IPsecure Interface KNX
General
5
1.2
Cyber security (network security)
The industry is increasingly faced with cyber security risks. To increase the stability, security and robustness of its
solutions, Theben has introduced official robustness tests for Internet security as part of the product development
process.
In addition, the information below includes guidelines and mechanisms that you can use to improve the security of
KNX systems.
1.3
Preventing access to the different media
The basis for any protection concept is the careful shielding of the system against unauthorized access. Only
authorized persons (installers, janitors and users) should have physical access to a KNX system.
The critical points of every KNX medium must be protected as well as possible during planning and installation.
In general, applications and devices should be permanently installed to prevent their easy removal and in this way
prevent access to the KNX system for unauthorized persons. Subdistributions with KNX devices should be closed,
or in rooms to which only authorized persons have access.
1.4
Twisted pair cabling
•
The ends of KNX twisted pair cables should not be visible or protrude from the wall either inside or outside
the building.
•
If available, use the anti-theft devices on the application modules.
•
Bus cables outdoors represent an elevated risk. Ensure that physical access to KNX twisted pair cables is
especially difficult here.
•
For extra security, devices installed in areas with limited protection (outdoor areas, underground parking lots,
restrooms, etc.) can be designed as a separate line. Enabling the filter tables in the Line Couplers (KNX only)
prevents attackers from gaining access to the whole system.
1.5
IP cabling inside the building
For building automation, use a separate LAN or WiFi network with its own hardware (routers, switches, etc.).
Regardless of the KNX system, apply the usual security mechanisms for IP networks. These are examples:
•
MAC filter
•
Encryption of wireless networks
•
Usage of strong passwords and protection of these against access by unauthorized persons
Note
The device cannot be reached during IP, TCP or UDP flooding (access from the Internet). To prevent this
reaction, set a data rate limit at network level.
Please discuss the topic with your network administrator.
