ABB i-bus KNX IPR/S 3.5.1, Product Manual

Page: 6 / 44

ABB i-bus ® KNX
General
6 2CDC502099D0211 Rev. A | IPR/S 3.5.1
1.2 Cyber security (network security)
The industry is increasingly faced with cyber security risks. To increase the stability, security and
robustness of its solutions, ABB has introduced official robustness tests for Internet security as part of the
product development process.
In addition, the information below includes guidelines and mechanisms that you can use to improve the
security of KNX systems.
1.3 Preventing access to the different media
The basis for any protection concept is the careful shielding of the system against unauthorized access.
Only authorized persons (installers, janitors and users) should have physical access to a KNX system. The
critical points of every KNX medium must be protected as well as possible during planning and installation.
In general, applications and devices should be permanently installed to prevent their easy removal and in
this way prevent access to the KNX system for unauthorized persons. Subdistributions with KNX devices
should be closed, or in rooms to which only authorized persons have access.
1.4 Twisted pair cabling
► The ends of KNX twisted pair cables should not be visible or protrude from the wall either inside or
outside the building.
► If available, use the anti-theft devices on the application modules.
► Bus cables outdoors represent an elevated risk. Ensure that physical access to KNX twisted pair
cables is especially difficult here.
► For extra security, devices installed in areas with limited protection (outdoor areas, underground
parking lots, restrooms, etc.) can be designed as a separate line. Enabling the filter tables in the line
coupler (KNX only) prevents attackers from gaining access to the whole system.
1.5 IP cabling inside the building
For building automation, use a separate LAN or WiFi network with its own hardware (routers, switches,
etc.).
Regardless of the KNX system, apply the usual security mechanisms for IP networks. These are
examples:
•
MAC filter
• Encryption of wireless networks
•
Usage of strong passwords and protection of these against access by unauthorized persons
Note
The device cannot be reached during IP, TCP or UDP flooding (access from the Internet). To prevent
this reaction, set a data rate limit at network level.
Please discuss the topic with your network administrator.