Eaton Network-M3, User Manual

Page: 216 / 294

Cybersecurity recommended secure hardening guidelines
Securing the Network Management Module – 216
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Eaton publishes patches and updates for its products to protect them against vulnerabilities that are discovered. Eaton encourages
customers to maintain a consistent process to promptly monitor for and install new firmware updates.
Good Practices
Update device firmware prior to putting the device into production.
Thereafter, apply firmware updates and software patches regularly.
Please check Eaton’s cybersecurity website for information bulletins about available firmware and software updates.
Navigate in the help to
Contextual help>>>Card>>>Administration to get information on how to upgrade the Network
Module.
Eaton also has a robust vulnerability response process. In the event of any security vulnerability getting discovered in its
products, Eaton patches the vulnerability and releases information bulletin through its cybersecurity web site -
https://
eaton.com/cybersecurity and patch through www.eaton.com/downloads.
5.2.2.13 Business Continuity / Cybersecurity Disaster Recovery
5.2.2.13.1 Plan for Business Continuity / Cybersecurity Disaster Recovery
Eaton recommends incorporating the Network module into the organization’s business continuity and disaster recovery plans.
Organizations should establish a Business Continuity Plan and a Disaster Recovery Plan and should periodically review and, where
possible, exercise these plans. As part of the plan, important system | device data should be backed up and securely stored,
including:
Updated firmware for the Network module. Make it a part of standard operating procedure to update the backup copy as
soon as the latest firmware is updated.
The current configuration.
Documentation of the current permissions / access controls, if not backed up as part of the configuration.
The following section describes the details of failures states and backup functions:
Communication and power status indicators: Navigate in the help to Information>>>Front panel connectors and LED
indicators.
Configuration of backup and recovery: Navigate in the help to Servicing the Network Management Module>>>Saving/
Restoring/Duplicating Network module configuration settings.
5.2.2.14 Sensitive Information Disclosure
Eaton recommends that sensitive information (i.e. connectivity, log data, personal information) that may be stored by Network
module be adequately protected through the deployment of organizational security practices.
Full name
Email
Phone
Organization
The mail credentials in the CDS storage
PKI signed server’s (HTTP + MQTT) certificate and associated private key
Server’s (HTTP + MQTT) self-signed private keys (they are self-generated by the device upon user request, so unique per
device)
Username’s (in clear) and their “vCard” (Full name, Organization, Phone, Email, …)
Hashed passwords
IP addresses, hostnames (DNS, Gateway, mail servers, …) of customer network devices (in database or logs)
Maintenance report AES key/password
5.2.2.15 Decommissioning or Zeroization
It is a best practice to purge data before disposing of any device containing data. Guidelines for decommissioning are provided in
NIST SP 800-88. Eaton recommends that products containing embedded flash memory be securely destroyed to ensure data is
unrecoverable.