, etc.), carefully investigate as to which data storage media are

considered secure. A regular virus check must be carried out for these data storage media.

Always save your data on local data storage media so that the data is encrypted.

These measures are especially important for sensitive data, such as archives, passwords, or

executable files (*.exe).

6.4.1.6

Passwords

NOTICE

Data misuse caused by using passwords that are not secure enough

Data can be easily misused by using passwords that are not secure enough. Insecure

passwords can easily be guessed or decoded.

● Therefore, change the default passwords during the commissioning and adapt them at

regularly defined intervals.

● Also change passwords for functions that you yourself do not use to ensure that such

unused functions are not misused.

● Always keep your passwords secure, and ensure that only authorized persons have

access to these passwords.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

Note

Assigning secure passwords

Observe the following rules when creating new passwords:

● When assigning new passwords, make sure that you do not assign passwords that can be

guessed, e.g. simple words, key combinations that can be easily guessed, etc.

● Passwords must always contain a combination of upper-case and lower-case letters as well

as numbers and special characters. PINS must comprise an arbitrary sequence of digits.

● When assigning a password, always ensure you are adhering to the applicable company

specifications, e.g. special password policy of the respective company.

● Observe that, in accordance with the applicable company specifications, passwords with

the maximum required minimum length must be assigned.

● Wherever possible and where it is supported by the IT systems, a password must always

have a character sequence as complex as possible.

Programs are available that can help you to manage your passwords. Using these programs,

you can encrypt, save and manage your passwords and secret numbers - and also create

secure passwords.

Further information on assigning secure passwords can be found in Chapter References

(Page 101).

6.4.1.7

Product security notifications

Note

Complying with product security notifications

Threats are extremely diverse in nature and are continually changing. As a consequence,

always keep yourself up-to-date on a regular basis through the Industry Online Support (https://

support.industry.siemens.com/sc/ww/en/sc/2090) regarding whether there are new and

relevant product security notifications for your particular products. Comply with the instructions

provided in the product security notifications.

6.4.1.8

Virus scanner

An anti-virus program, virus scanner or virus protection program is a software that can detect,

block and, if required, eliminate computer viruses, computer worms or Trojans horses.

In principle, virus scanners can only detect known malware (viruses, worms, Trojans, etc.) or

harmful logic and therefore cannot provide protection against all viruses or worms. For this

reason, virus scanners can only be considered as a complement to general precautionary

measures.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

The use of a virus scanner must not impact the production operations of a plant. As the last

consequence, this will lead to even a virus-infected computer not being permitted to

immediately shut down if this would cause the control of the production process to be lost.

NOTICE

Data misuse when using online virus scanners

If you use an online virus scanner, then security-relevant or confidential data can get into the

wrong hands and be misused.

● Therefore, do not check any security-relevant or confidential data via an online virus

scanner.

Note

Keep virus scanners up-to-date

Always ensure that the virus scanner database is always up-to-date.

Note

Do not install several virus scanners together.

You must always avoid installing several virus scanners together in one system.

Note

Operation in a local network

Always use a virus scanner when locally connecting with the plant or system network.

6.4.1.9

Whitelisting

The basic philosophy of whitelisting is that all applications are mistrusted, unless they have

been classified as trustworthy after an appropriate check. This means that a whitelist is

maintained in the system. This whitelist therefore contains all applications that have been

classified as trustworthy and consequently can be run on your PC systems.

Whitelisting mechanisms provide additional/alternative protection against undesired

applications or malware and unauthorized changes to installed applications or executable files

(.exe, .dll).

Heed the corresponding product-specific information (Page 43) to determine whether the use

of virus scanners and/or whitelisting is recommended.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.2

Patch management

WSUS

The WSUS (Windows Server Update Service) system functionality provided by Microsoft is

available for current Windows systems. WSUS supports administrators by providing Microsoft

updates in large local networks. WSUS automatically downloads update packages (Microsoft

update) from the Internet and offers them to the Windows clients for installation.

The fully automatic update process ensures that Microsoft security updates are always

available on Siemens clients.

NOTICE

Security gaps for out-of-date operating systems

Note that security updates, hotfixes, etc. are no longer supplied by Microsoft for obsolete

operating systems < Windows 10. As a consequence, dangerous security gaps can occur with

your operating system.

● Therefore always upgrade your operating system - if possible - to the latest version.

● If you work with an older operating system, take appropriate additional measures (e.g.

whitelisting) to protect your system.

Note

Before installing Microsoft Updates, note the following important points:

● Prior to the update, back up the system status for a fallback, if necessary. Ensuring the

compatibility of the update with the individual system configuration is the responsibility of the

customer.

● Never establish a direct connection to the WSUS server in the Internet! Ensure that the

environment is secure and install an intermediate layer (e.g. DMZ network, firewall,

SCALANCE S modules, etc.).

6.4.2.1

Product software

Note

Out-of-date product software also represents a potential security gap for attacks.

● As a consequence, always install the latest product software versions.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.3

Data integrity

Data integrity is understood to mean the correctness (integrity) of data and the correct

functioning of systems. Ensuring the integrity of the data is thus an essential goal of information

security. Integrity protection should not be confused with protecting the confidentiality.

NOTICE

Corruption of data and the resulting malfunctioning of the system

For automation and drive systems as well as controller components, data such as archives

and programs can be imported from external sources. This data influences the behavior of

these systems and should therefore be protected against unauthorized changes.

Data such as archives, programs, and OA applications can also be saved and archived. The

systems currently do not provide the capability of ensuring the integrity of programs, archives,

and OA applications.

Therefore take your own measures for ensuring integrity to guarantee the data integrity of your

archives, OA applications, or other saved data:

● Apply the Siemens Industrial Holistic Security Concept.

● Use digital signatures to protect data.

● Ensure there is sufficient access protection:

- Restrict access rights such as to data archives/Sharepoints accordingly.

- Do not send any unencrypted/unsigned emails.

6.4.4

Disposal

The products are to be disposed of in accordance with the respectively valid national

regulations. The products described in this manual are extensively recyclable on account of the

low-toxic composition of the materials used. To recycle and dispose of your old equipment in

an environmentally friendly way, please contact an appropriate disposal company.

NOTICE

Misuse of data resulting from insecure methods of deleting data

Incomplete or insecure deletion of data from memory cards or hard drives can lead to misuse

of the data of the part programs, archives, etc. by third parties.

● Therefore ensure that all storage media are securely deleted before disposing of the

product :

● There are programs that support you in securely deleting/formatting storage media.

Alternatively, contact a certified data destruction specialist to take care of this task.

Also observe the special disposal information of the products in Chapter Product-specific

security measures (Page 43).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1

SINUMERIK

The following chapter provides you with an overview of the security-related measures that you

must take to protect your SINUMERIK control from threats. Detailed descriptions and

procedures can be found in the corresponding SINUMERIK documentation.

Many products (SINUMERIK, SIMOTION, SINAMICS) contain OpenSSL. The following

applies to these products:

● This product contains software (https://www.openssl.org/ ) that has been developed by the

OpenSSL project for use in the OpenSSL toolkit.

● This product contains cryptographic software (mailto:eay@cryptsoft.com) created by Eric

Young.

● This product contains software (mailto:eay@cryptsoft.com) developed by Eric Young.

7.1.1

Firewall and networking

NCU/PCU networking structure

The following graphic shows the networking of the control (NCU) and the IPC. X130 at the NCU

and eth 1 at the IPC are used to establish a connection to the company network. A firewall

protects these two interfaces against unauthorized access.

The NCU contains a packet filter functionality (firewall) that filters the connection to the factory

network. This integrated firewall is preconfigured with optimum settings for the incoming and

outgoing communication. The firewall is configured in such a way that access to the networks

behind the firewall is blocked, and when several logon attempts are made from a certain IP

address, this is identified, blocked and prevented. In this way, the control is protected against

brute-force attacks.

The IPC has the firewall function via the Windows functionality.

NOTICE

Data misuse via an unprotected interface

Since the X120 interface of the NCU or the eth2 port of the IPC are not protected by a firewall,

there is a risk of misuse of data. The interface only provides the option of establishing a

connection to the local plant/system network.

● As a consequence, never connect this local network with the Internet/company network.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

(WKHUQHW

)LUPHQQHW]ZHUN

)LUHZDOO

HWK ZLWK

ILUHZDOO

6HUYHU

6,180(5,. 23

3&8 7&8

HWK

6,180(5,.

RSHUDWRU SDQHO

&RPSDQ\ QHWZRUN

;

ZLWK ILUHZDOO

&RPSDQ\ QHWZRUN

;

ZLWK ILUHZDOO

/RFDO +0,

SODQW V\VWHP

QHWZRUN

;

6,180(5,.

[ '

;

/RFDO VHUYLFH

;

EHL 6,180(5,. 21(

352),1(7

6,180(5,. 21(

6,180(5,.

' VO

Figure 7-1

Networking of NCU/IPC

Firewall settings

Ethernet interface X130 of the NCU and the eth1 interface of the IPC are protected by a firewall

for security reasons. If individual programs require access to a communication port for

communication purposes, you can activate or deactivate the firewall via SINUMERIK Operate.

Additional ports can be separately released.

Alternatively, you can configure the firewall via the "basesys.ini".

Further information

Further information on the configuration of the firewall and default settings can be found in the

following manuals:

● SINUMERIK Operate (IM9) (https://support.industry.siemens.com/cs/de/en/view/

109769186)

● Diagnostics Manual (808D) (https://support.industry.siemens.com/cs/de/en/view/

109763685)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.2

Physical protection of the NCU

NOTICE

Misuse, manipulation and theft

Modules, such as the NCU, are open equipment. If not protected, there is the risk of misuse

by unauthorized personnel, manipulation or theft of data (e.g. CompactFlash Card).

● As a consequence, always install NCUs in housings and locked control cabinets or in

electrical rooms. Only appropriately trained and authorized personnel may access these

housings, electrical cabinets and electrical rooms. Information on the permitted locks can

be found in Chapter Physical protection of critical production areas (Page 30).

● Further information on the control cabinet installation of the NCU can be found in the

SINUMERIK 840D sl NCU 7x0.3 PN Manual (https://support.industry.siemens.com/cs/de/

en/view/99922219) or in the corresponding Equipment Manuals for SINUMERIK ONE:

"NCU1750" and "NCU1760".

7.1.3

Machine control panels - SINUMERIK (MCP/MPP)

Machine control panels (Machine Control Panels and Machine Push Button Panels) are

available for user-friendly operation of SINUMERIK machine functions.

Note

Only operate the machine control panels (MCP/MPP) on an internal, local machine network

and secure them against any possible external access.

Note

Firmware update

For MCP/MPP/PP72-48 firmware updates or module diagnostics (Port 3845) contact Siemens

Service&Support (https://support.industry.siemens.com/sc/ww/en/sc/2090 ).

See also

Passwords (Page 38)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.4

System hardening

7.1.4.1

Deactivating hardware interfaces

Deactivating interfaces

Measure

Description

Deactivate/activate Ether-

You can activate or deactivate the Ethernet interfaces in the BIOS of the PCU.

net interfaces in the BIOS of

You can find detailed information on this in PCU-Basesoftware (IM8) Commissioning Manual

the PCU

(https://support.industry.siemens.com/cs/de/en/view/109748542 ), Chapter "BIOS settings".

Deactivating/activating

To prevent malware entering the control or the plant network via the USB interfaces, you can

USB interfaces

disable the USB interfaces of the NCU. Use the service command "sc_usb disable". Enter the

relevant command on the Service Desktop in the "Run" dialog box or at the prompt. Use this

function to make your system more secure and protect it from unwanted manipulation and

malware.

Further information can be found in the PCU-Basesoftware (IM8) Commissioning Manual

(https://support.industry.siemens.com/cs/de/en/view/109748542 ), Chapter "How to discon-

nect the USB interfaces".

Deactivating ports

Measure

Description

Deactivating the PROFI-

In STEP 7 HW Config, a PROFINET interface port of a SINUMERIK PLC can be deactivated

NET port for

(X150). It is activated by default. The SINUMERIK PLC cannot be accessed via a deactivated

SINUMERIK 840D sl PLC

PROFINET interface port.

Further information can be found in the SIMATIC S7-300 CPU 31xC and CPU 31x Equipment

Manual: Technical specifications (https://support.industry.siemens.com/cs/de/en/view/

12996906), Chapter "Configuration of the port properties".

No communication function.

Note that no communication functions, such as PG/OP functions, open IE communication or S7

communication (PROFINET IO), are possible via a deactivated port.

Deactivating the PROFI-

The PROFINET port can be deactivated in the TIA Portal under "Device configuration". Select

NET port for SINUMERIK

the PLC and then switch to the menu "General > PROFINET interface> Advanced op-

ONE PLC

tions > Port > Port options". Uncheck the box for "Activate this port for use".

Further information can be found in the TIA Portal online help.

Deactivating

For secure operation, only one defined access point should be available to the network for

a PROFINET port of

diagnostics/maintenance. All of the other ports to the controls, devices, or switches (Scalance

SCALANCE X switch

X) should be deactivated. This prevents unauthorized access.

(possible as of the X200 ser-

Further information can be found in the SIMATIC NET Configuration Manual: SCALANCE

ies)

X-200 Industrial Ethernet switches (https://support.industry.siemens.com/cs/de/en/view/

109757352), Chapter "Ports".

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.4.2

Communication services and used port numbers

SINUMERIK supports certain communication protocols. The address parameters, the relevant

communication layer as well as the communication role and the communication direction are

decisive for each protocol.

This information allows you to match the security measures for the protection of the automation

system to the used protocols (e.g. firewall).

Further information can be found in the product information for "SINUMERIK port lists"

(available soon).

Note

System hardening for software solutions

When using SINUMERIK Integrate software and other PC applications (e.g. Create MyConfig

(CMC) or Access MyMachine (AMM)), make sure that the PC on which the software is used,

always fulfills the requirements of industrial security.

These include, for example:

● Current Microsoft security updates

● Current virus scanner software

● Activated firewall, etc.

Further information can be found in Section System integrity (Page 36).

7.1.4.3

Secure Boot with SINUMERIK ONE

Note

Only signed software

The SINUMERIK ONE NCUs have a Secure Boot feature that ensures that only software that

is signed by Siemens can be loaded onto the NCU. This concerns both GIV software versions

of the controller and any other software (e.g. SINAMICS TEC). Once a *.tgz file is imported and

there is no accompanying *.sig file, the NCU will no longer ramp up.

In this situation, the controller can no longer be accessed via any interface. The previously

installed software can no longer be deleted.

7.1.5

Virus protection

In the context of the length of the service life of a machine tool, the use of antivirus software

does not make sense.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

The reasons for this are as follows:

● Continuous pattern updates necessary

The protection of an antivirus program is only as good as the up-to-datedness of its virus

patterns. Providing this in day-to-day production of the machine without a direct Internet

connection is not possible without further action.

● Changed patterns and backg1round scans affect the runtime behavior of the controller

Scans that run in the backg1round can influence the system load and thus the system

behavior of the machine. The longer the pattern list, the more time and resource-consuming

the scan, which means the influence increases as the machine ages.

● Short support times

As a rule, updates and patterns for antivirus software are provided by the end of the

operating system support, at the latest. However, a machine tool generally has a

significantly longer service life than a Windows operating system. Therefore the protection

becomes ineffective against new threats over time.

● Unforeseeable backlash effects on machine functionality

In certain circumstances, a pattern update can result in a desired system function being

detected by the antivirus software as a suspicious operation and prevented from executing,

which can have unforeseeable consequences for the operation of the machine.

Reasons for whitelisting

The use of whitelisting makes sense for protecting a Windows-based IPC in the SINUMERIK

system for the following reasons:

● In a normal scenario, whitelisting does not require updates to continuously protect the

machine.

● Whitelisting does not lose its protective effect over the service life of the machine (apart from

technical progress).

● Whitelisting also protects against malware that may not yet be known to an antivirus

program.

Note

Measures for protecting against viruses in a CNC environment

Take all the necessary measures for virus protection in the CNC environment. This also

includes the proper handling of data storage media, USB sticks and network connections,

precautionary measures when copying data and during software installations, etc.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.5.1

Whitelisting

SINUMERIK application example

Using the McAfee Application Control Software as example, a description as to how

SINUMERIK PCU 50 with Windows XP can be "hardened" is provided. The licensed software

can be used with the PCU 50 as a standalone version (Solidifier/Solidcore). The whitelisting

software is directly purchased from the manufacturer.

A detailed description of this application can be found on the Internet (https://

support.industry.siemens.com/cs/ww/en/view/89027076).

7.1.5.2

Virus protection / memory card

The memory card must be handled with particular care for all SINUMERIK devices that use a

memory card so that no malicious software is loaded to the system.

WARNING

Risk of death due to software manipulation when using exchangeable storage media

Storing files on exchangeable storage media poses an increased risk of infection, e.g. with

viruses and malware. Incorrect parameter assignment can cause machines to malfunction,

which can lead to injuries or death.

● Protect files stored on exchangeable storage media from malicious software using

appropriate protection measures, e.g. virus scanners.

7.1.6

Security updates / patch management

For organizational reasons, it is not possible to provide the latest Windows security patch when

the PCU / the IPC is shipped.

Windows 10-based SINUMERIK IPCs are basically delivered with variant LTSB 2016. This

version of Windows not only provides extended support, but also gives you the capability of

installing patches for specific problems and there are no compulsory updates.

Provide your Windows-based devices with the current security updates in a timely manner.

These updates should not take place during machine operation. Therefore, use a local WSUS

server (see Chapter Defense in depth concept (Page 28)).

Note

Before installing Microsoft Updates, note the following important points:

● Prior to the update, back up the system status for a fallback, if necessary. Ensuring the

compatibility of the update with the individual system configuration is the responsibility of the

customer.

● Never establish a direct connection to the WSUS server in the Internet! Ensure that the

environment is secure and install an intermediate layer (e.g. DMZ network, firewall,

SCALANCE S modules, etc.).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

Since it is usually difficult to regularly update the Windows operating system of an IPC for a

machine that is in use, and no more updates are available after the end of the support period,

you should ensure the IPC is protected in accordance with the Defense in Depth concept

(Page 28), e.g. by means of a security router and the use of a whitelisting solution.

Possibly identified security weak points of the NCU are taken into account or corrected in the

current CNC software version.

Note

Availability

The availability of Microsoft security updates is published via Microsoft Security Bulletins. The

use of security updates is entirely up to the customer and is their sole responsibility. This can

be realized based on the "evaluation of maximum severity" provided in the Microsoft Security

Bulletin. Microsoft publishes information on security updates for the PCU and download links

on the Internet (https://technet.microsoft.com/en-us/security/bulletins ).

See also

Patch management (Page 41)

7.1.7

Account management

7.1.7.1

Definition of access levels

Access to functions and machine data

The access concept controls access to functions and data areas. Access levels 1 to 7 are

available, where 1 represents the highest level and 7 the lowest level. Access levels 1 to 3 are

locked using a password and 4 to 7 using the appropriate key-operated switch.

Ac-

Locked by

Area

Data class

cess

level

Password: SUNRISE

Machine manufacturer

Manufacturer (M)

Password: EVENING

Service

Individual (I)

Password: CUSTOMER

User

User (U)

Key-operated switch set-

Programmer, machine setter

User (U)

ting 3

Key-operated switch set-

Qualified operator

User (U)

ting 2

Key-operated switch set-

Trained operator

User (U)

ting 1

Key-operated switch set-

Semi-skilled operator

User (U)

ting 0

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

Linux passwords / NCK

Level

User name

UID

manufact

102

service

103

user

104

operator3

105

operator2

106

operator1

107

operator

108

Corresponding to the named user, there is always a Unix group with the same name (also with

the GID to the UIDs). As user, you are always member of your own group and also in all "lower-

level" groups. For example, "operator2" is a member of the "operator2", "operator1" and

"operator" groups. The file access rights are mainly controlled via these groups.

NOTICE

Data misuse caused by using passwords that are not secure enough

Data can be easily misused when passwords that are not secure enough are created.

Passwords that are not secure enough can be easily hacked into.

The default passwords for the basic commissioning procedure are listed in the

documentation.

● Therefore, always change the preassigned default passwords during commissioning

● Change the passwords at regularly defined intervals.

● For CNC software <V4.8: During commissioning, change the Linux password in addition to

the SINUMERIK Operate passwords. You can find additional information in the

Commissioning Manual "NCU operating system".

● A continuous warning appears on the SINUMERIK ONE if the default passwords are not

changed.

Further information on assigning secure passwords can be found in Chapter Passwords

(Page 38).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

Note

Changing passwords between SINUMERIK Operate and Linux

The access levels for SINUMERIK Operate and Linux are merged as of software version

4.8 SP3 (840D sl/828D) and 6.13 (SINUMERIK ONE). Changing a password for

SINUMERIK Operate simultaneously changes the relevant password in Linux and vice versa.

It is important to note the following behavior:

● When a general NC reset is performed, no passwords are reset to the default passwords.

● Following a software upgrade, the SINUMERIK Operate passwords apply to the NC

unchanged.

● Once a password has been changed, it cannot be reset to its original state.

● When recommissioning the system with Restore [-full] (menu item in the Emergency Boot

System "Recover system from USB memory stick (reformat CF card)"), the CF card is

formatted and restored to a system in the delivery state. The passwords are not included in

the SINUMERIK archive. Therefore, always change the default passwords after a Restore

[-full] to individual passwords.

7.1.7.2

Safety Integrated password

In SINUMERIK Operate, commissioning data is generally protected via various access levels.

You protect the safety-related drive parameterization additionally with the Safety Integrated

password. This password is stored in the drive data so that it can be changed only by authorized

persons who know the password.

Note

The SINAMICS Safety password must be used for SINUMERIK Safety

The assignment of the Safety Integrated password using the SINUMERIK Operate screen is

supported as of V4.8 SP2 HF1. The assignment of the Safety Integrated password is also

supported by a screen form of the SINUMERIK ONE Commissioning Tool.

● Always set a Safety password to prevent parameters from being changed using the external

configuration software Starter or the commissioning software SINAMICS Startdrive.

Further information can be found in the Safety Integrated plus Commissioning Manual.

See also

SINUMERIK 840Dsl Safety Integrated plus Commissioning Manual (https://

support.industry.siemens.com/cs/de/en/view/109777982)

Further information

You can find further information on how you can change the passwords of the access levels

along with other information on access levels for programs and softkeys and access rights for

files in the SINUMERIK Operate (IM9) Commissioning Manual (https://

support.industry.siemens.com/cs/ww/en/view/109769186), Chapter "General

settings > Access levels".

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.7.3

CNC lock function

You can use the "CNC lock function" and the encrypted file that was created with SINUMERIK

Integrate Access MyMachine (AMM) application to activate a lock date in the control. This

allows the use of the machine to be limited to the time until the lock date is reached. The NC

Start function of the control is locked when the lock date is exceeded.

The CNC lock function supports the business model with time-limited use. This protects against

unauthorized use beyond the set interval.

Note

Only for SINUMERIK 828D

Note that the CNC lock function is only available on the SINUMERIK 828D controller.

Further information on the CNC lock function and on the creation of a lockset file can be found

at:

● "SINUMERIK Integrate Access MyMachine /P2P (PC)" Operating Manual (https://

support.industry.siemens.com/cs/de/en/view/109770206)

● "PLC" Function Manual, Chapter "P4: PLC for SINUMERIK 828D > CNC lock function"

7.1.7.4

Deleting the preinstalled SSH key

Application

Removing the SSH key preinstalled by Siemens reduces the risk of data misuse. However, in

order to ensure sufficient access to the system, you can define and install your own SSH key.

Service command

The service command 'sc' is a tool used for performing a range of service tasks on a

SINUMERIK NCU:

Syntax:

sc clear preinstalled-keys

Alternative names:

---

Authorization level

service

This command deletes all of the SSH keys preinstalled by Siemens on the control. When called

from the service system, the keys on the CompactFlash card are affected, and not the SSH

keys on the service system itself.

Further information

You can find additional information in the Base Software and Operating Software

Commissioning Manual (https://support.industry.siemens.com/cs/de/en/view/109763236 ).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.7.5

PLC web server

In the delivered state, the PLC has no password and the Web server of the PLC is not activated.

Note

● If you activate the PLC Web server in the S7 project, you must define an appropriate user

and an associated password for it. Create a secure password. When creating a new

password, carefully follow the information provided in Chapter Passwords (Page 38).

● Only use the HTTPS protocol to establish communication confidentiality and integrity.

Further information

Further information on the PLC web server can be found in the Function Manual S7-1500, ET

200SP, ET200pro web server (https://support.industry.siemens.com/cs/ww/en/view/

59193560).

7.1.7.6

Access levels for softkeys

The display and operation of softkeys can be suppressed by both the OEM and the user. This

allows the operating software to be specifically adapted to the required functional scope and

therefore be configured as transparently as possible. To prevent access to functions in the

operating software, or to restrict the possibility of operator errors, restricts the functional system

scope.

Note

Applicability of modified access levels for softkeys

The setting of specific access levels for softkeys on a PCU only affects the respective PCU

softkeys themselves. To implement access rights on the NCU, both the manufacturer and the

user must use the appropriate mechanisms and set the rights accordingly.

Further information can be found in the SINUMERIK Operate (IM9) Commissioning Manual

(https://support.industry.siemens.com/cs/ww/en/view/109769186 ), Chapter "Access levels for

programs".

7.1.7.7

BIOS and AMT access protection

In order to prevent unauthorized access to the BIOS of the PCU 50 and the SIMATIC IPCs,

make sure that you use a very secure BIOS password (see Section Passwords (Page 38))

Further information

Further information on BIOS settings of the PCU 50 can be found in the PCU-Basesoftware

(IM8) Commissioning Manual (https://support.industry.siemens.com/cs/de/en/view/

109748542).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

Setting the password for AMT (Intel® Active Management Technology)

The Active Management Technology (AMT) function is used for the remote management of the

PCU. For remote management, generally suitable protective measures must be taken (such as

network segmenting) in order to guarantee secure operation of the plant.

For security reasons, AMT is deactivated when a PCU is delivered. When you activate AMT the

first time in the BIOS setup, assign a strong password to prevent misuse of the remote

management.

Further information on the AMT function of the PCU as well as the procedure for changing the

password can be found on the Internet (https://support.industry.siemens.com/cs/de/en/view/

52310936).

7.1.7.8

Password protection for Create MyConfig (CMC)

NOTICE

Data misuse due to incorrect assignment of rights

Access data, such as the pre-configured passwords for access to the control system, can be

stolen and misused.

● For that reason, set up organizational measures to ensure that only authorized persons are

given access to these files.

Note

Password protection for linked external files

The protection mechanisms integrated into CMC (password protection) are ineffectual for

linked external files that are integrated into the CMC context.

Note

Protecting CMC packages from reimporting

Note that CMC packages have to be protected by password against being reimported.

● For that reason, always set up a password against reimporting when you assign a password

for a new project.

7.1.8

Know-how protection

The following functions provide protection of technological know-how and prevent

unauthorized access to the SINUMERIK controllers:

7.1.8.1

SINUMERIK Integrate Lock MyCycles

Using the "SINUMERIK Integrate Lock MyCycles" (cycle protection) function, cycles can be

encrypted and then stored protected in the control. The cycles are encrypted outside the control

using the SINUMERIK Integrate Access MyMachine/P2P program.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

For cycles with cycle protection, execution in the NC is possible without any restrictions.

In order to protect the manufacturer's know-how, any type of view is inhibited for cycles with

cycle protection.

This software option is available for the SINUMERIK 808D, 828D and 840D sl controllers.

You can find an application example for cycle protection for SINUMERIK on the Internet (https://

support.industry.siemens.com/cs/ww/en/view/109474775).

Further information

Further information on cycle protection can be found in the SINUMERIK Access MyMachine /

P2P (PC) Operating Manual (https://support.industry.siemens.com/cs/ww/en/view/

109770206).

7.1.8.2

SINUMERIK Integrate Lock MyPLC

With the aid of block properties, you can protect the blocks created in the SIMATIC PLC from

unauthorized changes, for example.

The block properties should be edited when the block is open. In addition to properties that can

be edited, data that is only displayed for your information is also displayed in the respective

dialog field: It cannot be edited.

A block that has been compiled using this option does not allow you to view the instruction

section. The interface of the block can be viewed, but not changed.

Further information

You can find further information on block protection in the SIMATIC Programming with STEP

7 Programming and Operating Manual (https://support.industry.siemens.com/cs/de/en/view/

109751825), Chapter "Block properties".

Note

The integrated CP in the SINUMERIK 840D sl does not support the "Module access protection /

protection level" option.

Encryption of blocks

As of STEP 7 Version 5.5 SP3 and the CNC system software V4.5 SP2 for 840D sl/ 840D sl or

V6.13 for SINUMERIK ONE, you can create encrypted block protection for functions and

function blocks in the offline and online view. You can use this function to encrypt your blocks

and protect the block code against external access.

The option "SINUMERIK" and, if required, "SIMATIC" must be selected for the encryption with

SINUMERIK.

A detailed procedure of how to encrypt your blocks can be found on the Internet (https://

support.automation.siemens.com/WW/view/en/45632073).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.8.3

OPC UA

OPC UA (Unified Architecture) is a standardized, industrial communication protocol for access

to control data, e.g. by higher-level control systems. Variables of a SINUMERIK 840D sl,

SINUMERIK 828D or SINUMERIK ONE can be read and written to via this communication

protocol using the SINUMERIK Integrate Access MyMachine /OPC UA software option.

NOTICE

Date misuse resulting from an insecure connection to the client

There is a danger of data misuse due to an unencrypted connection to the OPC UA client.

● Therefore, always encrypt your connection to the OPC UA client.

● Information on the encryption of the data connection can be found in the SINUMERIK

Access MyMachine /OPC UA Configuration Manual (https://

support.industry.siemens.com/cs/de/en/view/109777871).

NOTICE

Data misuse due to incorrect user administration / rights assignment

A significant security risk can ensue through incorrect user administration and faulty right

assignment. Users can access data or actions for which they have not been authorized.

● As a consequence, always very carefully consider which users are assigned which rights.

As administrator, you are responsible for professional user administration and assignment

of rights.

Note

Selecting a secure password

Always set a secure password for your connection to the OPC UA client! Further information on

selecting a secure password can be found in Section Passwords (Page 38).

7.1.8.4

User administration in the TIA Portal

The TIA Portal gives you the capability of using user administration for projects. In this way, for

example, a project can be protected against unintentional or unauthorized modification. A user

sets up the project protection to activate user management. This user is created as a project

administrator. Once the project protection has been activated, the project can only be opened

and edited by authorized users. Note that project protection cannot be revoked.

User administration via the TIA Portal is available for the SINUMERIK 840D sl and SINUMERIK

ONE controllers.

UMC - User Management Component

In addition, you can install the "User Management Component UMC" software package, which

provides central user administration, on one or more computers.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

Further information

Further information on the topic of secure user administration can be found in the TIA Portal

online help.

7.1.8.5

SIMATIC Logon

User administration and traceability

The SIMATIC Logon option package is used to set up access rights for products and libraries

in STEP 7. These projects can therefore only be accessed by an authorized group of people.

SIMATIC Logon can be used in conjunction with SINUMERIK STEP 7.

More detailed information can be found in Chapter Secure access control with SIMATIC Logon

(Page 73).

7.1.9

Data backup

There are different archive forms and archiving methods in the SINUMERIK for the different

components.

Time of the data backup

Perform a data backup at the following times:

● After commissioning

● After changing machine-specific settings

● After the replacement of a hardware component

● Before and after a software upgrade

● Before the activation of memory-configuring machine data

You can find further information in the following manuals:

● SINUMERIK 840Dsl Commissioning CNC Commissioning Manual (https://

support.industry.siemens.com/cs/ww/en/view/109777906)

● Installation Manual SINUMERIK ONE New installation and upgrade

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

Note the general information on secure data storage with regard to archives in Section Data

storage (Page 37).

NOTICE

Misuse of confidential data on the control system

On the control system, there is a risk of confidential data being misused.

● As a consequence, it is not permissible to load confidential data to the control (e.g. using

the "SINUMERIK Integrate Access MyMachine/P2P" software).

● Always store confidential data in an encrypted form locally on an encrypted storage

location in the network.

7.1.10

Disposal

NOTICE

Misuse of data resulting from insecure methods of deleting data

Incomplete or insecure deletion of data from memory cards or hard drives can lead to misuse

of the data of the part programs, archives, etc. by third parties.

● Therefore ensure that all storage media are securely deleted before disposing of the

product :

● There are programs that support you in securely deleting/formatting storage media.

Alternatively, contact a certified data destruction specialist to take care of this task.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

7.2

CNC Shopfloor Management Software

The following chapter provides you with an overview of the security-related measures you can

take to protect your CNC Shopfloor Management software products from threats. Detailed

descriptions and procedures can be found in the corresponding documentation of the CNC

Shopfloor Management software.

7.2.1

System overview

A leading-edge IT architecture is created based on the CNC Shopfloor Management Software,

more specifically, at three levels - "In Cloud", "In Line" and "In Machine". These levels

correspond to the 3 platforms "MindSphere", "SINUMERIK Integrate" and "SINUMERIK/

SINUMERIK Edge", with their numerous tailored functions from the field to the cloud.

Cloud

MindSphere

SINUMERIK

Line

Integrate

SINUMERIK

Machine

Edge

Figure 7-2

CNC Shopfloor Management Software

7.2.2

Cloud applications (In Cloud)

MindSphere provides state-of-the-art security during on-site data collection and when

transferring and saving to the Cloud.

The security framework is oriented on the principles of industry standards, e.g. IEC 62443,

International Organization for Standardization (ISO)/IEC 27001, and the Federal Office for

Information Security (BSI) and recommendations from authorities on working with data in

Cloud environments.

In accordance with proven communication practices of the industry, all communication

between the client and MindSphere is protected by TLS V1.2 via public end points. Reliable

x509 certificates from the Siemens Trust Center are used. These correspond to the

requirements of the European Telecommunications Standards Institute (ETSI) and of the

Certification Authority Browser Forum (CA/B Forum).

Further information on encryption for MindSphere can be found in the MindSphere Whitepaper

(https://www.plm.automation.siemens.com/global/en/topic/mindsphere-whitepaper/28842 ).

Saved data is always saved by Siemens on high-performance servers in the computer centers

of the infrastructure providers. All of the infrastructure centers meet the highest standards for

data security and are protected against cyber threats. As commercial providers of a Cloud IaaS

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

(Infrastructure as a Service), they provide higher security standards than typical private, local

facilities for data storage. The computer centers are operated in accordance with the Best

Practices of the industry.

As an additional layer of security, all of the Cloud infrastructure partners must ensure on-site

security measures such as electronic photo ID badges, card owner access control, biometrics,

digital video monitoring with recording and alarm monitoring.

Figure 7-3

MindSphere

7.2.2.1

Manage MyMachines /Remote

Security measures and system hardening

Note

As a user of Manage MyMachines /Remote, always ensure that you operate the product with

the latest versions of SINUMERIK Integrate client and Manage MyMachines /Remote Service

Engineer and Machine Operator Clients. Also follow the guidelines for industrial security

contained in Chapters 1.3 and 2.3 of the Manage MyMachines /Remote Function Manual

(https://support.industry.siemens.com/cs/ww/en/view/109759394 ).

The connection of SINUMERIK controls to MindSphere via "TLS 1.2 /HTTPS" meets the

highest security standards.

The automatic confirmation of the machine identity, used in conjunction with token provided in

MindSphere for the onboarding of the machine, ensures that the correct machine is accessed

during a remote session.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

Disposal

To completely delete an installation of Manage MyMachines /Remote, you should ensure that

all of the software and certificates have been properly deleted from your Windows device or

SINUMERIK control system, including backup systems. The data will continue to be available

in MindSphere, unless the tenant is closed.

Additional information on the topic of disposal can be found in the Manage MyMachines /

Remote Function Manual (https://support.industry.siemens.com/cs/ww/en/view/109759394 ).

Further information on general concepts for secure remote access to industrial plants can be

found in the following documents:

● cRSP IT Security Concept (https://support.industry.siemens.com/cs/ww/en/view/

109759394)

● Siemens common Remote Service Platform (cRSP) (https://www.downloads.siemens.com/

download-center/Download.aspx?pos=download&fct=getasset&id1=A6V11272777)

See also

cRSP IT security concept (https://www.downloads.siemens.com/download-center/

Download.aspx?pos=download&fct=getasset&id1=A6V11272775)

7.2.3

PC/Server/Desktop applications (In Line)

7.2.3.1

SINUMERIK Integrate 4.1

Access to the resources of the SINUMERIK Integrate server

Note

Access to the resources of the SINUMERIK Integrate server

Read and write access to the file system and resources of the operating system (in particular

to the Windows Registry) of the SINUMERIK Integrate server is only enabled for users with

administrator rights. Make sure that these administrator IDs have sufficiently strong passwords.

NOTICE

Data manipulation possible

Within the production/machine network (Intranet), there is a risk that a hacker can access the

file system of the SINUMERIK Integrate Servers or the variance SINUMERIK Integrate

clients. There, the hacker can manipulate various system components (e.g. the content of

databases). As a consequence, the attacker can change tool data, NC programs, machine

archives or the system structure itself, for example. SINUMERIK Integrate cannot prevent this

type of attack.

● As a consequence, as the person responsible for the machine network, it is imperative that

you take the appropriate industrial security measures for the production/machine network.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

Use of open programming interfaces

NOTICE

Data misuse by using open programming interfaces

There is a potential risk of data misuse when using open programming interfaces.

● Therefore, when using open programming interfaces, only use clients that at least

communicate with the SINUMERIK Integrate server via "TLS 1.2 /https" communication

paths.

● Note that the corresponding TLS version is not supported by every operating system.

System hardening

System hardening is the removal of all software components and functions that are not

absolutely required by the desired application to fulfill the intended task.

System hardening of third-party software: Microsoft™ Internet Information Server, Microsoft™

SQL Server, browsers (Microsoft™ Internet Explorer, Mozilla Firefox)

SINUMERIK Integrate requires software from third parties: For example, the Microsoft™

Internet Information Server, Microsoft™ SQL Server products and various browsers. They

must be hardened according to the latest technology. In particular, restrict access to the

Microsoft™ SQL Server to the local host and protect access with a password. Encrypt access

to the database. In addition, you should only use current browsers for communication with the

SINUMERIK Integrate server. Secure communication cannot be guaranteed when using

outdated browsers (SSL instead of TLS).

System hardening of neighboring products to SINUMERIK Integrate: For example, tool setting

station, Teamcenter, AUVESY™ VersionDog

SINUMERIK Integrate communicates with neighboring software products, e.g. tool setting

stations, Teamcenter and VersionDog. They must be hardened according to the latest

technology so that there are no negative effects via this communication path.

Network file exchange via common drives

Note

Network file exchange via common drives (Server Message Block, SMB)

If you use SMBs for exchanging files with SINUMERIK Integrate functions, only use standard

authentication mechanisms (user name / password). Also restrict the accesses for each user

accordingly. Data storage on shared drives should be kept to a minimum.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

Data backup

For data backup on machine tools, see Section "Data backup (Page 59)". Also back up the

server side. Relevant are the configuration and contents of the Microsoft SQL Server database,

the SINUMERIK Integrate server and the following SINUMERIK Integrate applications:

● MMT

● SFT RM

● MMP

● AMC

● AMP

Perform a data backup at the following times:

● After commissioning

● When changing the hardware configuration

● After replacing the hardware

● Before and after upgrading the software

Communication security for SINUMERIK Integrate applications

The communication between the SINUMERIK Integrate server and various client forms (such

as MMT or browsers) is preconfigured with HTTP. The required configuration should provide

support for service technicians trained specially for SINUMERIK Integrate. If possible, switch

the communication to HTTPS, which requires a separate certificate. It should be noted that

HTTPS is not possible for all client/server combinations.

7.2.3.2

Cloud mode

If the AMM and AMC applications are used in cloud operation, the Siemens AG as operator

ensures the security of the SINUMERIK Integrate server. Customers only have to ensure the

security of the infrastructure on the machine side.

Firewall of the machine network

In contrast to standalone operation, a connection to the cloud server outside the machine and

company networks is required when using the SINUMERIK Integrate AMM and AMC

applications. The associated firewalls must enable the required ports. However, only the

required ports should be opened. Further information on the required firewall settings can be

found in the SINUMERIK Integrate Installation Manual, Section "System requirements".

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

Phishing for passwords

"Phishers" could attempt to obtain login data, which would allow them to carry out actions within

SINUMERIK Integrate in the name of the user. Hackers could, for example, falsify e-mails and

websites from SIEMENS and thus gain access to confidential information from

SINUMERIK Integrate users. The users are then prompted, for example, to enter the access

data in a form and then send it to their SINUMERIK Integrate organization.

Note

You should observe the following when you encounter suspicious e-mails:

● Be on your guard when you receive e-mails from someone you do not know, especially if the

e-mails include links and attachments. Never open suspicious attachments and do not click

on any links in the e-mail.

● Carefully check the sender’s complete e-mail address.

● Check the integrity of the links embedded in the e-mail (e.g. by moving the mouse over the

link). Tell-tale signs are spelling mistakes or where links contain a confusing company name.

● Use digital signatures in emails.

● If in doubt, never divulge any confidential information.

Handling of confidential information

The communication route between the company's firewall and the SINUMERIK Integrate

server is protected against malicious attacks by secure communication protocols (TLS). Third

parties cannot eavesdrop on the transferred information or change it. Also note the company-

specific guidelines for the transfer of confidential information via AMM and AMC.

7.2.4

Controller-related applications (In Machine, SINUMERIK Edge)

7.2.4.1

SINUMERIK Edge

Overview

The SINUMERIK Edge is a remote-controlled edge device that functions as a field gateway as

well as a computation node for any user workload within an extended IoT/OT architecture.

Thus, SINUMERIK Edge allows a vertical flow of information and data processing between all

layers:

● In Machine

● In Line

● In Cloud

This also contains the temporary or permanent saving of process data. SINUMERIK Edge thus

has the task, through its security architecture, of not allowing any regression/erosion of the

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

present network security and of the data protection level. In order to not cancel the individual

security mechanisms of the SINUMERIK Edge, organizational support is also needed here.

Security features and security measures

The SINUMERIK Edge is equipped with 2 physical network connections (RJ45), which,

according to the manual, are to be used for connecting to the In Machine and In Line level.

Ensure that the port assignment is correct due to the following reasons:

● The communication for the "In Machine" network is assumed to be unprotected for the most

part.

● No uncontrolled connectivity to higher-level networks (In Line, In Cloud) is possible for the

"In Machine" network.

Through a multi-level network architecture, the SINUMERIK Edge ensures the isolation of both

networks, which is only overcome by an application-defined flow of data. Due to the use of

container technology, there are additional mechanisms for isolating the workload (Edge

application) with regard to network, memory and CPU resources.

Communication of the SINUMERIK Edge in the direction of "In Cloud" and "In Line" always

takes place via an encrypted end-to-end channel (TLS 1.3). Supplemental to this, the

integration into a PKI-based trust chain is supported. This ensures both its restriction to only

permitted communication partners and a trustworthy transmission. For the In Line exchange of

data in environments with special security requirements, client-based authorization via client

certificates is also possible.

The initial exchange of the certificates needed for secure communication between the Edge

Management System (MindSphere / In Cloud) and SINUMERIK Edge (In Line) takes place

during the so-called onboarding procedure. Onboarding includes the exchange of a "shared

secret", which connects a logical device (MindSphere asset) with a physical device

(SINUMERIK Edge). Since this exchange does not take place via the same communication

infrastructure, a compromise can be ruled out as early as the onboarding procedure. A second

aspect of the onboarding is the linking/integration of the MindSphere IoT services (Timeseries

Store, FileStore, Fleetmanager, etc.) in the correct MindSphere tenants. The SINUMERIK

Edge platform also ensures that no data flow into a tenant or asset that is not defined for this

purpose can be established at any time.

Note

The requirement for using SINUMERIK Edge is a MindSphere tenant, including a valid

MindAccess account (at least IoT value plan S).

The SINUMERIK Edge only communicates via "outgoing" connections. This means that no

exposition of the SINUMERIK Edge on the In Line or In Cloud level is needed. Rather, this

scenario is discouraged. Regardless of this configuration, the reachability of the MindSphere

end points from the SINUMERIK Edge must be temporarily guaranteed. This concerns

onboarding, the firmware update, or the (de)-installation of Edge applications. The

SINUMERIK Edge allows applications (Industrial App) to not only provide data via a controlled

path In Cloud, but these applications also provide user interfaces and/or interfaces (APIs), to

allow new workflows (In Line) or to supplement existing ones. To this end, applications may

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.2 CNC Shopfloor Management Software

provide separate user and access management options. The associated security information

can be found in the relevant documentation.

Communication of the SINUMERIK Edge with the SINUMERIK only takes place via the "In

Machine" network and is encrypted in accordance with the respective protocols. The

authorization mechanisms vary depending on the protocol used, however. Since some

protocols are protected using weak protection mechanisms, it is important in such cases to

adhere to adequate password guidelines and to ensure within an organization that passwords

are never saved or are only saved in urgent cases.

The SINUMERIK Edge is also protected against unwanted manipulation or weakening of the

security features on both the firmware and application levels by the following features:

● Measured / Secured Boot

● Full Disk Encryption

● Rootless Access

To ensure a high level of security of the SINUMERIK Edge over a long period of time, the

firmware is continuously being further developed and hardened. This is required to adapt to the

ever intensifying cyber security threat situation. For this purpose, an update mechanism is

available as part of the SINUMERIK Edge firmware, which is integrated into the corresponding

IT process as part of a continuous security strategy.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

7.3

SIMOTION

SIMOTION security measures

The following section provides an overview of the Industrial Security features available for

SIMOTION (Motion Control) in order to protect your plant against threats.

Security functions

● There is only compiled code on the controller by default. For this reason, no upload and

consequently no re-engineering is possible.

● No modifications can be made to the configuration without the matching engineering project.

● Know-how protection for source programs with password and encryption.

● Applicative copy protection for the configuration on the control system

● Detection of source code manipulation with the SIMOTION SCOUT engineering system.

● Activating/deactivating unused functions (web server, OPC UA server, ports, etc.)

● Use of the SIMATIC Logon for access to a project only with the appropriate rights.

● Virus scan and security updates for SIMOTION PC-based controllers (SIMOTION P).

A production plant is typically divided into several different network segments. These

"segments" are components that have the required security functions connected upstream.

They are shown with a padlock symbol in the overview graphic.

Operations level

PCS7

WinCC

UMTS

Softnet Securtiy

Internet

Client/Step 7…

Scalance

S623

Scalance XR324-12M

DSL Modem

Scalance M875

Step 7, TIA Portal,

Control level

SIMOTION SCOUT,

Scalance X308-2M

WinCC

SIMATIC S7-1500

CP1628

Scalance S612

mit CP 1543-1

SIMATIC S7

SIMATIC S7-1200

HMI

SIMOTION

SIMATIC ET 200S/

SIMOTION

SIMATIC ET 200S/

SINAMICS

ET200SP

SINAMICS

ET200SP

Field level

Figure 7-4

Display of a typical production plant with protected areas

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

Reference

Detailed descriptions and further procedures can be found in the corresponding SIMOTION

documentation.

Many products (SINUMERIK, SIMOTION, SINAMICS) contain OpenSSL. The following

applies to these products:

● This product contains software (https://www.openssl.org/ ) that has been developed by the

OpenSSL project for use in the OpenSSL toolkit.

● This product contains cryptographic software (mailto:eay@cryptsoft.com) created by Eric

Young.

● This product contains software (mailto:eay@cryptsoft.com) developed by Eric Young.

7.3.1

System hardening

7.3.1.1

Port security

Deactivating hardware ports

As of version 4.4, individual hardware ports of PROFINET interfaces (e.g. X150 interface ports)

can be set to Disable in the engineering system (HW Config) for SIMOTION devices. This

prevents devices being connected without permission and also increases security in terms of

third-party access to the system. You should therefore deactivate unused ports.

Note

A SIMOTION device can no longer be accessed via a deactivated PROFINET interface

hardware port.

The engineering system and the PN stack ensure that at least one port on each interface is not

set to Disable to prevent users locking themselves out. The default setting is Automatic

settings.

Further information

Further information on the logical Ethernet ports and protocols used for SIMOTION can be

found in the Communication with SIMOTION System Manual (https://

support.industry.siemens.com/cs/de/en/view/109767623), Chapter "Services used".

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

7.3.1.2

Virus scan, Windows security patches, SIMOTION P

General information on virus scanners

Once an industrial PC system is connected to the Internet, either directly or via an internal

company network, there is a danger that it can become infected with a virus. However,

malicious software is not only able to reach the system via the Intranet/Internet, but also, for

example, via a removable storage device (such as a USB memory stick) attached to the system

for backing up data.

SIMOTION P320 virus scanner

A virus scanner that runs on Microsoft Windows, as used in office or home computers, has a

deep impact on a system's processes. There are, for example, processes such as real-time

scans or regular system scans. Such interventions can cause performance issues for the

system, and as a result, for the SIMOTION Runtime software. Although the SIMOTION

Runtime software runs in a real-time environment, it still depends on the available system

resources.

Note

Because of the resulting performance impairments, the installation and use of a standard virus

scanner on a SIMOTION P320 during system runtime is not permitted.

Using a virus scanner

As a standard virus scanner cannot be used for SIMOTION P320, an alternative procedure is

followed. The virus scanner is installed to a separately bootable Windows PE operating system.

It is started, for example, from a CD or a USB storage device and then performs a virus scan.

Note

FAQ Service & Support portal

More information on using a virus scanner on a SIMOTION P320 can be found in the FAQ "How

can a virus scanner be used on a SIMOTION P3x0?" (https://support.automation.siemens.com/

WW/view/en/59381507) which is available as a download from the Service & Support portal.

7.3.2

Secure project storage

Project data storage in SIMOTION SCOUT

All relevant data, configurations and programs are stored in the project. Only the programs and

libraries encrypted via the know-how protection can be stored in a project. To protect the entire

project, you should protect the project data with conventional office solutions, e.g. password-

protected archives or encrypted hard disks.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

File structure

The SIMOTION SCOUT project data can come in the following formats:

Engineering data (ES)

● Standard storage: File structure in the project tree

STEP 7/TIA Portal and SIMOTION SCOUT objects in the project directory. These objects

are not secure and can be edited by anyone if there is no know-how protection for programs

and libraries or external file encryption is used. Programs in this context programs are

synonymous with units, which can contain the programs, function blocks and functions.

● XML data

Project data created via an XML export/import. The know-how protection is retained.

Runtime data (RT) - data on the CF card

● ZIP archive of the SIMOTION project (not binary).

The project archive is stored on the memory card of the respective SIMOTION controller

(CFAST, CF card, MMC). The archive can be transferred, e.g. via SIMOTION SCOUT or

using standard methods (FTP transfer).

● Binaries (zipped, unzipped)

Binaries contain the compiled, executable project with the configurations and applications.

Changes cannot be made during runtime without the SIMOTION SCOUT project because

the project is stored as binary data on the SIMOTION controller.

The following figure shows an example of possible project data storage with display of the

protected data.

File structure in the project tree

STEP 7, SIMOTION SCOUT

ZIP archive

XML file

Compiled in binary form

Encrypted programs,

libraries and password-

Compiled in binary form,

protected modules

cannot be decompiled

without the project

Figure 7-5

SIMOTION SCOUT project data storage

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

7.3.3

Know-how protection

7.3.3.1

Secure access control with SIMATIC Logon

User administration and traceability

The SIMATIC Logon option package is used to set up access rights for products and libraries

in STEP 7. These projects can therefore only be accessed by an authorized group of people.

SIMATIC Logon can be used in conjunction with SIMOTION SCOUT.

SIMATIC Logon supports the following functions:

● Assignment of individual authorization levels to users or user groups for the execution of

specific actions (e.g. read, write, transfer blocks).

● Logging of online activities and logon actions on the computer. Access and changes in the

project are reproducible.

● Assignment of authorization to users / user groups only for a limited time.

● Password aging strategies

Change log

A change log can be recorded when the access protection is activated. This includes, for

example:

● Activation

● Deactivation

● Configuration of access protection and the change log

● Opening and closing of projects and libraries including their download to the target system

as well as activities to change the operating state

7.3.3.2

Know-how protection in engineering

Know-how protection types

The know-how protection in SIMOTION SCOUT prevents unauthorized viewing and editing of

your programs. Multiple logins are possible. The standard login can be set for the engineering

session.

A distinction is made between two types of know-how protection:

● Know-how protection for programs and libraries

● Know-how protection for drive units (as of SINAMICS V4.5)

You set a login and a password under Project -> Know-how protection. The know-how

protection for the program is activated via the Set menu command. The programs contained in

the project are still visible to the user in this session, but the program names are displayed with

a padlock symbol.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

Programs and libraries

The know-how protection protects the programs and libraries in your project. Unauthorized

viewing and editing of your programs is prevented when the know-how protection is activated.

You can set the know-how protection for individual programs or for all programs in a project.

Access protection and encryption can be set in several levels for the following types of data:

● Programs (units in Structured Text (ST), Motion Control Chart (MCC) and LAD/FBD that

contain programs, function blocks, and functions)

● Drive Control Charts (DCC)

● Libraries

You can select three different security levels for the encryption:

● Standard

Access only with user login and password (backward compatible with versions before V4.2).

● Medium

Improved coding of the password (due to a new procedure, no backward compatibility

without knowledge of the password).

Programs and libraries can be recompiled at any time even without knowledge of the

password.

● High (only for ST source files in libraries)

Compilation is only possible after the password has been entered.

Protected libraries can also be used after an export without knowledge of the password,

because in this case the compilation result is also exported.

- An export without source texts is also possible when exporting libraries

Highest protection. Complete removal of the source texts in the engineering upon export.

The export only contains the compilation result (recompilation no longer possible).

The block interfaces are always visible.

Drive units in SIMOTION SCOUT

The know-how protection for drive units only applies online and is used to protect intellectual

property, in particular, the know-how of machine manufacturers, against unauthorized use or

reproduction of their products.

A detailed description can be found in Chapter Know-how protection (Page 82).

7.3.3.3

Copy protection for the configuration on the control system.

Copy protection for SIMOTION projects

Measures can be taken to tie the configuration to the memory card or the controller. This

prevents illegal duplication of the configuration.

The serial numbers of the CPU, memory card and DRIVE-CLiQ components in the application

can be queried via system functions. This enables the machine manufacturer to create a block

with an encryption algorithm which generates a key from the currently installed serial numbers

during runtime and compares it with a machine key. Each machine configuration has a specific

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

machine key which is generated by the machine manufacturer and stored in the application,

and which can be entered by the end customer, for example, via the HMI, particularly during

maintenance work.

In addition, special agreements can also be made regarding extended know-how protection

and copy protection through the use of a SIMOTION Open Architecture technology package.

Original machine

Copied machine

Figure 7-6

Copy protection of binary SIMOTION SCOUT projects

7.3.4

Offline/online comparison

Project comparison

You can use the SIMOTION SCOUT/STARTER Project comparison function (start this via

the Start object comparison button) to compare objects within the same project and/or objects

from different projects (online or offline).

The offline/online comparison is used to detect in detail any subsequent manipulations of the

project data on the plant in comparison to your secured engineering data. Thus you check if any

unauthorized third parties accessed the system.

The following comparisons are possible:

● Offline object with offline object from the same project

● Offline object with offline object from a different project

● Offline object with online object

The project comparison in SIMOTION SCOUT contains all objects in a project, such as

SIMOTION devices, drive units, libraries, programs (units), technology objects, I/Os as well as

the configuration of the execution system.

The offline/online comparison provides support for service jobs or for detecting changes to the

project data.

It may, for example, be the case that inconsistencies are indicated when you switch to online

mode in the project navigator, i.e. there are deviations between your project in SIMOTION

SCOUT and the project loaded into the target system.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

Possible causes can include, for example:

● A program has been changed

● The result of compiling a program is different

● There is a deviation on the global device variables

● The execution system has been changed

● The hardware configuration has been changed

● A library has been changed

● A configuration data item for an axis has been changed

The object comparison allows you to establish these differences and, if necessary, run a data

transfer to rectify the differences.

Detailed offline/online comparison

You can determine specific differences between the offline and the online project by performing

a complete project comparison. If there are discrepancies, you can determine the changes/

manipulation to the source code down to the program line level, when the additional information

(source information) has also been stored on the target system during the download. This is

also possible with the LAD/FBD and MCC graphical programming languages.

Figure 7-7

Example of ST detail comparison

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

SINUMERIK 840D sl. Training. Operate - Turning (2016-2020) - page 1