scheider electric MiCOM P746, Technical Manual

Page: 516 / 530

P746/EN CS/A11G31 Cyber Security
(CS) 17-14 MiCOM P746
CS
4.4 Password Management
The user is locked out temporarily, after a defined number of failed password entry attempts.
The number of password entry attempts, and the blocking periods are configurable. These
settings are shown in Table 4.
The first invalid password entry sets the attempts count (actual text here) to 1 and initiates
an 'attempts timer'. Further invalid passwords during the timed period increments the
attempts count. When the maximum number of attempts has been reached, access is
blocked. If the attempts timer expires, or the correct password is entered
before
the 'attempt
count' reaches the maximum number, then the 'attempts count' is reset to 0.
Once the password entry is blocked, a 'blocking timer' is initiated. Attempts to access the
interface whilst the 'blocking timer' is running results in an error message, irrespective of
whether the correct password is entered or not. Only after the 'blocking timer' has expired
will access to the interface be unblocked, whereupon the attempts counter is reset to zero.
Attempts to write to the password entry whilst it is blocked results in the following message,
which is displayed for 2 seconds.
NOT ACCEPTED
ENTRY IS BLOCKED
Appropriate responses achieve the same result if the password is written through a
communications port.
The attempts count, attempts timer and blocking timer can be configured, as shown in Table 4.
Setting
Cell
col row
Units Default Setting Available Setting
Attempts Limit 25 02 3 0 to 3 step 1
Attempts Timer 25 03 Minutes 2 1 to 3 step 1
Blocking Timer 25 04 Minutes 5 1 to 30 step 1
Table 4: Password blocking configuration
Password Recovery
Password recovery is the means by which the passwords can be recovered on a device if
the customer should mislay the configured passwords. To obtain the recovery password the
customer must contact Schneider Electric Customer Care Center and supply two pieces of
information from the IED – namely the
Serial Number
and its
Security Code
. The Customer
Care Center will use these items to generate a Recovery Password which is then provided to
the customer.
The security code is a 16-character string of upper case characters. It is a read-only
parameter. The IED generates its own security code randomly. A new code is generated
under the following conditions:
−
On power up
−
Whenever settings are set back to default
−
On expiry of validity timer (see below)
−
When the recovery password is entered
As soon as the security code is displayed on the LCD display, a validity timer is started. This
validity timer is set to 72 hours and is not configurable. This provides enough time for the
Customer Care Center to manually generate and send a recovery password. The Service
Level Agreement (SLA) for recovery password generation is one working day, so 72 hours is
sufficient time, even allowing for closure of the Customer Care Center over weekends and
bank holidays.