FEC920: USER GUIDE
Page 6
September 18
2.6 FIRMWARE
From time to time, to provide new functionality or address known issues,
Siemens
may make new versions of the
FEC920
firmware available.
This firmware may be downloaded from the
Siemens
website, and transferred to a
FEC920
instrument in the field,
via a USB memory stick (or FTP server).
2.7 SUPPORTED PROTOCOLS AND THREAT MITIGATIONS
The
FEC920
supports the following protocols on Ethernet. For each protocol, a list of mitigations are provided.
As a general comment, the firewall is configured to block all ports
except
those required for installed/enabled
options.
2.7.1 FTP Client
An external FTP client can access the FTP server on the instrument. This FTP server has default remote
username & password for each of the default users, passwords can be modified. Additional users can be added
with configurable remote username and passwords.
To mitigate threats:
1.
Physically protect access to subnet(s) in use.
2.
Firewall to block TCP port 21.
3.
It is recommended that user’s should change their passwords regularly, this could be done manually or by
using the password expiry feature.
2.7.2 FTP Server
Up to two external FTP servers can be configured. The
FEC920
will then connect to these servers as an FTP
client and push archive files to the servers.
Threat mitigation as for FTP Client.
2.7.3 ICMP (ping)
The
FEC920
will respond to a ping to aid network diagnostics.
To mitigate threats:
1.
Physically protect access to subnet(s) in use.
2.
Use a firewall to block ICMP / ping.
2.7.4 DHCP
The
FEC920
can allocate its IP address using DHCP; however this is typically set to fixed IP address allocation
by configuration. The DHCP server could be spoofed allocating an invalid IP address to the instrument.
To mitigate threats:
1.
Use fixed IP address allocation.
2.
Physically protect access to subnet(s) in use.
Caution:
Non-Schneider Electric firmware
There is a potential risk that an attacker could upgrade a
FEC920
with non-
genuine firmware that contains malicious code. To mitigate this potential risk,
genuine
FEC920
firmware upgrade utility executables are always supplied digitally
signed with the publisher as Schneider Electric. Do not use a firmware upgrade
utility if it has not been signed by Schneider Electric.
Failure to follow these instructions can result in injury or equipment damage.
A5E45696052A Rev-AA
