Siemens SIMATIC NET SCALANCE XCM-300, Руководство по эксплуатации продукта

Страница: 15 / 82

• Terminate management connections (e.g. HTTP, HTTPS, SSH, etc.) properly.
• Make sure the device is fully decommissioned before taking the device out of service.
For more information, refer to "Supplementary documentation (Page 7)".
Secure/non-secure protocols
• Use secure protocols when access to the device is not prevented by physical protection
measures.
• Disable or limit the use of non-secure protocols. While some protocols are secure (e.g. HTTPS,
SSH, 802.1X, etc.) , others were not designed for secure applications (e.g. SNMPv1/v2c, RSTP,
etc.).
Appropriate safeguards against non-secure protocols should be taken to prevent
unauthorized access to the device/network.
• If non-secure protocols and services are required, make sure the device is operated within a
protected network area.
• When a secure alternative is available for a protocol, use the secure version instead. For
example:
– Use HTTPS instead of HTTP
– Use SNMPv3 instead of SNMPv1/v2c
• Avoid or limit use of the following:
– Non-authenticated and unencrypted protocols
– Link Layer Discovery Protocol (LLDP)
• After commissioning, make sure Discovery and Configuration Protocol (DCP) access rights
are set to read-only.
Hardware/software
• Limit critical applications and access to management services to private networks.
Connecting a SINEC OS device to the Internet is possible. However, the utmost care should
be taken to protect the device and the network behind it using secure means, such as a
firewall and IPsec.
• Whenever possible, use VLANs to protect against Denial of Service (DoS) attacks and
unauthorized access.
• Select services are enabled by default in SINEC OS. It is recommended to only enable the
minimum services that are required for your setup.
For more information about available services, "Supplementary documentation (Page 7)".
• Use the latest Web browser version compatible with SINEC OS to make sure the most secure
ciphers available are employed. Additionally, 1/n-1 record splitting is enabled in the latest
Web browser versions of Mozilla Firefox, Google Chrome and Microsoft Edge, and mitigates
against attacks such as SSL/TLS Protocol Initialization Vector Implementation Information
Disclosure Vulnerability (e.g. BEAST).
Recommendations on network security
3.1 Security recommendations
SCALANCE XCM-300
Product
Manual, 04/2022, C79000-G8976-C585-01
15