Phoenix Contact 1153079, Installation And Startup Manual

Page: 8 / 54

FL MGUARD 1000 product family
8 / 52
PHOENIX CONTACT 108413_en_06
• Observe the Change Notes for the respective firmware version.
• Pay attention to the security advisories published on Phoenix Contact‘s Product Secu -
rity Incident Response Team (PSIRT) website regarding any published vulnerabilities.
Use up-to-date security software
•
Install security software on all PCs to detect and eliminate security risks such as virus -
es, trojans, and other malware.
• Ensure that the security software is always up to date and uses the latest databases.
• Use whitelist tools for monitoring the device context.
• Use an Intrusion-Detection system for checking the communication within your system.
Take Defense-in-Depth strategies into consideration when planning systems
It is not sufficient to take measures that have only been considered in isolation when pro -
tecting your components, networks, and systems. Defense-in-Depth strategies encompass
several coordinated measures that include operators, integrators, and manufacturers.
• Take Defense-in-Depth strategies into consideration when planning systems.
Perform regular threat analyses
• To determine whether the measures you have taken still provide adequate protection for
your components, networks, and systems, threat analyses should be performed regularly.
• Perform a threat analysis on a regular basis.
Deactivate unneeded communication channels
• Deactivate unnecessary communication channels (e.g., SNMP, FTP, BootP, DCP,
etc.) on the components that you are using.
Do not integrate components and systems into public networks
•
Avoid integrating your components and systems into public networks.
• If you have to access your components and systems via a public network, use a VPN
(Virtual Private Network).
Restrict access rights
•
Restrict access rights for components, networks, and systems to those individuals for
whom authorization is strictly necessary.
• Deactivate unused user accounts.
Secure access
•
Change the default login information after initial startup.
• Use secure passwords reflecting the complexity and service life recommended in the
latest guidelines.
• Change passwords in accordance with the rules applicable for their application.
• Use a password manager with randomly generated passwords.
• Wherever possible, use a central user administration system to simplify user manage -
ment and login information management.
Use secure access paths for remote access
• Use secure access paths such as VPN (Virtual Private Network) or HTTPS for remote
access.