Security Recommendations
Sicore II Installation and Commissioning Guide
667/HB/52600/000 Issue 2 Unrestricted
15
2. Security Recommendations
2.1.
Password Security
Siemens strongly advises changing the username and password on installation (see Section
8.1). Ideally the password should be unique for each site and should have a management
process defined that contains:
•
A process for creating secure passwords
•
A method for authorised users to gain access to password
•
A requirement that passwords are changed at regular intervals.
The preferred alternative to passwords is to use Soft PKI Certificates.
2.2.
VPN
Where the VPN is provided by on-site communications equipment (ADSL, 4G) instead of
Sicore II, care should be taken to secure access to and from the communications equipment
by unauthorised personnel. This includes, but is not limited to, firewalls at the upstream
communications equipment and physical security.
An industry-standard security risk assessment should also be performed to assess any risks
introduced by the communications equipment.
2.3.
FTP
The use of FTP (File Transfer Protocol) is not advised without additional security precautions
as it does not provide any protection from the following attacks:
•
Man-in-the-middle – a compromised device can intercept the FTP file transfers
and capture confidential/personal information, for example images and Vehicle
Registration Marks. This information can be considered personal in some
countries and therefore covered by the GDPR/Other regulations.
•
Password snooping – the password for access to the FTP server is sent
unencrypted, this means that an attacker monitoring the network can capture
usernames and passwords that would allow them to bypass security on the server.
This would also allow an attacker to inject fake data.
•
Passwords may become uncontrolled – care should be taken during installation to
make sure that the passwords are transferred in a secure manner. Failure to do so
may lead to leaking the passwords - allowing attackers access to the FTP server.
2.4.
NTP
The Network Time Protocol does not provide any authentication. This means that an attacker
can fake the NTP messages and cause an NTP client to use the incorrect time. It is advised
that if NTP is to be used, multiple NTP servers should be set up and, where possible, Trusted
Time should also be used.