Siemens SIMATIC ET 200AL, System Manual

Page: 1214 / 2255

Communications services
3.6 Secure Communication
Communication
Function Manual, 05/2021, A5E03735815-AJ
93
What has changed
Additional optional password for more security
The most noticeable change in the frame of the configuring of the above devices is the ability
to assign a password to protect sensitive configuration data of the respective CPU. This refers
to data such as private keys that are required for the proper functioning of certificate-based
protocols (Secure Communication) - as of TIA Portal V17 also for the PG/HMI communication.
You can use a policy setting to check the assigned passwords as they are entered into the TIA
Portal. This will ensure that your company complies with prescribed password policies.
If your machine or system does not require this protection based on the Siemens Industrial
Defense-in-Depth concept, you can dispense with password assignment, for example,
because another equivalent protection is present. It is possible to do without the password if
you have implemented measures to prevent unauthorized access to the TIA Portal project and
the configuration of the CPU.
WARNING
Without password, weak protection of private keys
Note that without a password to protect trusted configuration data, the private keys for
certificates required for secure communication are only weakly protected.
Certificate-based communication between PG/HMI and CPU
Because PG/HMI communication is certificate-based, you will be asked to accept the server
certificate during commissioning.
Additional parameter assignment options allow you to determine the behavior of the CPU
during operation: For example, you can specify that the CPU also allows connection to
devices that do not support Secure PG/HMI communication.
Maintenance / replacement parts scenario
For the problem-free exchange of the CPU in replacement parts scenario, you must observe
specific rules (see Rules for the replacement parts scenario (Page 72)).
See also
Protection of confidential configuration data (Page 61)