MA-025
–
DGA 900 Operator Guide
–
Rev 2.0
12-Apr-19
Page 68 of 92
Appendix A
Security Configuration
A.1
Introduction
This appendix addresses security configuration for remote operations and the software
firewall.
A.1.1
General Recommendations
GE recommends the ‘Defence in depth’ approach. The
Defence in depth approach
advocates multiple layers of independent security controls to make it as difficult as
possible for an attack to succeed. When using GE products and solutions, consider
adopting the following security best practices:
▪
Care must be taken when connecting hardware to a wide area network including but
not limited to a corporate network or the Internet at large. The network segmentation
and firewall rules at each network interface must be carefully considered to reduce the
allowed traffic to the bare minimum needed for operation. Access rules customised to
the site's specific needs must be used to access devices from outside the local control
networks. Care must be taken to control, limit, and monitor all access, using, for
example, virtual private networks (VPN) or Demilitarised Zone (DMZ) architectures. If a
device is being used in a manner that does not require wide area network access, it is
strongly recommended that the device not be connected to any wide area network to
reduce the attack surface.
▪
Harden system configurations by enabling/using the available security features, and by
disabling unnecessary ports, services, functionality, and network file shares.
▪
Apply all the latest GE product security updates, SIMs, and other recommendations.
▪
Apply all the latest operating system security patches to control systems PCs.
▪
Use antivirus software on control systems PCs and keep the associated antivirus
signatures up to date.
▪
Use whitelisting software on control systems PCs and keep the whitelist up to date.
A.1.2
Sample Checklist
This section provides a sample checklist to help guide the process of securely deploying GE
products.
▪
Create or locate a network diagram.
▪
Identify and record the required communication paths between nodes.
▪
Identify and record the protocols required along each path, including the role of each
node.
▪
Revise the network as needed to ensure appropriate partitioning, adding firewalls or
other network security devices as appropriate. Update the network diagram.
▪
Configure firewalls and other network security devices.
▪
Enable and/or configure the appropriate security features on each GE product.
