SINUMERIK 840D sl. Training. Operate - Turning (2016-2020)

Product-specific security measures

7.3 SIMOTION

7.3.5

SIMOTION IT Web server

Introduction

SIMOTION devices provide a Web server with preprepared standard websites. These websites

can be displayed via Ethernet using a commercially available browser. Additionally, you have

the option of creating your own HTML websites and incorporating service and diagnostic

information. The web server can be deactivated. If the Web server is active, secure operation

of the plant can be ensured via the integrated security concept and the user administration.

Deactivating/activating the Web server

The Web server with all functions and services can be activated or deactivated in the

SIMOTION SCOUT or SIMOTION SCOUT TIA project under the hardware configuration of the

controller. You can activate or deactivate individual functions.

Figure 7-8

Activating the SIMOTION IT Web server functions in SIMOTION SCOUT or SIMOTION SCOUT TIA

Note

To activate the Web server, you must establish a user administration scheme with password-

protected user access.

Security concept of HTTP/S, FTP and Telnet access on the Web server

As of version V4.4, access to the SIMOTION IT Web server is protected by a multi-level security

concept.

The security status of the Web server is indicated by the security level on the website. This

security level can have three different levels: Low, Normal, High

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

Security Level Low

The device is supplied with an empty user database. No projects exist yet. The security level

is low to allow configuration of the device.

● In this state, access to the Web server as an anonymous user is possible to enable use of

functions such as the project and firmware update or OPC XML.

● FTP and Telnet access are also possible.

● New users can be entered in the empty user database.

Security Level Normal

The controller has a user database. A project exists on the controller and HTTP, HTTPS, FTP,

and Telnet are activated in the hardware configuration.

● User password authentication is required for access to websites with sensitive content (e.g.

firmware update, watch table, etc.), FTP and Telnet.

As soon as a project has been loaded to the controller, Security Level Normal is active, with an

empty user database as required. Standard websites are still visible. All other websites can only

be accessed with the necessary authentication.

Security Level High

High security with maximum access protection:

● HTTP, HTTPS, FTP and Telnet have been deactivated via the project in the hardware

configuration. Access to the Ethernet via the various ports of the services is then no longer

possible. The Web server cannot be used.

User management

SIMOTION IT uses a user database to safeguard access to a device. The groups are stored in

the user database along with their assigned users. The defined user groups can be assigned

access rights to the individual Web server websites. The Web server is accessed after the

authentication.

Authentication

● There are users (USERs).

● Each user has a password. This is encrypted.

● Users belong to groups (GROUP).

● Websites, directories, and applications are protected by secure areas defined for each

group.

● Only users that belong to the secure area can access the protected website.

● Each secure area has a group of users who have access authorization.

● A user can belong to different groups.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

Encrypted data transfer (HTTPS)

The Web server can be accessed via an HTTP as well as an HTTPS connection. The Secure

Socket Layer protocol (SSL) in HTTPS enables encrypted data transmission between a client

(browser) and the SIMOTION controller (Web server). Secure transmission can be forced by

deactivation of the HTTP port for security reasons.

Certificates must be generated and installed for encrypted communication between the

browser and the Web server. A device comes supplied with a standard root certificate and a

private key of the Web server as a file. These files should be replaced with your own to increase

the security of HTTPS access to the device.

Key files

● Delivery state

In order for you to be able to access the SIMOTION controller via the SIMOTION IT

diagnostics standard websites (in their delivery state) via HTTPS, a root certificate and a

private key are supplied as a file on the device.

● Creating the SSL certificate yourself

With the help of the Perl Tool and the supplied Perl Script (cert.pl), the certificates required

for customer facilities (sites) can be generated and tied together to form loading packages.

There are two ways of acquiring your own server certificate (SSL certificate):

● Create a root certificate (self-signed) and a private key using a certificate software.

● Purchase a server certificate from a certificate authority.

Importing the SSL certificate into the browser

If you use SSL with your own certification authority, you will need to prepare your PCs for

communication with the SIMOTION controller. To do this, the root certificate must be added to

the list of certificates in your browser.

Further information

Further information on the SIMOTION IT web server can be found in the following

documentation:

● SIMOTION IT Diagnostics and Configuration Diagnostics Manual (https://

support.industry.siemens.com/cs/de/en/view/109767636)

● SIMOTION IT OPC UA Programming Manual (https://support.industry.siemens.com/cs/de/

en/view/109767638)

● AUTOHOTSPOT

● SIMOTION IT Virtual Machine and Servlets Programming Manual (https://

support.industry.siemens.com/cs/de/en/view/109767639)

See also

SIMOTION IT Programming and Web Services Programming Manual (https://

support.industry.siemens.com/cs/de/en/view/109767637)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.3 SIMOTION

7.3.6

OPC UA server

Introduction

SIMOTION has implemented an OPC UA server with DA (Data Access).

OPC UA binary encoding is supported. Access to an arbitrary OPC UA client can be protected

via authentication and encrypted data transfer.

Configuration

Note

Before connecting to the OPC UA server, ensure that the environment is secure and install a

hardware-based intermediate layer (e.g. DMZ network, firewall, SCALANCE S modules, etc.).

The OPC UA server can be activated or deactivated via HW Config from TIA Portal or STEP 7.

Figure 7-9

Activating the SIMOTION IT Web server functions in SIMOTION SCOUT or SIMOTION SCOUT TIA

Further settings are made via the SIMOTION IT Web server configuration masks:

● Enabling of the Ethernet interface and associated port of SIMOTION for the OPC UA access.

● Definition of the user name, password and user group as part of the user administration of

the SIMOTION IT Web server.

● Handling of the certificates for the encryption of the data transfer.

Further information

Further information on the OPC UA server can be found in the SIMOTION IT OPC UA

Programming Manual (https://support.industry.siemens.com/cs/de/en/view/109767638 ).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

7.4

SINAMICS

The following chapter provides you with an overview of the Industrial Security features

available for SINAMICS to protect your converters from threats. In the following, you will find

topics which you should pay special attention to regarding Industrial Security:

● Write and know-how protection

● Parameters: Access levels

● Using the memory card

● Note on Safety Integrated

● Communication services and used port numbers

● Web server

● Information about individual interfaces

● SINAMICS Startdrive and STARTER

● SINAMICS Drive Control Chart (DCC)

Detailed descriptions and procedures can be found in the corresponding SINAMICS

documentation.

Many products (SINUMERIK, SIMOTION, SINAMICS) contain OpenSSL. The following

applies to these products:

● This product contains software (https://www.openssl.org/ ) that has been developed by the

OpenSSL project for use in the OpenSSL toolkit.

● This product contains cryptographic software (mailto:eay@cryptsoft.com) created by Eric

Young.

● This product contains software (mailto:eay@cryptsoft.com) developed by Eric Young.

7.4.1

Network security

Note

SINAMICS products may only be used in a secure and trusted network. Observe the

information on this topic in Chapter "Network segmentation (Page 31)".

7.4.2

Know-how protection

Some SINAMICS converters provide you with a "Know-how protection" function: This function

offers you protection of your intellectual property, especially the know-how of machine

manufacturers against unauthorized use, modification or reproduction of their products.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

Effect

Adjustable parameters which are not recorded in an exception list can neither be read nor

written.

Exceptions

● The know-how protection does not affect parameters that are provided with the following attributes:

● KHP_WRITE_NO_LOCK

- These parameters are excepted from the know-how protection and can therefore be written to de-

spite the know-how protection.

- For a list of these parameters, see the List Manual of the respective product.

- These parameters are not included in the exception list.

● KHP_ACTIVE_READ

- These parameters can also be read, but not written, with activated know-how protection.

- For a list of these parameters, see the List Manual of the respective product.

- These parameters are not included in the exception list.

● Know-how protection does not prevent the execution of certain functions:

● In particular, the "Restore factory settings" function is still possible despite know-how protection.

● For a full list of executable functions, please refer to the following references.

Further information

For more information on this topic, see the following references:

● SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109763287)

Chapter "Know-how protection"

● SINAMICS G110M operating instructions (https://support.industry.siemens.com/cs/de/en/

view/109757594)

Chapter "Know-how protection"

● SINAMICS G120 Operating Instructions

Chapter "Know-how protection"

● SINAMICS S and SINAMICS G List Manuals

Section "Parameters for write protection and know-how protection"

● SINAMICS G130, G150 and S150 Operating Instructions

Chapter "Know-how protection"

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

7.4.3

Parameters: Access levels and password

For the G110M, G120, G130, G150, S110, S120 and S150 series devices, the SINAMICS

parameters are divided into the access levels 0 to 4. With the aid of the access levels, you can

specify which parameters can be modified by which user or input/output device:

● With the aid of parameter p0003, you can specify which access levels you can select with

the BOP or IOP.

● Parameters of access level 4 are password-protected and only visible for experts up to

SINAMICS RT V4.9.

The SINAMICS S and SINAMICS G List Manuals specify in which access level the parameter

can be displayed and changed.

Further information

For detailed information on this topic, see the following references:

● SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109771805)

Chapter "Parameters"

● SINAMICS S120 Safety Integrated Function Manual (https://support.industry.siemens.com/

cs/de/en/view/109771806)

Section "Handling the safety password"

● SINAMICS G110M List Manual

Chapter "Overview of parameters"

● SINAMICS G120 Operating Instructions

Chapter "Parameters"

● SINAMICS S and SINAMICS G List Manuals

Section "Explanation of the list of parameters"

● SINAMICS G130, G150 and S150 Operating Instructions

Chapter "Parameters"

7.4.4

Using the memory card

The memory card must be handled with particular care for all SINAMICS devices that use a

memory card so that no malicious software or erroneous parameterizations are spread

between different commissioning PCs or inverters.

WARNING

Risk of death due to software manipulation when using exchangeable storage media

Storing files onto exchangeable storage media amounts to an increased risk of infection of the

commissioning PCs, e.g. with viruses or malware. Incorrect parameter assignment can cause

machines to malfunction, which can lead to injuries or death.

● Protect files stored on exchangeable storage media from malicious software using

appropriate protection measures, e.g. virus scanners.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

WARNING

Risk of death due to software manipulation when using exchangeable storage media

Storing the parameterization (incl. Safety Integrated parameterization) on exchangeable

storage media carries the risk that the original parameterization (with Safety Integrated) will be

overwritten, for example, by the memory card of another drive without Safety Integrated.

Incorrect parameter assignment can cause machines to malfunction, which can lead to

injuries or death.

● Ensure that only the memory card that belongs to the respective inverter is used.

● Ensure that only trained or authorized personnel have access to the enclosures, cabinets

or electrical equipment rooms.

7.4.5

Safety Integrated

To actually reduce the risk for machines and plants through the use of Safety Integrated

functions, working with Safety Integrated functions requires special care for all SINAMICS

devices that have it.

DANGER

Unexpected movement of machines caused by inactive safety functions

Inactive or non-adapted safety functions can trigger unexpected machine movements that

may result in serious injury or death.

● Observe the information in the appropriate product documentation before commissioning.

● Carry out a safety inspection for functions relevant to safety on the entire system, including

all safety-related components.

● Ensure that the safety functions used in your drives and automation tasks are adjusted and

activated through appropriate parameterizing.

● Perform a function test.

● Only put your plant into live operation once you have guaranteed that the functions relevant

to safety are running correctly.

Note

Important safety notices for Safety Integrated functions

If you want to use Safety Integrated functions, you must observe the safety instructions in the

Safety Integrated manuals.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

7.4.6

Communication services and used port numbers

SINAMICS converters support specific communication protocols. The address parameters, the

relevant communication layer, as well as the communication role and the communication

direction are decisive for each protocol. You require this information to match the security

measures for the protection of the automation system to the used protocols (e.g. firewall).

Some of the security measures described here are restricted to Ethernet and PROFINET

networks.

For detailed information on this topic, see the following references:

● SINAMICS S120

- Starting from firmware Version 5.2

SINAMICS S120 Communication Function Manual (https://

support.industry.siemens.com/cs/ww/en/view/109771803)

- Older firmware versions

SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109771805)

- Including: Section "Communication services and used port numbers"

● SINAMICS G Function Manual Fieldbuses (https://

support.industry.siemens.com/cs/ww/de/view/109757336/en)

Section "Ethernet and PROFINET protocols that are used"

● SINAMICS G130, G150 and S150 Operating Instructions

Chapter "Communication services and used port numbers"

7.4.7

Integrated web server

The SINAMICS web server provides information on a SINAMICS device via its websites. This

is accessed via an Internet browser.

Data transfer

In addition to the normal (unsecured) transmission (http), the Web server also supports secure

transmission (HTTPS). Secure transmission (HTTPS) is the recommended setting.

Note

Smart Access Module

The web server of the Smart Access Module does not support secure transmission (HTTPS).

Alternatively, you can use an encrypted WLAN transmission.

By entering "HTTP://" or "HTTPS://" in front of the address of the drive, you can decide yourself

whether normal or secure transmission is used to access the data.

For safety reasons, secure transmission can be forced by deactivation of the http port.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

Access rights

The normal protection mechanisms of SINAMICS also apply for access via the web server,

including password protection. Further protective mechanisms have been implemented

especially for the Web server. Different access options have been set for different users,

depending on the function. The parameter lists are protected so that only users with the

appropriate rights can access or change the data.

Further information

For detailed information on this topic (e.g. the supported Internet browsers), see the following

references:

● SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109763287)

Section "Web server"

● SINAMICS S210 Operating Instructions (https://support.industry.siemens.com/cs/ww/en/

view/109771824)

● SINAMICS V20 Operating Instructions (https://support.industry.siemens.com/cs/de/de/

view/109768394/en)

● SINAMICS G120 Smart Access Operating Instructions (https://

support.industry.siemens.com/cs/ww/en/view/109771299)

● SINAMICS G130, G150 and S150 Operating Instructions

7.4.7.1

Certificates for the secure data transfer

Protecting the HTTPS access

The "Transport Layer Security" (TLS) protocol enables encrypted data transfer between a client

and the SINAMICS drive. HTTPS access between the browser and the drive is based on

Transport Layer Security.

The encrypted variant of communication between the browser and the Web server using

HTTPS requires the creation and installation of certificates (default configuration, self-created

certificates or server certificates from a certification authority).

TLS

Transport Layer Security (TLS V1.2 or higher) is a hybrid encryption protocol for secure transfer

of data in the Internet.

Key files

You need 2 key files (a public certificate and a private key) for the encryption method used by

the Transport Layer Security.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

Certificate handling

The necessary certificate and key is generated on the drive so that you can access the drive via

HTTPS in the SINAMICS as delivered. For this reason, the firmware certificate should only be

used in secure networks (e.g. PROFINET below a PLC) or for direct point-to-point connections

on the service interface X127.

Instead, use a certificate confirmed by an external certification center. The references cited in

the following contain a detailed description of the procedure.

Further information

For detailed information on this topic, see the following references:

● SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109771805)

Section "Certificates for the secure data transfer"

● SINAMICS G130, G150 and S150 Operating Instructions

7.4.8

Information about individual interfaces

X127 LAN (Ethernet)

Ethernet interface X127 is intended for commissioning and diagnostics, which means that it

must always be accessible. Note the following restrictions for the X127 interface:

● Only local access is possible

● No networking or only local networking in a locked control cabinet permissible

If you require remote access to the control cabinet, then you must apply additional security

measures so that misuse through sabotage, data manipulation by unqualified persons and

intercepting confidential data are completely ruled out.

X140 serial interface (RS232)

You connect an external HMI device for operator control/parameter assignment via the serial

interface X140.

NOTICE

Access to the inverters only for authorized personnel

Unauthorized persons may be able to damage or alter production equipment as a result of

gaps in a company's physical security. Confidential information can also be lost or altered as

a result of this. You can prevent this if you protect the company site and the production areas

accordingly.

● You can find information on suitable protective measures in Section "Physical protection of

critical production areas (Page 30)".

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

X150 LAN (Ethernet)

The network with which interface X150 is connected must be separated from the rest of the

plant network in accordance with the Defense in Depth concept (see Chapter "General security

measures (Page 27)"). Access to cables and possibly open connections must be implemented

in a protected fashion, as in a control cabinet.

X1400 LAN (Ethernet)

The network with which interface X1400 is connected must be separated from the rest of the

plant network in accordance with the Defense in Depth concept (see Chapter "General security

measures (Page 27)"). Access to cables and possibly open connections must be implemented

in a protected fashion, as in a control cabinet.

Further information

For detailed information on this topic, see the following references:

● SINAMICS S120

- SINAMICS S120 Control Units and Additional System Components Equipment Manual

(https://support.industry.siemens.com/cs/de/en/view/109763286 )

Section on the respective interfaces

- Starting from firmware Version 5.2: SINAMICS S120 Communication Function Manual

(https://support.industry.siemens.com/cs/ww/en/view/109771803 )

- Older firmware versions:

SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109763287)

● SINAMICS G and SINAMICS S Operating Instructions

● SINAMICS V90 Operating Instructions

7.4.9

Disposal

NOTICE

Data misuse resulting from unsafe disposal of the product

Unsafe disposal of the product can lead to misuse of the parameter data by third parties.

● Therefore, before disposal, restore all the parameters to the factory settings.

You can find further information on restoring the factory settings in the Function Manual or

Operating Instructions of the respective product.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

NOTICE

Data misuse resulting from unsafe disposal of the memory card

Unsafe disposal of the memory card can lead to misuse of the data etc. by third parties. Among

other things, the data backups required for operating the converter are located on the memory

card.

● Therefore, ensure that the data on the memory card is securely deleted before disposing

of the product. There are programs that support you in securely deleting/formatting the

memory card.

● This concerns all products that have a memory card.

Note

Deleting user-defined certificates

Make sure you securely remove all user-defined certificates before disposing of a SINAMICS

product. A hacker can use your certificates to gain access to your protected data transmission.

● Products with memory card

- Delete the files SINAMICS.key and SINAMICS.crt from the directory OEM\SINAMICS

\WEB\WEBCONF\CERT on the memory card.

● Products with optional memory card (e.g. SINAMICS S210)

- Create empty files ("SINAMICS.key" and "SINAMICS.crt") with the corresponding file

names.

- Copy these files to the memory card.

- Insert the memory card into the converter.

- Restart the converter.

- Alternatively, when you no longer need data from the memory card: reformat the memory

card.

You can find further information in the Function Manual or Operating Instructions of the

respective product.

7.4.10

SINAMICS Startdrive and TIA Portal

7.4.10.1

Malfunctions of the machine as a result of incorrect or changed parameterization

WARNING

Malfunctions of the machine as a result of incorrect or changed parameterization

As a result of incorrect or changed parameterization, machines can malfunction, which in turn

can lead to injuries or death.

● Protect the parameter settings against unauthorized access.

● Respond to possible malfunctions by applying suitable measures (e.g. EMERGENCY

STOP or EMERGENCY OFF).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

7.4.10.2

SINAMICS Startdrive

Startdrive in the TIA Portal

SINAMICS Startdrive is an option package in the TIA Portal with which SINAMICS drives are

commissioned. With regard to Industrial Security, you must consider the corresponding

specifications for SINAMICS drives and for the TIA Portal.

In addition to the commissioning of single drives, you can also use Startdrive to configure drives

on SIMATIC control systems such as the S7-1500. Information on how to proceed with

SIMATIC controllers can be found in the TIA Portal online help at "Configuring networks".

Commissioning computer

Ensure the security of the commissioning computer. Follow the general security measures

(Page 27) for this purpose.

Device know-how protection

● You can protect the parameterization of your drive from unauthorized access via the "know-

how protection" function.

● The function is only available online.

● Device know-how protection is supported as of Startdrive V16.

Security functions

● Activation/deactivation of unused functions (web server, ports)

● Write protection for the parameter assignment, p-parameters are readable, but not

writeable, protects against unintentional changes to the parameter assignment (only

available online).

Protecting backup files in the Windows file system

If you create backup files of charts or projects with Windows tools, also protect these files with

Windows tools against unauthorized access using secure passwords. The Startdrive project

itself is protected for integrity.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

Scripting (Openness)

Scripts (Openness) are used for automating sequences in Startdrive. You must therefore test

the scripts before using them on machines.

WARNING

Risk due to incorrect configurations for automated operating actions

Scripting provides the extensive automation options that are required to be able to automate

manual operator actions in the Startdrive tools and therefore to optimize the time required for

the recurring configuration of projects and tasks.

The script programmer and the script user are responsible for the operator actions

implemented in scripting.

Incorrect configurations that are not discovered in tests can result in serious physical injury or

death.

● Run systematic tests on new and modified scripts to verify and validate them.

● Before running a script, make sure it has the correct content. Verify and validate the results

of script execution by tests on the machine.

As for DCCs, scripts can also be protected via know-how protection.

7.4.10.3

SINAMICS STARTER

Commissioning drives with STARTER

Drives of the MICROMASTER and SINAMICS families can be commissioned with STARTER.

An integrated version of STARTER is contained in SIMOTION SCOUT. For information on

SIMOTION SCOUT, see "SIMOTION (Page 69)".

Commissioning computer

Ensure the security of the commissioning computer. Follow the general security measures

(Page 27) for this purpose.

Protecting backup files in the Windows file system

If you create backup files of charts or projects with Windows tools, also protect these files with

Windows tools against unauthorized access using secure passwords.

Security functions

● Know-how protection for the parameter assignment, scripts and DCCs and DCC libraries

with password and encryption

● Copy protection for the configuration on the drive unit. The project can only be opened

together with the original card.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

● Detection of parameter manipulation with STARTER via the project comparison, see also

"Offline/online comparison (Page 75)"

● Activation/deactivation of unused functions (web server, ports), see also "Integrated web

server (Page 86)"

● Write protection for the parameter assignment, p-parameters are readable, but not

writeable, protects against unintentional changes to the parameter assignment (only

available online).

Know-how protection for drive units

In addition to the know-how protection for DCCs, DCC libraries and scripts, you can also protect

the parameter assignment of your drive against unauthorized access via the know-how

protection for the drive. The function is only available online. See also "Know-how protection

(Page 82)".

Scripting

Scripts are used for automated execution in STARTER. You must therefore test the scripts

before using them on machines.

WARNING

Risk due to incorrect configurations for automated operating actions

Scripting provides the extensive automation options that are required to be able to automate

manual operator actions in the STARTER/SCOUT tools and therefore to optimize the time

required for the recurring configuration of projects and tasks.

The script programmer and the script user are responsible for the operator actions

implemented in scripting.

Incorrect configurations that are not discovered in tests can result in serious physical injury or

death.

● Run systematic tests on new and modified scripts to verify and validate them.

● Before running a script, make sure it has the correct content. Verify and validate the results

of script execution by tests on the machine.

As for DCC charts, scripts can also be protected via know-how protection.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

With the Drive Control Chart Editor based on CFC, you configure the technology functions with

DCC for SINAMICS drives graphically.

● Startdrive

The following figure shows the data flow of the configuration data when configuring with

SINAMICS DCC:

7,$ 3RUWDO

3URMHNW WUHH

3ODQ

7DVN &DUGV

3URMHFW

'&& 6WDQGDUG EORFNV

'ULYH XQLW

$OO %ORFNV

$''

/LEUDULHV

08/

① Loading

② Import of DCB libraries

Figure 7-10

Flow of configuration data: TIA-DCC

● STARTER

The following figure illustrates the data flow of the configuration data when configuring with

SINAMICS DCC and the ways to protect the configured/programmed DCC sources:

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

'&& &)&

$GG

0XO

&RQILJXULQJ

&RPSLOLQJ

%DFNXS LQ WKH ILOH V\VWHP

67$57(5 FKDUWV DQG OLEUDULHV

%ORFN W\SH LPSRUW

/RDGLQJ

6,1$0,&6

'&% OLEUDU\ 6,1$0,&6

'&& OLEUDU\ 6,1$0,&6

Figure 7-11

Flow of configuration data: Example for DCC Classic V2.1 ... V3.4 (STARTER)

Startdrive: Option package DCC

Note the following special features regarding Startdrive:

● DCC does not provide a backup in the file system.

● The DCB libraries used are loaded implicitly with the project into the target device

● DCC does not offer any chart know-how protection

Commissioning computer

Ensure the security of the commissioning computer. Follow the general security measures

(Page 27) for this purpose.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

Using know-how protection

DCCs, DCC libraries, programs and backup files are subject to an increased risk of

manipulation. Therefore, use the know-how protection, the write protection for drive units and

the know-how protection for DCC charts and DCC libraries in STARTER, see also Use write

and know-how protection (Page 97).

Information on know-how protection can also be found in the "Motion Control SINAMICS/

SIMOTION Editor Description DCC" Programming and Operating Manual.

Protecting backup files in the Windows file system

If you create backup files of charts or projects with Windows tools, also protect these files with

Windows tools against unauthorized access using secure passwords.

Note the information on SINAMICS and on the engineering systems

Also note the Industrial Security information for SINAMICS drives and engineering systems

with which SINAMICS drives are commissioned. Particularly the information on network

security is important, see also Network security (Page 31).

7.4.11.2

Use write and know-how protection

Prevent unauthorized changes by means of know-how protection

WARNING

Danger to life through manipulation of DCC charts and DCC libraries

The use of unprotected DCCs and DCC libraries entails a higher risk of manipulation of DCCs,

DCC libraries and backup files.

● Protect important DCCs and DCC libraries via "Know-how protection programs" or "Know-

how protection drive units" in SCOUT or STARTER. Assign a strong password to prevent

manipulation.

● Therefore, for "Know-how protection programs" or "Know-how protection drive units", use

passwords which include at least eight characters, upper and lower case letters, numbers,

and special characters.

● Make sure that only authorized personnel can access the passwords.

● Protect the backup files on your file system using a write protection.

7.4.12

SINAMICS Smart Access Module

The optional Smart Access Module offers you an intelligent solution for commissioning the

SINAMICS V20 or G120 converter.

The Smart Access Module is a web server module with integrated WLAN connectivity. It allows

web-based access to the converter from a connected device (conventional PC with WLAN

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.4 SINAMICS

adapter, tablet or smartphone). This module is only intended for commissioning and therefore

cannot be used with the converter for the long term.

NOTICE

WLAN: Changing a default password

The misuse of passwords can also represent a considerable security risk. As a result of

incorrect or changed parameterization, machines can malfunction, which in turn can lead to

injuries or death.

● After logging on to the Smart Access Module for the first time, change the module's default

password.

● Assign a secure password. Information on this can be found in the Operating Instructions

of the respective converter.

NOTICE

Unauthorized access to the converter via the SINAMICS Smart Access Module

Unauthorized access to the converter via the Smart Access Module as a result of cyber

attacks could lead to interruptions in the process and thus to property damage or personal

injury.

● Before you log in to the web pages, check the status LED on the Smart Access Module. If

the status LED is green or flashing, unauthorized access could have occurred: Switch the

SINAMICS Smart Access Module off and then on again using the on-off switch to re-

establish the WLAN connection.

For detailed information on this topic, see the following references:

● SINAMICS V20 Converter Operating Instructions (https://support.industry.siemens.com/cs/

de/en/view/109773836)

● SINAMICS G120 Smart Access Operating Instructions (https://

support.industry.siemens.com/cs/ww/en/view/109771299)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

References

General information

Additional general information about Industrial Security is available on the Internet:

● Industrial security (https://www.siemens.com/industrialsecurity )

● Cyber security (https://new.siemens.com/global/en/company/topic-areas/

cybersecurity.html)

● Planning security (https://new.siemens.com/global/en/products/automation/topic-areas/

industrial-security/planning.html)

● Implementing security (https://new.siemens.com/global/en/products/automation/topic-

areas/industrial-security/implementation.html)

● Always active (https://new.siemens.com/global/en/products/automation/topic-areas/

industrial-security/always-active.html)

● Certifications and standards (https://new.siemens.com/global/en/products/automation/

topic-areas/industrial-security/certification-standards.html)

● Whitepapers and downloads (https://new.siemens.com/global/en/products/automation/

topic-areas/industrial-security/downloads.html)

Secure passwords

Further information on assigning secure passwords can be found in the chapter under the

following addresses:

● Federal Agency for Security in Information Technology (BSI) (https://

support.industry.siemens.com/cs/de/en/view/109757594)(in German only)

● European Network and Information Security Agency (enisa). (https://www.enisa.europa.eu/

media/news-items/basic-security-practices-regarding-passwords-and-online-identities)

● National Institute of Standards and Technology (NIST) (https://nvlpubs.nist.gov/nistpubs/

SpecialPublications/NIST.SP.800-63b.pdf)

Web pages of the products

Additional product-specific information about Industrial Security is available on the individual

product websites:

● SINUMERIK: SINUMERIK homepage (https://www.siemens.com/sinumerik )

● SIMOTION: SIMOTION homepage (https://www.siemens.com/simotion )

● SINAMICS: SINAMICS homepage (https://www.siemens.com/sinamics )

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

101

References

Product-specific manuals

Product-specific manuals for the individual products can be found on the Internet:

●

"SINUMERIK 840D sl NCU 7x0.3 PN" Manual (https://support.industry.siemens.com/cs/de/

en/view/99922219)

●

"Commissioning CNC: NC, PLC, Drive" Commissioning Manual (https://

support.industry.siemens.com/cs/ww/en/view/109777906)

●

"SINUMERIK 840D sl Operating System NCU (IM7)" Commissioning Manual (https://

support.industry.siemens.com/cs/ww/en/view/109763236)

●

"SINUMERIK 840D sl Base Software and HMI sl" Commissioning Manual (https://

support.industry.siemens.com/cs/de/en/view/109254363)

●

SINUMERIK 840Dsl Safety Integrated plus Commissioning Manual (https://

support.industry.siemens.com/cs/de/en/view/109777982)

●

"SINUMERIK Operate (IM9)" Commissioning Manual (https://

support.industry.siemens.com/cs/ww/en/view/109769186)

●

PCU-Basesoftware (IM8) Commissioning Manual (https://

support.industry.siemens.com/cs/de/en/view/109748542)

●

"PCU Base Software (IM10)" Commissioning Manual (https://

support.industry.siemens.com/cs/de/en/view/109769185)

●

SINUMERIK Access MyMachine /P2P (PC) Operating Manual (https://

support.industry.siemens.com/cs/ww/en/view/109770206)

●

SINUMERIK Access MyMachine /OPC UA Configuration Manual (https://

support.industry.siemens.com/cs/de/en/view/109777871)

●

Manage MyMachines /Remote Function Manual (https://

support.industry.siemens.com/cs/ww/en/view/109759394)

●

Diagnostics Manual 808D (https://support.industry.siemens.com/cs/de/en/view/

109763685)

●

SIMOTION IT Programming and Web Services Programming Manual (https://

support.industry.siemens.com/cs/de/en/view/109767637)

●

SIMOTION IT Diagnostics and Configuration Diagnostics Manual (https://

support.industry.siemens.com/cs/de/en/view/109767636)

●

SIMOTION IT Virtual Machine and Servlets Programming Manual (https://

support.industry.siemens.com/cs/de/en/view/109767639)

●

SIMOTION IT OPC UA Programming Manual (https://support.industry.siemens.com/cs/de/

en/view/109767638)

●

BA_G110M (https://support.industry.siemens.com/cs/de/en/view/109757594 )

●

Communication with SIMOTION System Manual (https://support.industry.siemens.com/cs/

de/en/view/109767623)

●

SINAMICS S120 Drive Functions Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109771805)

●

SINAMICS S120 Control Units and Additional System Components Equipment Manual

(https://support.industry.siemens.com/cs/de/en/view/109771804 )

Industrial Security

102

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

References

● SINAMICS S120 Safety Integrated Function Manual (https://

support.industry.siemens.com/cs/de/en/view/109771806)

● SINAMICS S120 Communication Function Manual (https://

support.industry.siemens.com/cs/ww/en/view/109771803)

● SINAMICS S120/S150 List Manual (https://support.industry.siemens.com/cs/de/en/view/

109763271)

● G110M Operating Instructions (https://support.industry.siemens.com/cs/de/en/view/

109757594)

● G120 Operating Instructions (https://support.industry.siemens.com/cs/ww/en/view/

109771299)

● SINAMICS G Fieldbuses Function Manual (https://

support.industry.siemens.com/cs/ww/de/view/109757336/en)

● S210 Operating Instructions (https://support.industry.siemens.com/cs/ww/de/view/

109771824)

● V20 Operating Instructions (https://support.industry.siemens.com/cs/de/en/view/

109773836)

● Function Manual S7-1500, ET 200SP, ET200pro web server (https://

support.industry.siemens.com/cs/ww/en/view/59193560)

● SIMATIC Programming with STEP 7 Programming and Operating Manual (https://

support.industry.siemens.com/cs/de/en/view/109751825)

● SIMATIC S7-300 CPU 31xC and CPU 31x Equipment Manual: Technical specifications

(https://support.industry.siemens.com/cs/de/en/view/12996906 )

● SIMATIC NET Configuration Manual: SCALANCE X-200 Industrial Ethernet switches

(https://support.industry.siemens.com/cs/de/en/view/109757352 )

services/industrial_security)

Safety Integrated plus Commissioning Manual (https://

support.industry.siemens.com/cs/de/en/view/109763246)

Recommendations for creating secure passwords provided by BSI [German Federal Office for

IT Security] (https://www.bsi-fuer-buerger.de/BSIFB/DE/Empfehlungen/Passwoerter/

passwoerter_node.html)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

103

Glossary

AMC

Abbreviation for SINUMERIK Integrate Analyze MyCondition

AMD

Abbreviation for SINUMERIK Integrate Access MyData

AMM

Abbreviation for SINUMERIK Integrate Access MyMachine

AMP

Abbreviation for SINUMERIK Integrate Analyze MyPerformance

AMT

Abbreviation for Intel® Active Management Technology

Area of attack

The scope to which a system can be deprived of its protection so that it can be attacked.

Attack

An attempt to destroy a resource, to deprive it of its protection, to change it, to deactivate it, to

steal it, to gain unauthorized access to it or to use it in an illegal way.

Authentication

Verification of the identity of a user, process or device, frequently as prerequisite for the

permission to access resources in an information system.

Authorization

The right granted by a system entity to access a system resource.

Availability

Property to be accessible and usable when requested by an authorized entity.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

105

Glossary

Brute force

There are no efficient algorithms for solving many of the problems in computer science. The

most natural and simplest approach to an algorithmic solution for a problem is to simply try out

all possible solutions until the correct one is found. This method is called brute-force searching.

One typical application is given again and again when it comes to listing an example of brute-

force searching - the "cracking" of passwords. Passwords are often encrypted using

cryptographic hash functions. Directly calculating the password from the hash value is

practically impossible. However, a password cracker can calculate the hash values of

numerous passwords. If a value matches the value of the stored password, then the password

(or another, randomly matching password) has been found. In this case, brute force refers to

the simple trial and error approach of entering every possible password.

Cloud computing

Cloud computing is the storage of data in a remote data center, and can also involve the

execution of programs that are not installed on local computers, but rather in the (metaphoric)

cloud.

Confidentiality

Property which ensures that the information is not made available or disclosed to unauthorized

individuals, entities or processes.

Cyber security

Cyber security is the practice of defending computers, servers, mobile devices, electronic

systems, networks, and data from malicious attacks. It also includes the security of information

technologies and electronic information. The term is broad and applies to everything from

computer security to disaster recovery, i.e. the restoration after an incident, to the training of

end users.

Defense in depth

Creation of multiple security mechanisms, especially in a layer structure, with the intention of

slowing down or completely preventing attacks.

Denial of service (DoS)

Denial of service (DoS) is the non-availability of an IT-based service that is normally available.

Although there can be many reasons for such non-availability, the term "DoS" is generally used

when infrastructure systems are overloaded. This can be the result of an unintentional overload

or through a deliberate attack on a server, a computer or other components in a network.

DMZ

The demilitarized zone is an autonomous subnet that separates the local area network (LAN)

from the Internet through firewall routers (A and B). The firewall routers are configured in such

a way that they reject data packets for which there were no previous data packets. If a data

packet is sent from the Internet to the server, it is therefore rejected by firewall router A. If,

Industrial Security

106

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Glossary

however, a hacker gains access to a server within the DMZ and sends data packets to the LAN

in an attempt to analyze or hack it, these are rejected by firewall router B.

Firewall

Device to connect networks with one another, which restricts the exchange of data between two

connected networks.

Hacker

Person involved in an intentional hacking activity. The reasons for these activities can be

malicious or not malicious, or also remain within the limits of what is ethnically and legally

acceptable.

Hardening

Procedure in which the security of a system is increased by reducing the area of attack.

IANA

The Internet Assigned Numbers Authority (IANA) is a department of ICANN, and is responsible

for assigning numbers and names in the Internet, especially IP addresses. It is one of the oldest

institutions in the Internet.

Incident

One or more unwanted or unexpected events that impair the company operation and endanger

the information security. The cause can be security holes, incorrect configurations or

misconduct and their exploitation.

Industrial security

Measures to increase the industrial security standards of a plant. They protect against

unauthorized access to higher-level control systems, industrial controls and PC-based systems

of the plant as well as against cyber attacks.

Information security

Safeguards the confidentiality, integrity and availability of information.

Integrity

Property which guarantees that resources are free of error and complete.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

107

Glossary

Internet of Things (IoT)

General term for technologies of a global infrastructure of information organizations which

allow physical and virtual objects to be linked together and allows them to work together via

information and communication techniques.

IPsec (Internet Protocol Security)

IPsec is an expansion of the Internet protocol (IP) to include encryption and authentication

mechanisms. This way, the Internet protocol can transport cryptographically secured IP

packets via insecure public networks.

Malware

Malware is a general term for programs that have been developed to damage users. There are

numerous types of malware, e.g. viruses, trojans, rootkits or spyware.

MMP

Abbreviation for SINUMERIK Integrate Manage MyPrograms

MMT

Abbreviation for SINUMERIK Integrate Manage MyTools

NAT (Network Address Translation)

NAT is a process used in IP routers that connect local networks to the Internet. Since, in

general, Internet access is only via one IP address (IPv4), all other nodes in the local network

require a private IP address. Private IP addresses can be used several times, but are not valid

in public networks. For this reason, nodes with a private IP address cannot communicate with

nodes outside the local network. In order for all computers with a private IP address to have

access to the Internet, the Internet access router must replace the IP addresses of the local

nodes with a separate, public IP address in all outgoing data packets. In order for the incoming

data packets to be assigned to the correct station, the router saves the current TCP

connections in a table. The NAT router "memorizes" which data packets belong to which TCP

connection. This process is called NAT (Network Address Translation).

NCU

Central control module of a CNC control for NC, HMI, PLC and closed-loop control.

OpenVPN

OpenVPN is a program to establish a virtual private network (VPN) via an encrypted TLS

connection. Libraries belonging to the OpenSSL program are used for encryption. OpenVPN

uses either UDP or TCP for transferring data.

Industrial Security

108

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Glossary

Patch management

Area of the system management whose tasks include the procurement, testing and installing

of several patches (code changes) for an administered computer system or in such a system.

At the same time, a subprocess of the Security Vulnerability Management whose tasks include

the correction and containment of security holes for Siemens products by means of software

corrections.

Patterns of viruses

Designation for the database of virus scanners, which contains the schematic and code-

specific structure of all known viruses. This is usually a file that is used and processed by the

virus scanners. The schemata contained in the file are used when checking for viruses and with

them the files to be checked are compared.

PCU

Highly integrated industrial PC for the user interface or system software and user interface of

a CNC.

Phishing

The term "phishing" describes the threat of "using bait to fish for passwords" in e-mails, via

counterfeit links or even text messages (e.g. SMS). What are known as "phishers" attempt to

obtain data via serious or official-looking e-mails and websites. With the aid of malware, they

exploit weak points, e.g. in the operating system or web browser.

Remote access

Use of systems which are within the perimeter of the security zone and that can be accessed

from another geographical location with the same rights as if the systems were physically at the

same location.

SCADA

Supervisory Control and Data Acquisition (SCADA) involves monitoring and controlling

technical processes using a computer system.

Security

Safeguards the confidentiality, integrity and availability of a product, a solution or a service.

Security hole

Weak point in a computer system that allows an attacker to violate the integrity of the system.

As a rule, this is the result of program errors or design defects in the system.

A weak point of a resource or operator element that can be exploited by one or more threats.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

109

Glossary

SIEM system

SIEM stands for Security Information and Event Management and has become an established

term in IT security. Such systems are able to identify and evaluate security-relevant events and

notify the administrator.

Switch

Network component for connecting several terminal devices or network segments in a local

network (LAN).

Threat

Potential cause of an undesirable incident which may result in damage to a system or

organization.

Threat and Risk Analysis (TRA)

The Threat and Risk Analysis is a Siemens-wide standardized method for use in the product,

solution and service business, for product development, engineering or service projects. The

method is intended to help those involved in the project to identify typical security defects and

weak points, analyze the hazards that could exploit these defects and weak points, and

evaluate the resulting risks.

TLS

Transport Layer Security (TLS V1.2 or higher) is a hybrid encryption protocol for secure transfer

of data in the Internet.

VPN (Virtual Private Network)

An encrypted connection of computers or networks via the Internet. It enables confidential data

to be exchanged via public networks.

WSUS (Windows Server Update Services)

Windows Server Update Services (WSUS in short) is the software component of the Microsoft

Windows Server since Version 2003 which is responsible for patches and updates. It is the

successor version of the Software Update Services software component.

Industrial Security

110

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Table of contents

Preface

Fundamental safety instructions

1.1

General safety instructions

1.2

Warranty and liability for application examples

1.3

Security information

What is industrial security?

Why is industrial security so important?

3.1

Networking and wireless technology

3.2

Possible corporate security holes

Security measures in automation and drive technology

4.1

Security measures

4.2

Siemens Industrial Holistic Security Concept

4.3

Standards and regulations

Security management

General security measures

6.1

Defense in depth concept

6.2

Plant safety

6.2.1

Physical protection of critical production areas

6.3

Network security

6.3.1

Network segmentation

6.3.1.1

Separation between production and office networks

6.3.1.2

Network segmentation with SCALANCE S

6.3.2

Cloud Security

6.4

System integrity

6.4.1

System hardening

6.4.1.1

Services and ports

6.4.1.2

User accounts

6.4.1.3

PC/notebooks and mobile devices in an industrial environment

6.4.1.4

Data storage

6.4.1.5

Transporting data

6.4.1.6

Passwords

6.4.1.7

Product security notifications

6.4.1.8

Virus scanner

6.4.1.9

Whitelisting

6.4.2

Patch management

6.4.2.1

Product software

6.4.3

Data integrity

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Table of contents

6.4.4

Disposal

Product-specific security measures

7.1

SINUMERIK

7.1.1

Firewall and networking

7.1.2

Physical protection of the NCU

7.1.3

Machine control panels - SINUMERIK (MCP/MPP)

7.1.4

System hardening

7.1.4.1

Deactivating hardware interfaces

7.1.4.2

Communication services and used port numbers

7.1.4.3

Secure Boot with SINUMERIK ONE

7.1.5

Virus protection

7.1.5.1

Whitelisting

7.1.5.2

Virus protection / memory card

7.1.6

Security updates / patch management

7.1.7

Account management

7.1.7.1

Definition of access levels

7.1.7.2

Safety Integrated password

7.1.7.3

CNC lock function

7.1.7.4

Deleting the preinstalled SSH key

7.1.7.5

PLC web server

7.1.7.6

Access levels for softkeys

7.1.7.7

BIOS and AMT access protection

7.1.7.8

Password protection for Create MyConfig (CMC)

7.1.8

Know-how protection

7.1.8.1

SINUMERIK Integrate Lock MyCycles

7.1.8.2

SINUMERIK Integrate Lock MyPLC

7.1.8.3

OPC UA

7.1.8.4

User administration in the TIA Portal

7.1.8.5

SIMATIC Logon

7.1.9

Data backup

7.1.10

Disposal

7.2

CNC Shopfloor Management Software

7.2.1

System overview

7.2.2

Cloud applications (In Cloud)

7.2.2.1

Manage MyMachines /Remote

7.2.3

PC/Server/Desktop applications (In Line)

7.2.3.1

SINUMERIK Integrate 4.1

7.2.3.2

Cloud mode

7.2.4

Controller-related applications (In Machine, SINUMERIK Edge)

7.2.4.1

SINUMERIK Edge

7.3

SIMOTION

7.3.1

System hardening

7.3.1.1

Port security

7.3.1.2

Virus scan, Windows security patches, SIMOTION P

7.3.2

Secure project storage

7.3.3

Know-how protection

7.3.3.1

Secure access control with SIMATIC Logon

7.3.3.2

Know-how protection in engineering

7.3.3.3

Copy protection for the configuration on the control system

7.3.4

Offline/online comparison

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Table of contents

7.3.5

SIMOTION IT Web server

7.3.6

OPC UA server

7.3.7

Disposal

7.4

SINAMICS

7.4.1

Network security

7.4.2

Know-how protection

7.4.3

Parameters: Access levels and password

7.4.4

Using the memory card

7.4.5

Safety Integrated

7.4.6

Communication services and used port numbers

7.4.7

Integrated web server

7.4.7.1

Certificates for the secure data transfer

7.4.8

Information about individual interfaces

7.4.9

Disposal

7.4.10

SINAMICS Startdrive and TIA Portal

7.4.10.1

Malfunctions of the machine as a result of incorrect or changed parameterization

7.4.10.2

SINAMICS Startdrive

7.4.10.3

SINAMICS STARTER

7.4.11

SINAMICS Drive Control Chart (DCC)

7.4.11.1

Industrial security with SINAMICS DCC

7.4.11.2

Use write and know-how protection

7.4.12

SINAMICS Smart Access Module

7.5

SIMOCRANE

References

101

Glossary

105

Index

111

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Fundamental safety instructions

1.1

General safety instructions

WARNING

Danger to life if the safety instructions and residual risks are not observed

If the safety instructions and residual risks in the associated hardware documentation are not

observed, accidents involving severe injuries or death can occur.

● Observe the safety instructions given in the hardware documentation.

● Consider the residual risks for the risk evaluation.

WARNING

Malfunctions of the machine as a result of incorrect or changed parameter settings

As a result of incorrect or changed parameterization, machines can malfunction, which in turn

can lead to injuries or death.

● Protect the parameterization against unauthorized access.

● Handle possible malfunctions by taking suitable measures, e.g. emergency stop or

emergency off.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Fundamental safety instructions

1.2 Warranty and liability for application examples

1.2

Warranty and liability for application examples

Application examples are not binding and do not claim to be complete regarding configuration,

equipment or any eventuality which may arise. Application examples do not represent specific

customer solutions, but are only intended to provide support for typical tasks.

As the user you yourself are responsible for ensuring that the products described are operated

correctly. Application examples do not relieve you of your responsibility for safe handling when

using, installing, operating and maintaining the equipment.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Fundamental safety instructions

1.3 Security information

1.3

Security information

Siemens provides products and solutions with industrial security functions that support the

secure operation of plants, systems, machines and networks.

In order to protect plants, systems, machines and networks against cyber threats, it is

necessary to implement - and continuously maintain - a holistic, state-of-the-art industrial

security concept. Siemens’ products and solutions constitute one element of such a concept.

Customers are responsible for preventing unauthorized access to their plants, systems,

machines and networks. Such systems, machines and components should only be connected

to an enterprise network or the internet if and to the extent such a connection is necessary and

only when appropriate security measures (e.g. firewalls and/or network segmentation) are in

place.

For additional information on industrial security measures that may be implemented, please

visit

https://www.siemens.com/industrialsecurity https://www.siemens.com/industrialsecurity ).

Siemens’ products and solutions undergo continuous development to make them more secure.

Siemens strongly recommends that product updates are applied as soon as they are available

and that the latest product versions are used. Use of product versions that are no longer

supported, and failure to apply the latest updates may increase customer’s exposure to cyber

threats.

To stay informed about product updates, subscribe to the Siemens Industrial Security RSS

Feed under

https://www.siemens.com/industrialsecurity https://new.siemens.com/global/en/products/

services/cert.html#Subscriptions).

Further information is provided on the Internet:

Industrial Security Configuration Manual (https://support.industry.siemens.com/cs/ww/en/

view/108862708)

WARNING

Unsafe operating states resulting from software manipulation

Software manipulations, e.g. viruses, Trojans, or worms, can cause unsafe operating states

in your system that may lead to death, serious injury, and property damage.

● Keep the software up to date.

● Incorporate the automation and drive components into a holistic, state-of-the-art industrial

security concept for the installation or machine.

● Make sure that you include all installed products into the holistic industrial security concept.

● Protect files stored on exchangeable storage media from malicious software by with

suitable protection measures, e.g. virus scanners.

● On completion of commissioning, check all security-related settings.

● Protect the drive against unauthorized changes by activating the "Know-how protection"

converter function.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

What is industrial security?

Definition of industrial security

Generally, industrial security is understood to be all of the measures for protecting against the

following:

● Loss of confidentiality due to unauthorized access to data

● Loss of integrity due to data manipulation

● Loss of availability (e.g. due to destruction of data or Denial-of-Service (DoS))

Objectives of industrial security

The objectives of industrial security encompass:

● Fault-free operation and guaranteeing of availability of industrial plants and production

processes

● Preventing hazards to people and production due to cyber security attacks

● Protection of industrial communication from espionage and manipulation

● Protection of industrial automation systems and components from unauthorized access and

loss of data

● Practicable and cost-effective concept for securing existing systems and devices that do not

have their own security functions

● Utilization of existing, open, and proven industrial security standards

● Fulfillment of legal requirements

An optimized and adapted security concept applies for automation and drive technology. The

security measures must not hamper or endanger production.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Why is industrial security so important?

3.1

Networking and wireless technology

Overview

There are many new trends which affect industrial security:

● Cloud computing in general

The number of network connections across the world is constantly increasing. This enables

innovations such as cloud computing and the applications that go hand in hand with it. In

conjunction with cloud computing, there has been a massive increase in the number of

mobile devices, such as cell phones and tablet PCs.

● Wireless technology

On the other hand, the increasing use of mobile devices has only become possible thanks

to the ubiquitous availability of mobile networks. Wireless LAN is also becoming

increasingly available.

● Worldwide remote access to plants, machines and mobile applications

● The Internet of Things (IoT)

Millions of electronic devices are becoming network-capable and are communicating via the

Internet, such as onboard computers in cars, which transmit warranty information to

dealers, or water meter sensors that transmit water consumption data to municipal water

suppliers via radio.

However, in order for everything from cloud computing to the Internet of Things to function

disturbance-free, you require a reliable network infrastructure and applications that are well

protected against attacks from malware and hackers.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Why is industrial security so important?

3.2 Possible corporate security holes

3.2

Possible corporate security holes

Possible security holes or weak points

The security chain of a company is only as strong as its weakest link. Security holes can exist

at numerous points. The following list gives only a few examples:

● Employees / external companies

● Production plants

● Network infrastructure

● Data centers / PC workstations

● Laptops/tablets

● Printers

● Smartphones/smartwatches

● Mobile data storage media

For this reason, a holistic approach is required to deal with the issue of security. Coordinated

guidelines and regulations are required that cover all areas: Devices, systems, processes and

employees.

The topic of data security and access protection (security) is becoming more and more

important in industrial environments. The following technologies results in higher requirements

placed on protecting and securing industrial plants and systems:

● The ongoing networking of complete industrial plants and systems

● The vertical integration and networking of various company levels

● New techniques, e.g. remote maintenance and/or remote access

The threats are diverse and the consequences are far-reaching:

Possible threats:

Potential threats come from the industry environment and involve the topic of confidentiality,

integrity and availability. Examples of threats include the following:

● Espionage of data, recipes, etc.

● Sabotage of production plants

● System stoppage, e.g. due to virus infection and malware

● Manipulation of data or application software

● Unauthorized use of system functions

Possible effects of a security incident

● Loss of intellectual property

● Loss of production or reduced product quality

● Negative company image and economic damage

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

Siemens automation and drive technology concerns itself with security aspects at the following

levels:

● Application security refers to products and functions that take into consideration the needs

of industrial security in the field of automation. This involves particular consideration of the

application and task at hand, as well as the people performing the actions in an automated

plant. This allows industrial security to be easily implemented in production processes.

● Security support provides support during the analysis, planning, implementation, testing

and optimization of industrial security - by means of specialists with special knowledge of

networks and the industry. These services lead to the highest possible level of industrial

security and operating capacity of the production plant.

Siemens offers comprehensive customer support based on the "Implement Security"

service: With this service you can implement protective measures to increase the security

level of plants and production facilities. You can find more information about the entire

"Implement Security" portfolio on the Internet.

industrial-security/implementation.html)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.1 Security measures

4.1

Security measures

With increasing digitalization, comprehensive security in the automation system is becoming

ever more important. For this reason, industrial security is a core element of every product that

can be networked.

Integration of security into the products

As manufacturer of automation and drive products, Siemens supports secure operation for its

customers by integrating security into its products:

● All of the measures involving automation and drive technology are stored in the Product

Lifecycle Management (PLM) process, which is certified by the German Technical

Inspectorate (TÜV) based on IEC 62443-4-1.

● Analytically potential attack threats are detected and evaluated using Threat and Risk

Analyses (TRA). Identified critical threats are implemented in the product as necessary

basic functions, based on the motto "Security by Design".

● Siemens regularly performs code analyses in order to identify and correct possible errors at

an early stage during the formal check.

● In its products and its manufacturing process, Siemens has implemented measures to

secure integrity to indicate any changes to the integrity.

● Siemens constantly checks the measures relating to hardening:

- Operating systems are configured in such a way that points of attack (e.g. via ports,

unneeded services) are minimized.

- Siemens tests its products to detect weak points at an early stage.

- Siemens offers a specific hotfix/patch management.

Protection of the development infrastructure and supply chain

As manufacturer of automation and drive products, Siemens supports secure operation for its

customers by securing the development infrastructure and supply chain:

● The Siemens ProductCERT (https://www.siemens.com/cert/en/cert-security-

advisories.htm) (Cyber Emergency Readiness Team) is the central department for security-

related incidents in the Siemens product and solution environment. Siemens ProductCERT

supports development work with consulting and other services. ProductCERT provides

information about current threats and vulnerabilities as well as the appropriate

countermeasures.

● Industrial security is a dynamic and complex subject that requires continuous monitoring

and adaptation of new security measures. Information on how Siemens protects its products

and solutions against cyber attacks and how industry profits from the competence of

Siemens can be found on the Internet (https://new.siemens.com/global/en/products/

automation/topic-areas/industrial-security/always-active.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.1 Security measures

Provision of patches, security components, and appropriate services

As manufacturer of automation and drive products, Siemens supports secure operation for its

customers through direct support of integrators and operating companies by providing patches,

security components and the appropriate services:

● SIEMENS offers monitoring through a SIEM system to monitor residual risk. SIEM stands

for Security Information and Event Management and has become an established term in IT

security. Such systems are able to identify and evaluate security-relevant events and notify

the administrator.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.2 Siemens Industrial Holistic Security Concept

4.2

Siemens Industrial Holistic Security Concept

Siemens places great emphasis on protecting the integrity and guaranteeing the confidentiality

of the processed data for its own products. Intellectual property and know-how of the Siemens

products are also in focus.

To achieve this, the Siemens Industrial Holistic Security Concept (SI HSC) is applied which

protects development departments and production plants (see the following diagram). Multi-

level security systems and basic security improvements of the IT infrastructure are

implemented. In parallel, process improvements have been introduced and training in security

awareness provided in the development and production. These measures are being performed

continuously by Siemens and clearly demonstrated by the security levels reached.

SI HSC also benefits the customers who Siemens has selected as partners for their industrial

solutions, or who want to orientate themselves on the concept. Siemens suppliers are also

considered with regard to security so that Siemens already applies the same security standards

when purchasing as for the manufacture of its own products.

0RQLWRULQJ RI

5HVLGXDO 5LVN

3URWHFWLRQ

&RQFHSW

0RQLWRULQJ RI WKH

7DUJHW

UHVLGXDO ULVN LQ RUGHU WR

LPSURYH WKH VHFXULW\

3URWHFWLRQ

6HOHFWLRQ DQG

FRQFHSW ZKHQ UHTXLUHG

/HYHO

LPSOHPHQWDWLRQ RI

%XVLQHVV

H J ZKHQ QHZ WKUHDWV

VXLWDEOH PHDVXUHV LQ

DSSHDU

,PSDFW

6HFXULW\ UHTXLUHPHQWV

RUGHU WR IXOILOO WKH

$VVHVVPHQW

PXVW EH IXOILOOHG E\ WKH

VWLSXODWHG UHTXLUH

,7 LQIUDVWUXFWXUH DQG

PHQWV H J FHOO

6FRSH

6LJQLILFDQFH RI

,7 SURFHVVHV EDVHG

SURWHFWLRQ FRQFHSW

NQRZ KRZ SURWHFWLRQ

RQ LQWHUQDWLRQDO

DQG SURGXFW LQWHJULW\

VWDQGDUGV ,(&

3URGXFWV DQG

IRU WKH FRPSDQ\

DQG ,62

EXVLQHVV DUHDV WDNHQ

LQWR DFFRXQW LQ WKH

+ROLVWLF 6HFXULW\

&RQFHSW

Figure 4-1

SI HSC security management process

Further information

Further information on the Siemens Industrial Holistic Security Concept is available on the

Internet on page Always active (https://new.siemens.com/global/en/products/automation/

topic-areas/industrial-security/always-active.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security measures in automation and drive technology

4.3 Standards and regulations

4.3

Standards and regulations

Siemens takes the applicable Industrial Security standards and regulations into consideration

throughout the entire development process:

● ISO 2700X: Management of information security risks

● IEC 62443: IT security for industrial higher-level control systems - network and system

protection

Further information on certifications and standards in the Industrial Security field can be found

on the Internet (https://new.siemens.com/global/en/products/automation/topic-areas/

industrial-security/certification-standards.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security management

The security management process as a basis

Protect your system and your company. Security management according to IEC 62443 and

ISO 27001 forms the basis for the successful implementation of industrial security.

The security management process is shown in the following:

5LVN DQDO\VLV

9DOLGDWLRQ DQG

*XLGHOLQHV RUJDQL]D

LPSURYHPHQW

WLRQDO PHDVXUHV

7HFKQLFDO PHDVXUHV

Figure 5-1

Security management process

1. Carry out a risk analysis. Determine all possible risks and define countermeasures for

reducing the risk to an acceptable level. In detail, a risk analysis encompasses the following

steps:

- Identification of threatened objects

- Analysis of value and potential for damage

- Threat and weak point analysis

- Identification of existing security measures

- Risk evaluation

- Evaluation of the effects with regard to the protection goals of confidentiality, integrity,

and availability

2. Define guidelines and introduce coordinated, organizational measures. To this end, the

awareness of the importance of industrial security must be borne by all levels of the

company. In addition, define guidelines and processes in order to achieve a uniform

procedure and to support compliance with the defined industrial security concept.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Security management

3. Introduce coordinated technical measures. You can find a list of general measures that help

to protect your plant against threats in Section General security measures (Page 27). You

can find measures to be considered for SINUMERIK, SIMOTION and SINAMICS

environments in Chapter Product-specific security measures (Page 43).

4. A security audit must ensure that all of the measures have been implemented and that they

have also eliminated or reduced the identified risks.

Note

Continuous process

Due to constantly changing security threats, this process must be continuously repeated in

order to guarantee the security of your plant. For this reason, the security management

process must be seen as a continuous process.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.1 Defense in depth concept

6.1

Defense in depth concept

To protect industrial plants and systems comprehensively against cyber attacks, measures

must be applied simultaneously at all levels. From the operational up to the field level - from

access control to copy protection. For this purpose, we use "Defense in Depth" as a general

protection concept, according to the recommendations of ISA99 / IEC 62443, the leading

standard for security in industrial automation.

'HIHQ

VH LQ GH

3ODQW VHFXULW\

3K\VLFDO DFFHVV SURWHFWLRQ

SURFHVVHV DQG VHFXULW\ VHUYLFH

JXLGHOLQHV IRU WKH SURWHFWLRQ RI

SURGXFWLRQ SODQWV

1HWZRUN VHFXULW\

6HF

XULW

VNV GHPDQ

&HOO SURWHFWLRQ

LRQ

SHULPHWHU QHWZRUN

ILUHZDOOV DQG 931

6\VWHP LQWHJULW\

6\VWHP KDUGHQLQJ

DXWKHQWLFDWLRQ DQG XVHU

DGPLQLVWUDWLRQ SDWFK

PDQDJHPHQW GHWHFWLRQ

RI DWWDFNV

,QWHJUDWHG DFFHVV SURWHFWLRQ

LQ WKH DXWRPDWLRQ

Figure 6-1

Defense in depth strategy

Further information on the defense in depth concept and the planning of a protection concept

for industrial plants can be found on the Internet (https://new.siemens.com/global/en/products/

automation/topic-areas/industrial-security/planning.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.1 Defense in depth concept

Protection levels

A defense in depth model has a three level structure:

● Plant security

Plant security represents the outermost protective ring. Plant security includes

comprehensive physical security measures, e.g. entry checks, which should be closely

coordinated with protective measures for IT security.

● Network security

The measures, grouped under the keyword "Network security", form the core of the

protective measures. This refers to the segmentation of the plant network with limited and

secure communication between subnetworks ("secure islands") and the interface check

with the use of firewalls.

● System integrity

"System integrity" represents the combination of two essential protection aspects. PC-

based systems and the control level must be protected against attacks. Steps include the

following measures:

- Integrated access protection mechanisms in the automation components to prevent

unauthorized changes via the engineering system or during maintenance

- The use of antivirus and whitelisting software to protect PC systems against malware

- Maintenance and update processes to keep the automation systems up-to-date

(e.g. patch management, firmware updates, etc.)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.2 Plant safety

6.2

Plant safety

$QODJHQVLFKHUKHLW

Unauthorized persons may be able to enter the production site/building and damage or alter

production equipment as a result of gaps in a company's physical security. Confidential

information can also be lost. This can be prevented if both the company's site and the

production areas are protected accordingly.

6.2.1

Physical protection of critical production areas

Company security

The company's physical security can be ensured via the following measures:

● Closed off and monitored company premises

● Entry control, keys / card readers and/or security personnel

● Escorting of external personnel by company employees

● Security processes in the company are taught and followed by all employees

Physical production security

The physical security of a production location can also be ensured via the following measures:

● Separate access control for critical areas, such as production areas

● Installation of critical components in lockable control cabinets / switching rooms including

monitoring and alarm signaling options. The control cabinets/contact chambers must be

secured by a cylinder lock. Do not use simple locks, such as universal, triangular/square or

double-bit locks.

● Configuration of the radio field to restrict the WLAN range so that it is not available outside

the defined areas (e.g. factory building).

● Guidelines that prevent the use of third-party data storage media (e.g. USB sticks) and IT

devices (e.g. notebooks) classified as insecure on systems.

Further information

Further information on integrated Siemens security solutions can be found on the Siveillance

page (https://new.siemens.com/global/en/products/buildings/security/security-

management.html).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

6.3

Network security

1HWZRUN VHFXULW\

Network security includes all measures taken to plan, implement and monitor security in

networks. This includes the control of all interfaces, e.g. between the office network and plant

network, or remote maintenance access via the Internet.

6.3.1

Network segmentation

6.3.1.1

Separation between production and office networks

One important protective measure for your automation or drive system is the strict separation

of the production networks and the other company networks. This separation creates

protection zones for your production networks.

Note

The products described in this manual must only be operated in defined protection zones.

Separation by means of a firewall system

In the simplest scenario, separation is achieved by means of an individual firewall system which

controls and regulates communication between networks.

See also Network segmentation with SCALANCE S (Page 32)

Separation via a DMZ network

In the more secure variant, the coupling is established via a separate DMZ network. In this

case, direct communication between the production network and the company network is

completely prevented by firewalls and only takes place indirectly via servers in the DMZ

network.

Note

The production networks should also be divided into separate automation cells in order to

protect critical communication mechanisms.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

General security measures

Observe the general security measures even within protection zones, for example as listed

in System hardening (Page 36):

6.3.1.2

Network segmentation with SCALANCE S

Siemens provides SCALANCE S security modules to meet network protection and network

segmentation requirements. Further information on SIEMENS SCALANCE S can be found on

the Internet (https://siemens.com/scalance-s ).

SCALANCE S security module

SCALANCE S security modules with Security Integrated provide:

● Stateful inspection firewall

In order to implement user-specific control and logging, firewall rules can also be specified

that only apply to certain users.

● VPN via IPsec (data encryption and authentication)

This establishes a secure tunnel between authenticated users whose data cannot be

intercepted or manipulated. The most important aspect is the protection against external

access via the Internet.

● NAT/NATP (address translation)

● Router functionality (PPPoE, DDNS) for broadband Internet access (DSL, cable)

● SCALANCE S623 with additional VPN port (DMZ) enables the secure connection of an

additional network for service and remote maintenance purposes. S623 also permits the

secure, redundant connection of subordinate networks by means of routers and firewall

redundancy.

● SCALANCE S615 has five Ethernet ports with which different network topologies can be

protected by means of a firewall or Virtual Private Network VPN (IPsec and OpenVPN), and

security concepts implemented flexibly.

Requirement

NOTICE

Data misuse

Long distances between the device to be protected and the upstream security modules

represent an invitation for data misuse.

● Note that upstream security modules, such as SCALANCE S, must be installed close to the

device to be protected in a locked control cabinet. This ensures that data cannot be

manipulated here without notice.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

Principle

The following application example shows cell segmentation by several SCALANCE S modules,

each of which is upstream of the automation cells. The data traffic to and from the devices within

automation cells can be filtered and controlled with the SCALANCE S firewall. If required, the

traffic between the cells can be encrypted and authenticated. Secure channels and client

access from the PCs to the cells can be established via SOFTNET Security Client, VPN client

software for PCs.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

2EMHFW VHFXULW\

6HFXULW\ PDQDJHPHQW

2IILFH QHWZRUN

'0=

*356

6&$/$1&(

8076

'RPDLQ

3& ZLWK

6HUYHU

FRQWUROOHU

6,0$7,&

ZLWK

,QWHUQHW

66&

URXWHU

&HQWUDO

6&$/$1&(

:HE

DUFKLYH

,QWHUQHW

6,0$7,& ILHOG 3*

VHUYHU

ZLWK 62)71(7

VHFXULW\ FOLHQW

6&$/$1&(

,QGXVWULDO (WKHUQHW

6&$/$1&( 6

3URGXFWLRQ QHWZRUN

3URGXFWLRQ

6,180(5,.

6,0$7,&

' VO

6,0$7,&

ZLWK

&60

$GYDQFHG

6,0$7,&

352),1(7

6,0$7,&

.73

&RPIRUW

6,0$7,&

6,1$0,&6

6,0$7,&

6,1$0,&6

6,0$7,&

6,027,21 ' [ ZLWK

6,1$0,&6

Figure 6-2

SCALANCE S application example

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.3 Network security

VPN access

Note

Note that a SCALANCE S security module must always be used for VPN access.

6.3.2

Cloud Security

Since cloud applications are becoming increasingly common and the cloud continues to grow

in its significance, the issue of security in the cloud environment is also becoming more and

more important.

The following addresses are designed to give you an idea of how you can make your system

safe in the cloud environment. Inform yourself about the applicable requirements and tried and

tested solutions/best practices.

Further information

● Companion Guide for Cloud - CIS Organization (https://www.cisecurity.org/press-release/

cis-controls-companion-guide-for-cloud-now-available/)

● Questionnaire Cloud Security - CSA Organization (https://cloudsecurityalliance.org/

artifacts/consensus-assessments-initiative-questionnaire-v3-0-1/)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4

System integrity

6\VWHP LQWHJULW\

System integrity is understood to mean the "integrity" or "correctness" of the data or the correct

response of the system. Thus, the following measures for protecting the system integrity should

ensure that the data/functionality of the system cannot be manipulated by unauthorized

persons or that manipulations can be detected.

6.4.1

System hardening

6.4.1.1

Services and ports

Activated services and ports represent a risk. To minimize the risk, only the necessary services

for all of the automation components should be activated. Ensure that all activated services are

taken into account (especially Web servers, FTP, remote maintenance, etc.) in the security

concept.

A description of all of the ports used can be found in the Equipment Manuals/Function Manuals

of the respective products.

6.4.1.2

User accounts

Any active user account that allows access to the system is thus a potential risk. Therefore, take

the following security measures:

● Reduction of configured/activated user accounts to the actually needed minimum

● Use of secure access data for existing accounts. This also involves assigning a secure

password.

● Regular checks, especially of the locally configured user accounts

● Regular change of passwords

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.1.3

PC/notebooks and mobile devices in an industrial environment

The terminal devices used in industrial environments (PCs, notebooks and mobile devices)

must meet the generally applicable security requirements. Therefore, take the following

measures:

● The terminal device that is used is set up, administered, regularly checked and patched by

the appropriate departments. This ensures it is always kept up-to-date. This also means that

software and operating systems which are supported and maintained by the manufacturer

are always installed.

● A current virus scanner, which is adapted to the operating system used, must be installed

on the terminal device that is used. Both the virus patterns and the software itself must be

regularly updated. Or, alternatively, work with the Whitelisting (Page 40) method.

● Activate a firewall with appropriate settings on the terminal device that is used.

● Use a configuration without admin. rights on the terminal device that is used.

● Encrypt all of the hard drives or mass storage units (e.g. eMMC or SSD) of the terminal

device that is used to protect sensitive data against unauthorized access.

● Do not use the terminal device for other tasks, e.g. in the office network. This is part of the

separation of networks dealt with in Chapter "Separation between production and office

networks (Page 31)".

● Secure terminal devices from data theft using a physical lock (e.g. Kensington lock) or do

not leave them unmonitored.

● If you leave protected terminal devices at the workstation, always activate the lock mode of

the operating system. This prevents access to the terminal device and the contents of the

screen can no longer be read.

● Set up user accounts (Page 36) for the access rights accordingly.

● Take appropriate measures to protect unneeded interfaces (e.g. USB, network, etc.) to

prevent unauthorized access. This can be done physically using commercially available

USB port locks or via corresponding software measures.

6.4.1.4

Data storage

Note

When you store security-relevant data on your PC, you are responsible for secure data storage.

These include, for example, the following measures:

● Consequent marking of your documents according to confidentiality levels by introducing a

document classification.

● Protection of your encrypted storage locations, such as sharepoints, against manipulation.

● If absolutely necessary, only store your confidential or security-relevant data encrypted on

your PC / systems or the network.

Security-relevant data includes sensitive data, such as archives, passwords, or executable

files (*.exe).

● Regularly back up your security-relevant data and carefully protect it against loss and

manipulation.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.1.5

Transporting data

Note

Apply the following measures when transporting data:

● Always encrypt your emails if you send confidential and/or security-relevant data by email.

● If you wish to transport confidential and/or security-relevant data on a data storage medium

(USB flash drive, hard disk, etc.), carefully investigate as to which data storage media are

considered secure. A regular virus check must be carried out for these data storage media.

Always save your data on local data storage media so that the data is encrypted.

These measures are especially important for sensitive data, such as archives, passwords, or

executable files (*.exe).

6.4.1.6

Passwords

NOTICE

Data misuse caused by using passwords that are not secure enough

Data can be easily misused by using passwords that are not secure enough. Insecure

passwords can easily be guessed or decoded.

● Therefore, change the default passwords during the commissioning and adapt them at

regularly defined intervals.

● Also change passwords for functions that you yourself do not use to ensure that such

unused functions are not misused.

● Always keep your passwords secure, and ensure that only authorized persons have

access to these passwords.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

Note

Assigning secure passwords

Observe the following rules when creating new passwords:

● When assigning new passwords, make sure that you do not assign passwords that can be

guessed, e.g. simple words, key combinations that can be easily guessed, etc.

● Passwords must always contain a combination of upper-case and lower-case letters as well

as numbers and special characters. PINS must comprise an arbitrary sequence of digits.

● When assigning a password, always ensure you are adhering to the applicable company

specifications, e.g. special password policy of the respective company.

● Observe that, in accordance with the applicable company specifications, passwords with

the maximum required minimum length must be assigned.

● Wherever possible and where it is supported by the IT systems, a password must always

have a character sequence as complex as possible.

Programs are available that can help you to manage your passwords. Using these programs,

you can encrypt, save and manage your passwords and secret numbers - and also create

secure passwords.

Further information on assigning secure passwords can be found in Chapter References

(Page 101).

6.4.1.7

Product security notifications

Note

Complying with product security notifications

Threats are extremely diverse in nature and are continually changing. As a consequence,

always keep yourself up-to-date on a regular basis through the Industry Online Support (https://

support.industry.siemens.com/sc/ww/en/sc/2090) regarding whether there are new and

relevant product security notifications for your particular products. Comply with the instructions

provided in the product security notifications.

6.4.1.8

Virus scanner

An anti-virus program, virus scanner or virus protection program is a software that can detect,

block and, if required, eliminate computer viruses, computer worms or Trojans horses.

In principle, virus scanners can only detect known malware (viruses, worms, Trojans, etc.) or

harmful logic and therefore cannot provide protection against all viruses or worms. For this

reason, virus scanners can only be considered as a complement to general precautionary

measures.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

The use of a virus scanner must not impact the production operations of a plant. As the last

consequence, this will lead to even a virus-infected computer not being permitted to

immediately shut down if this would cause the control of the production process to be lost.

NOTICE

Data misuse when using online virus scanners

If you use an online virus scanner, then security-relevant or confidential data can get into the

wrong hands and be misused.

● Therefore, do not check any security-relevant or confidential data via an online virus

scanner.

Note

Keep virus scanners up-to-date

Always ensure that the virus scanner database is always up-to-date.

Note

Do not install several virus scanners together.

You must always avoid installing several virus scanners together in one system.

Note

Operation in a local network

Always use a virus scanner when locally connecting with the plant or system network.

6.4.1.9

Whitelisting

The basic philosophy of whitelisting is that all applications are mistrusted, unless they have

been classified as trustworthy after an appropriate check. This means that a whitelist is

maintained in the system. This whitelist therefore contains all applications that have been

classified as trustworthy and consequently can be run on your PC systems.

Whitelisting mechanisms provide additional/alternative protection against undesired

applications or malware and unauthorized changes to installed applications or executable files

(.exe, .dll).

Heed the corresponding product-specific information (Page 43) to determine whether the use

of virus scanners and/or whitelisting is recommended.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.2

Patch management

WSUS

The WSUS (Windows Server Update Service) system functionality provided by Microsoft is

available for current Windows systems. WSUS supports administrators by providing Microsoft

updates in large local networks. WSUS automatically downloads update packages (Microsoft

update) from the Internet and offers them to the Windows clients for installation.

The fully automatic update process ensures that Microsoft security updates are always

available on Siemens clients.

NOTICE

Security gaps for out-of-date operating systems

Note that security updates, hotfixes, etc. are no longer supplied by Microsoft for obsolete

operating systems < Windows 10. As a consequence, dangerous security gaps can occur with

your operating system.

● Therefore always upgrade your operating system - if possible - to the latest version.

● If you work with an older operating system, take appropriate additional measures (e.g.

whitelisting) to protect your system.

Note

Before installing Microsoft Updates, note the following important points:

● Prior to the update, back up the system status for a fallback, if necessary. Ensuring the

compatibility of the update with the individual system configuration is the responsibility of the

customer.

● Never establish a direct connection to the WSUS server in the Internet! Ensure that the

environment is secure and install an intermediate layer (e.g. DMZ network, firewall,

SCALANCE S modules, etc.).

6.4.2.1

Product software

Note

Out-of-date product software also represents a potential security gap for attacks.

● As a consequence, always install the latest product software versions.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

General security measures

6.4 System integrity

6.4.3

Data integrity

Data integrity is understood to mean the correctness (integrity) of data and the correct

functioning of systems. Ensuring the integrity of the data is thus an essential goal of information

security. Integrity protection should not be confused with protecting the confidentiality.

NOTICE

Corruption of data and the resulting malfunctioning of the system

For automation and drive systems as well as controller components, data such as archives

and programs can be imported from external sources. This data influences the behavior of

these systems and should therefore be protected against unauthorized changes.

Data such as archives, programs, and OA applications can also be saved and archived. The

systems currently do not provide the capability of ensuring the integrity of programs, archives,

and OA applications.

Therefore take your own measures for ensuring integrity to guarantee the data integrity of your

archives, OA applications, or other saved data:

● Apply the Siemens Industrial Holistic Security Concept.

● Use digital signatures to protect data.

● Ensure there is sufficient access protection:

- Restrict access rights such as to data archives/Sharepoints accordingly.

- Do not send any unencrypted/unsigned emails.

6.4.4

Disposal

The products are to be disposed of in accordance with the respectively valid national

regulations. The products described in this manual are extensively recyclable on account of the

low-toxic composition of the materials used. To recycle and dispose of your old equipment in

an environmentally friendly way, please contact an appropriate disposal company.

NOTICE

Misuse of data resulting from insecure methods of deleting data

Incomplete or insecure deletion of data from memory cards or hard drives can lead to misuse

of the data of the part programs, archives, etc. by third parties.

● Therefore ensure that all storage media are securely deleted before disposing of the

product :

● There are programs that support you in securely deleting/formatting storage media.

Alternatively, contact a certified data destruction specialist to take care of this task.

Also observe the special disposal information of the products in Chapter Product-specific

security measures (Page 43).

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1

SINUMERIK

The following chapter provides you with an overview of the security-related measures that you

must take to protect your SINUMERIK control from threats. Detailed descriptions and

procedures can be found in the corresponding SINUMERIK documentation.

Many products (SINUMERIK, SIMOTION, SINAMICS) contain OpenSSL. The following

applies to these products:

● This product contains software (https://www.openssl.org/ ) that has been developed by the

OpenSSL project for use in the OpenSSL toolkit.

● This product contains cryptographic software (mailto:eay@cryptsoft.com) created by Eric

Young.

● This product contains software (mailto:eay@cryptsoft.com) developed by Eric Young.

7.1.1

Firewall and networking

NCU/PCU networking structure

The following graphic shows the networking of the control (NCU) and the IPC. X130 at the NCU

and eth 1 at the IPC are used to establish a connection to the company network. A firewall

protects these two interfaces against unauthorized access.

The NCU contains a packet filter functionality (firewall) that filters the connection to the factory

network. This integrated firewall is preconfigured with optimum settings for the incoming and

outgoing communication. The firewall is configured in such a way that access to the networks

behind the firewall is blocked, and when several logon attempts are made from a certain IP

address, this is identified, blocked and prevented. In this way, the control is protected against

brute-force attacks.

The IPC has the firewall function via the Windows functionality.

NOTICE

Data misuse via an unprotected interface

Since the X120 interface of the NCU or the eth2 port of the IPC are not protected by a firewall,

there is a risk of misuse of data. The interface only provides the option of establishing a

connection to the local plant/system network.

● As a consequence, never connect this local network with the Internet/company network.

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

(WKHUQHW

)LUPHQQHW]ZHUN

)LUHZDOO

HWK ZLWK

ILUHZDOO

6HUYHU

6,180(5,. 23

3&8 7&8

HWK

6,180(5,.

RSHUDWRU SDQHO

&RPSDQ\ QHWZRUN

;

ZLWK ILUHZDOO

&RPSDQ\ QHWZRUN

;

ZLWK ILUHZDOO

/RFDO +0,

SODQW V\VWHP

QHWZRUN

;

6,180(5,.

[ '

;

/RFDO VHUYLFH

;

EHL 6,180(5,. 21(

352),1(7

6,180(5,. 21(

6,180(5,.

' VO

Figure 7-1

Networking of NCU/IPC

Firewall settings

Ethernet interface X130 of the NCU and the eth1 interface of the IPC are protected by a firewall

for security reasons. If individual programs require access to a communication port for

communication purposes, you can activate or deactivate the firewall via SINUMERIK Operate.

Additional ports can be separately released.

Alternatively, you can configure the firewall via the "basesys.ini".

Further information

Further information on the configuration of the firewall and default settings can be found in the

following manuals:

● SINUMERIK Operate (IM9) (https://support.industry.siemens.com/cs/de/en/view/

109769186)

● Diagnostics Manual (808D) (https://support.industry.siemens.com/cs/de/en/view/

109763685)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

Product-specific security measures

7.1 SINUMERIK

7.1.2

Physical protection of the NCU

NOTICE

Misuse, manipulation and theft

Modules, such as the NCU, are open equipment. If not protected, there is the risk of misuse

by unauthorized personnel, manipulation or theft of data (e.g. CompactFlash Card).

● As a consequence, always install NCUs in housings and locked control cabinets or in

electrical rooms. Only appropriately trained and authorized personnel may access these

housings, electrical cabinets and electrical rooms. Information on the permitted locks can

be found in Chapter Physical protection of critical production areas (Page 30).

● Further information on the control cabinet installation of the NCU can be found in the

SINUMERIK 840D sl NCU 7x0.3 PN Manual (https://support.industry.siemens.com/cs/de/

en/view/99922219) or in the corresponding Equipment Manuals for SINUMERIK ONE:

"NCU1750" and "NCU1760".

7.1.3

Machine control panels - SINUMERIK (MCP/MPP)

Machine control panels (Machine Control Panels and Machine Push Button Panels) are

available for user-friendly operation of SINUMERIK machine functions.

Note

Only operate the machine control panels (MCP/MPP) on an internal, local machine network

and secure them against any possible external access.

Note

Firmware update

For MCP/MPP/PP72-48 firmware updates or module diagnostics (Port 3845) contact Siemens

Service&Support (https://support.industry.siemens.com/sc/ww/en/sc/2090 ).

See also

Passwords (Page 38)

Industrial Security

Configuration Manual, 02/2020, 6FC5397-5EP40-6BA1

SINUMERIK 840D sl. Training. Operate - Turning (2016-2020) - page 2