Siemens 6GK5786-1FC00-0AA0, Руководство по эксплуатации

Страница: 13 / 86

Physical/remote access
• Operate the devices only within a protected network area. Attackers cannot access internal
data from the outside when the internal and the external network are separate from each
other.
• Limit physical access to the device exclusively to trusted personnel.
The memory card or the PLUG (C-PLUG, KEY-PLUG, CLP) contains sensitive data such as
certificates and keys that can be read out and modified. An attacker with control of the
device's removable media could extract critical information such as certificates, keys, etc. or
reprogram the media.
• Lock unused physical ports on the device. Unused ports can be used to access the system
without authorization.
• For communication via non-secure networks, use additional devices with VPN functionality
to encrypt and authenticate communication.
• When you establish a secure connection to a server (for example for an upgrade), make sure
that strong encryption methods and protocols are configured for the server.
• Terminate the management connections (e.g. HTTP, HTTPS, SSH) properly.
• Make sure that the device has been powered down completely before you decommission it.
For more information, refer to "Decommissioning (Page 5)".
• We recommend formatting a PLUG that is not being used.
Hardware/Software
• Use VLANs whenever possible as protection against denial-of-service (DoS) attacks and
unauthorized access.
• Restrict access to the device by setting firewall rules or rules in an access control list (ACL).
• Selected services are enabled by default in the firmware. It is recommended to enable only
the services that are absolutely necessary for your installation.
For more information on available services, see "List of available services (Page 11)".
• Use the latest web browser version compatible with the product to ensure you are using the
most secure encryption methods available. Also, the latest web browser versions of Mozilla
Firefox, Google Chrome, and Microsoft Edge have 1/n-1 record splitting enabled, which
reduces the risk of attacks such as SSL/TLS Protocol Initialization Vector Implementation
Information Disclosure Vulnerability (for example, BEAST).
• Ensure that the latest firmware version is installed, including all security-related patches.
You can find the latest information on security patches for Siemens products at the Industrial
Security (
https://www.siemens.com/industrialsecurity ) or ProductCERT Security Advisories
( https://www.siemens.com/cert/en/cert-security-advisories.htm ) website.
For updates on Siemens product security advisories, subscribe to the RSS feed on the
ProductCERT Security Advisories website or follow @ProductCert on Twitter.
• Enable only those services that are used on the device, including physical ports. Free physical
ports can potentially be used to gain access to the network behind the device.
• For optimal security, use SNMPv3 authentication and encryption mechanisms whenever
possible, and use strong passwords.
Security recommendations
SCALANCE W786-x
Operating Instructions, 12/2021, A5E03678337-14
13