GE PACSystems* RX3i, Secure Deployment Manual

Page: 28 / 35

GFK-2904D July 2018 21
Chapter 5
Configuration Hardening
This section is intended to assist in reducing the potential attack surface by providing information that can be
used to harden the configuration of the PROFINET I/O Devices that are present in a particular installation.
Configuration Hardening should be considered in addition to enabling and using security features such as
Authentication, Access Control, and Authorization.
GE Automation & Controls recommends disabling, on each PROFINET I/O Device, all ports, services, and
protocols that are not required for the intended application.
5.1
Scanner
This section provides information to use when hardening the configuration of a PROFINET I/O Device Scanner
or it’s DAP (Device Access Point). These options should be considered when configuring any PROFINET I/O
Device that supports them.
Service How to Disable
IP Routing
Set Gateway IP Address to 0.0.0.0 in the hardware configuration and
download to the PROFINET I/O controller.
Ethernet Port Enable
Set Port Speed of Port submodule to Disabled in the hardware
configuration and download to the PROFINET I/O controller. This will
prevent the port from powering up and establishing a link. This setting is
retained over a power cycle.
SD Card Identity
Set the name of the Device using a DCP Client with the SD Card inserted.
Remove SD Card and enable the physical Write-Protect feature on the
SD Card. Re-insert the SD Card in the Scanner. This will prevent future
attempts to rename the Scanner from persisting over a power cycle.
Front Panel Ethernet Port
Set IP Address, Subnet Mask, and Gateway IP Address to 0.0.0.0 in the
hardware configuration and download to the PROFINET I/O Controller.
No Web Server access or firmware update functionality will be available
through the front panel Ethernet port.
Firmware Update During RUN Mode
Clear the control bit to disable firmware updates while the unit is
connected to a PROFINET IO Controller that is in RUN mode. Applies to
IC695PNS001-BAxx and IC695PNS101 only.