DOCSLIB.ORG

Security Guideline SIMATIC Wincc Open Architecture

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Security Guideline SIMATIC Wincc Open Architecture Preamble 1 Targets of the Security Guideline 2 Security Guideline References 3 SIMATIC WinCC Open Architecture Definitions 4 3.16 FP2 (P009) Strategy of the Security Guideline 5 Implementation of the Security Strategy for 6 Security Solutions Security Checklist 7 Glossary 8 Lists 9 05/2019 Legal Information Warning Concept This manual contains notes that need to be considered, to heed the secure configuration of a plant and to prevent damage to property. The notes on security impacts are shown by a warning triangle in different colors or a warning light. Notes referring to a minor or an improbably security issue have no symbols. The alerts and warnings are illustrated here in descending order of its level. DANGER Means that death or severe security issues will occur, if the corresponding precautions are not taken. WARNING Means that death or severe security issues may occur, if the corresponding precautions are not taken. CAUTION With a warning triangle means that moderate security issues may occur, if the corresponding precautions are not taken. ATTENTION With a grey warning triangle means that an undesirable event or condition may occur if the corresponding note is not heeded. CAUTION Without a warning triangle means that damage to property may occur, if the corresponding precautions are not taken. With the occurrence of multiple hazardous levels, the warning for the highest level is used. If a caution with the warning triangle warns of personal injury, it may also have a warning of damage to property. ETM professional control GmbH | A Siemens Company 05/2019 Copyright © ETM professional control GmbH | A Siemens Company A Siemens Company Marktstraße 3 A-7000 Eisenstadt subject to alterations 7000 Eisenstadt AUSTRIA Qualified Staff The product/system associated with this documentation should be handled only by personnel qualified for the task. They should handle the tasks assigned to them and paying attention to the associated documentation, like this document. Qualified persons, based on their training and experience, can detect risks and avoid possible hazards when handling these products/systems. Proper Use of ETM professional control GmbH products Please take note of the following: WARNING ETM professional control GmbH products should be used only for the application areas foreseen in the associated technical documentation. If third party products and components are used, they must be recommended and/or approved by ETM professional control GmbH. The fault-free and secure operation of the products assumes proper transport and storage, assembly, installation, commissioning, operation and maintenance. The permissible ambient conditions must be followed. Notes (Instructions) in the associated documentation must be seen and followed. Brands All names and designations marked with the registered trademark ® are registered brands of the Siemens AG or affiliated companies like e.g. ETM professional control GmbH. The use of the registered brands by a third party for their own purposes may infringe the rights of the owner. Disclaimer We have checked the contents of the documentation to ensure that they match the hardware and software described. Nevertheless, deviations cannot be entirely excluded, and we cannot, therefore, guarantee complete agreement. The information in this documentation is, however, reviewed regularly and any corrections necessary are incorporated in later editions. Information about the current version can be found in the page footer. Page 3 of 271 SIMATIC - WinCC Open Architecture3.16 FP2 (P009) Table of Content 1 PREAMBLE .......................................................................................................................................................................... 7 SCOPE .................................................................................................................................................................................. 7 INTENTION OF THIS DOCUMENT ................................................................................................................................................. 7 DISCLAIMER ........................................................................................................................................................................... 8 1.3.1 License ........................................................................................................................................................................... 8 STRUCTURE AND ORGANIZATION OF THIS DOCUMENT ................................................................................................................... 10 REQUIRED KNOWLEDGE.......................................................................................................................................................... 10 1.5.1 Training center ............................................................................................................................................................ 11 PRODUCTS USED .................................................................................................................................................................. 11 ABBREVIATIONS .................................................................................................................................................................... 13 2 TARGETS OF THE SECURITY GUIDELINE ............................................................................................................................. 16 3 REFERENCES ..................................................................................................................................................................... 17 IEC 62443/ISA99 ............................................................................................................................................................... 17 OTHER STANDARDS AND RULES ................................................................................................................................................ 21 OPERATIONAL GUIDELINES FOR INDUSTRIAL SECURITY ................................................................................................................. 22 4 DEFINITIONS ..................................................................................................................................................................... 23 NAMING SCHEME IN FIGURES AND EXAMPLES ............................................................................................................................. 23 NAMES OF THE NETWORKS IN THE “SECURITY GUIDELINE WINCC OPEN ARCHITECTURE" ................................................................... 24 5 STRATEGY OF THE SECURITY GUIDELINE ........................................................................................................................... 25 SECURITY MANAGEMENT PROCESS .......................................................................................................................................... 26 DEFENSE IN DEPTH ................................................................................................................................................................ 29 5.2.1 Defense in Depth concept ............................................................................................................................................ 30 5.2.2 Layers of protection ..................................................................................................................................................... 31 5.2.3 Implement Defense in Depth for different Types of Access ......................................................................................... 34 DIVISION IN SECURITY CELLS .................................................................................................................................................... 37 5.3.1 Process cells and security cells ..................................................................................................................................... 37 TASK-RELATED OPERATION AND ACCESS RIGHTS ........................................................................................................................ 39 TASK-BASED GROUPING, CENTRAL ADMINISTRATION AND LOCAL CONFIGURATION .............................................................................. 44 5.5.1 Requirements ............................................................................................................................................................... 44 5.5.2 Tasks ............................................................................................................................................................................ 44 5.5.3 Workstation authorization in WinCC OA ..................................................................................................................... 45 USAGE OF ENCRYPTED COMMUNICATION PROTOCOLS .................................................................................................................. 46 5.6.1 Usage of TLS protocol .................................................................................................................................................. 46 5.6.2 Usage of Kerberos........................................................................................................................................................ 51 6 IMPLEMENTATION OF THE SECURITY STRATEGY FOR SECURITY SOLUTIONS ...................................................................
Load more

Recommended publications
  • Tiny Core Linux
    THE TINY CORE LINUX HANDBOOK v 0.965 Not corrected draft (c) 2013 compiled by Thierry SALOMON tsalomon AT hotmail DoT com tinycorelinux.inf.hu Table of Contents TINY CORE LINUX .......................................................................................................................... 1 INTRODUCTION........................................................................................................................... 4 DOWNLOADING TINY CORE LINUX....................................................................................... 5 LIVE-CD MODE.............................................................................................................................6 THE GRAPHICAL USER INTERFACE........................................................................................7 Setting up the right screen resolution and mouse parameters.....................................................7 The Tiny Core Linux desktop..................................................................................................... 7 The Mouse menu.........................................................................................................................8 HOW TO SAVE YOUR SETTINGS (PERSISTENCE).............................................................. 10 INSTALLING TINY CORE LINUX ON A HARD DISK/FREE PARTITION..........................11 INSTALLING TINY CORE LINUX ON A USB-PENDRIVE................................................... 12 EMBEDDED INSTALLATION WITHIN WINDOWS...............................................................13
    [Show full text]
  • Manual Norton Partition Magic 8.0 Full Version for Windows 7
    Manual Norton Partition Magic 8.0 Full Version For Windows 7 Norton Partition Magic is an application used to manage hard disks on your computer, that has a If you are a moderator please see our troubleshooting guide. A familiar layout with disk map plus a full User Manual and lots of Help resources From EaseUS: As Partition Magic alternative, EaseUS Partition Master Home and GUID partition table (GPT) disk under Windows 2000/XP/Vista/7/8/8.1/10. If you have a Windows 8/8.1 system, DO NOT manage your partition with this. Supported OS: Windows 10/7/8/vista/XP and Windows Server 2003/2008/2012 Guide & Tips. How to extend system partition But Windows 8 is not supported by Norton Partition Magic), or can not be boot from a bootable CD/DVD. Partition. How to backup photos from iphone4 to icloud server backup windows server 2008 · Ipad compatible backup camera symantec netbackup 7.5 error code 58 Dodge grand caravan everyone the key NTFS partitions, made Source manually copy two components to users whose machines almost completely dead HDD. Magic EaseUS Partition Master is totally free partition manager for home users. Guide & Tips Say, create a new partition to install Windows 7, or extend the full system partition manager software for Windows 7 32 bit and 64 bit and Windows 8. Partition Magic ® is a registered trademark of Symantec Corporation. filemaker pro 12 crack norton partitionmagic 8.05 serial number keylogger for windows Camtasia studio 8 free download for windows 7 32bit vray 3ds max 2010 64 with Powerdvd 10 ultra 3d free download full version sony architect pro 5.2 photoshop lightroom mac serial windows 8 the missing manual captivate 4.
    [Show full text]
  • Inicio - Parted Magic
    Inicio - Parted Magic http://partedmagic.com/doku.php Parted Magic ⚙ Ver fuente Revisiones anteriores Backlinks ⚒ Los cambios recientes del sitio Login SÓLO EL € 0,20 Por Clic España Pago Por Clic - Empezar en 2 minutos www.addynamo.com Noticias Descargas Imágenes programas de cambios de Donaciones Ayuda Foro RSS Feed de Twitter de búsqueda Los programas de la adición de arranque Partición CLI Creación del LiveCD con InfraRecorder Creación del LiveCD con Nero Creación del LiveUSB Frugal Instale Cómo remasterizar el archivo iso PXE Con GParted Videos Eliminación de la contraseña de administrador en Windows XP 1 de 3 17/01/2012 8:43 Inicio - Parted Magic http://partedmagic.com/doku.php El Parted Magic OS cuenta con programas básicos de GParted y Parted para manejar las tareas de particiones con facilidad, mientras que con otros programas útiles (por ejemplo, Partimage, TestDisk, Truecrypt, Clonezilla, G4L, SuperGrubDisk, ddrescue, etc ...) y un excelente conjunto de información en beneficio de el usuario. Una amplia colección de herramientas de sistema de archivos también se incluyen, como Parted Magic soporta los siguientes: btrfs, ext2, ext3, ext4, FAT16, FAT32, HFS, HFS +, jfs, linux swap, ntfs, reiserfs y xfs. Parted Magic requiere al menos un procesador i586 y 312MB de RAM para funcionar o 175 MB en modo "LIVE". Reparación del sistema de Windows. Reparación y velocidad de tu ordenador. Optimización de sus sistemas Windows. Hermosa mujer china las mujeres chinas Para Salir y más, Únete gratis y Encuentra tu partido de hoy! www.asiamatchonline.com Software de espacio en disco Gestión de Espacio en disco duro.
    [Show full text]
  • The Cursor — Page 2 — June 18, 2011 Continued from Page 1 Bio: Stan Has Been Active with Personal Computers Behavior
    TThhee CCuurrssoorr Monthly Newsletter of the Washington Area Computer User Group Meeting Location: Next Meeting: OLLI, 4210 Roberts Road June 18, 2011 Fairfax, VA Presidential Bits by Geof Goodrum President, Washington Area Computer User Group In May, Paul Howard and Bill Walsh demonstrated the Skype videoconferencing and PC screen sharing system with help from Mel Mikosinki, Roger Fujii and others. Paul showed how the free Skype software (http://www.skype.com/) on a PC allowed several people to make video phone calls and have a meeting over the Internet and local network with tiled live video feeds from each. Several tips, though: invest in a good quality headset (headphone/microphone) to make PC Problem? video or phone calls; mute your microphone when you walk away from Bring it to the PC Clinic! your computer or don’t need to talk. Likewise, don’t forget that you are June 18 on “candid camera,” so mind your appearance and anything behind that you that might not want visible. And if you are doing a Skype demo Table of Contents with two systems in the same room with a speaker system like we Lloyd’s Web Sites...............2 were, definitely use headphones or mute your mikes – our apologies to User’s View of the iMac.....3 those who experienced the thrill of audio feedback when Mel joined the Linux News........................ 3 Skype video call with Paul across the room! GNU/Linux Distributions...4 The Skype demo was particularly timely, given Microsoft’s May 10th Linux Software...................5 announcement that it entered a deal to acquire Skype for an estimated Word Tips..........................
    [Show full text]
  • SIMATIC HMI Wincc V7.4 Wincc/Industrialdatabridge
    WinCC/IndustrialDataBridge Installation Notes 1 WinCC/IndustrialDataBridge Release Notes 2 WinCC/IndustrialDataBridge SIMATIC HMI Getting Started 3 WinCC/IndustrialDataBridge 4 WinCC V7.4 Documentation WinCC/IndustrialDataBridge System Manual Printout of the Online Help 8/2015 Printout of the Online Help Legal information Warning notice system This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury may result if proper precautions are not taken. CAUTION indicates that minor personal injury can result if proper precautions are not taken. NOTICE indicates that property damage can result if proper precautions are not taken. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The product/system described in this documentation may be operated only by personnel qualified for the specific task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified personnel are those who, based on their training and experience, are capable of identifying risks and avoiding potential hazards when working with these products/systems.
    [Show full text]
  • W32.Stuxnet Dossier Version 1.3 (November 2010)
    Security Response W32.Stuxnet Dossier Version 1.3 (November 2010) Nicolas Falliere, Liam O Murchu, and Eric Chien While the bulk of the analysis is complete, Stuxnet is an incredibly large and Contents complex threat. The authors expect to make revisions to this document Introduction ....................................................... 1 shortly after release as new information is uncovered or may be publicly Executive Summary ........................................... 2 disclosed. This paper is the work of numerous individuals on the Syman- Attack Scenario .................................................. 3 tec Security Response team over the last three months well beyond the Timeline .............................................................. 4 cited authors. Without their assistance, this paper would not be possible. Infection Statistics ............................................. 5 Stuxnet Architecture.......................................... 8 Introduction Installation ....................................................... 12 Load Point ........................................................ 16 W32.Stuxnet has gained a lot of attention from researchers and me- Command and Control ......................................17 dia recently. There is good reason for this. Stuxnet is one of the Windows Rootkit Functionality ....................... 20 most complex threats we have analyzed. In this paper we take a de- Stuxnet Propagation Methods......................... 21 tailed look at Stuxnet and its various components and particularly
    [Show full text]
  • W32.Stuxnet Dossier Version 1.2 (November 2010)
    Security Response W32.Stuxnet Dossier Version 1.2 (November 2010) Nicolas Falliere, Liam O Murchu, and Eric Chien While the bulk of the analysis is complete, Stuxnet is an incredibly large and Contents complex threat. The authors expect to make revisions to this document Introduction ....................................................... 1 shortly after release as new information is uncovered or may be publicly Executive Summary ........................................... 2 disclosed. This paper is the work of numerous individuals on the Syman- Attack Scenario .................................................. 3 tec Security Response team over the last three months well beyond the Timeline .............................................................. 4 cited authors. Without their assistance, this paper would not be possible. Infection Statistics ............................................. 5 Stuxnet Architecture.......................................... 8 Introduction Installation ....................................................... 12 Load Point ........................................................ 16 W32.Stuxnet has gained a lot of attention from researchers and me- Command and Control ......................................17 dia recently. There is good reason for this. Stuxnet is one of the Windows Rootkit Functionality ....................... 20 most complex threats we have analyzed. In this paper we take a de- Stuxnet Propagation Methods......................... 21 tailed look at Stuxnet and its various components and particularly
    [Show full text]
  • Report on the Worm Stuxnet's Attack
    Antiy Labs Report on the Worm Stuxnet’s Attack Antiy CERT Antiy Labs (October 2010) Contents Background of the Attack ......................................................................... 1 Behavior Analysis ..................................................................................... 1 Running Environment ................................................................................ 1 Local Behavior ........................................................................................... 2 Spread Method ......................................................................................... 4 Shortcut File Parsing Vulnerability (MS10-046) .................................... 5 RPC remote execution vulnerability (MS08-067), and privilege escalation vulnerability ......................................................................... 7 Print Spooler Service Vulnerability (MS10-061) .................................... 8 Attack Behavior ......................................................................................... 8 Generation Relationship ......................................................................... 10 Solutions and Proposals ......................................................................... 12 Attack Prevention .................................................................................... 12 Proposals on Security .............................................................................. 13 New Characteristics of the Attack ..........................................................
    [Show full text]
  • Network Video Recorder
    4-684-078-01 (2) Network Video Recorder Installation Manual Before operating the unit, please read this manual and the Safety Regulations thoroughly and retain them for future reference. HAW-EIBU Software Version 2016 R2 and Later © 2016 Sony Corporation Configuring Initial Settings with Setup Table of Contents Wizard ........................................................ 21 Configuring the Recording Disk Usage Precautions ...................................4 Settings ....................................................... 22 Package Contents ....................................6 Updating the Device Pack Version ............ 25 System Requirements ..............................7 Starting Management Client ...................... 26 Names and Functions of Parts................ 8 Front (without the Front Panel) .................... 8 Authorizing the Recording Server ............. 26 Front (with the Front Panel) ......................... 8 Configuring the Recording Destinations .... 26 Rear ............................................................... 9 Registering Cameras .................................. 27 Acquiring Reference Manuals and Quitting Management Client ...................... 28 Technical Documents ............................10 Step 5: Verifying Operation ................... 29 System Configuration............................ 11 Step 6: Activation ................................... 29 Single Network Video Recorder Exporting License Request Files (.lrq) ....... 29 Systems ......................................................
    [Show full text]
  • Stuxnet Virus
    Sarah Walterman, Liz Ottati, Hamad Mohammed Business Information Systems- Cybersecurity Term Project Stuxnet Virus The Stuxnet Virus was discovered in June 2010; however, it is said that the development started as early as 2005. It is a “500-kilobyte computer worm that infected the software of at least 14 industrial sites in Iran.”9 Malware exists in many forms, that is, worms, scareware, Trojans, spyware, and adware. Each of these programs has a unique way of compromising the way a computer functions. Over the years, there have been malware programs reported as threats to networks. As an instance, Stuxnet is one such malware existing in PCs. While it’s not known exactly who created Stuxnet, the most realistic guess is that the United States and Israel worked together to make it. The original purpose was to “derail, or at least delay, the Iranian program to develop nuclear weapons.”8 Most worms are created to just infect a computer, but Stuxnet was created to cause “real-world physical effects.”8 Developers of the malware made it in such a way that it attacks devices that meet a specific requirement. The worst-hit country was Iran. The state's top companies, especially those dealing with uranium infrastructure, were infected by Stuxnet.10 Stuxnet is believed to be spread using flash drives. “Stuxnet, as it came to be known, was unlike any other virus or worm that came before. Rather than simply hijacking targeted computers or stealing information from them, it escaped the digital realm to wreak physical destruction on equipment the computers controlled.”6 It was programmed to make the nuclear plant’s centrifuges spin faster than they were meant to and it eventually destroys them.
    [Show full text]
  • Common Information Commands
    PCLOS>digital magazine_ PCLOS Editor’s Desk Digital Magazine Staff A New And Exciting Year! Chief Editor Papawoob Welcome to a new and exciting year! This past year has given us the opportunity to bring you many articles that hopefully enhanced your PCLOS and Linux experiences. The Staff and Design & Concept myself are looking forward to another year of bringing you many more such experiences pmbasehore & silversaile this year. This issue will be the first with our new and much improved layout theme (we hope you enjoy it!.) Editors Trobbins • Myrddin • Jaydot This issue has more interesting articles including one which will teach you the basic commands used to find out information about your system, hardware, etc. Consultants We also have articles on how to repair kdeinit problems, a new script to compress Archie • Watcher directories and still have easy access to them, and a review of the new Parted Magic CD. We have links to great tutorials on using both The Gimp and Inkscape. HTML Layout gseaman You will also find a short plea for helping both the Mag Staff and the Documen- tation Team in transferring as many articles from previous issues of the Proofreaders Mag to the Wiki as possible. I proposed this idea to the Docu- Jaydot • historyb • Takeikin mentation Team but they are understaffed, as are we here at the RaveDave • GuyPronouncedGuy Dtrud0h • MeeMaw Mag. If you are interested in helping out the entire PCLOS malador • jaslar community by donating a little time and effort, then please moriancumer_12 follow the instructions you will find in the article.
    [Show full text]
  • The History of Stuxnet: Key Takeaways for Cyber Decision Makers Military Category Cyber Conflict Studies Association
    The History of Stuxnet: Key Takeaways for Cyber Decision Makers Military Category Cyber Conflict Studies Association - Call for Papers June 4th, 2012 The History of Stuxnet – Key Takeaways for Cyber Decision Makers 1 History is the witness that testifies to the passing of time; it illuminates reality, vitalizes memory, provides guidance in daily life and brings us tidings of antiquity. — Cicero Introduction In each profession and aspect of daily life there are decision makers who guide from their area of influence. These decision makers exist at every level of civilian and military leadership. It is through their choices, and the understanding of their choices’ impacts, that a nation collectively moves forward. This forward movement also exists in the development of the cyberspace domain. Cyber decision makers dictate tactical and strategic level choices to include capability development, employment, and overall strategies. It is by these choices that the cyberspace domain acts as a national level projection of power. The projection of power through offensive and defensive strategies in cyberspace offers unique challenges compared to the other warfighting domains due to its comparative youth. As a relatively new domain it is imperative to understand the history of key cyber events so that modern day decision makers can capitalize on the lessons learned. It is in this way that the best choices for the vectoring of the domain will present themselves. The Stuxnet cyber attack on the Iranian nuclear enrichment facility at Natanz is seen by many as the first true cyber weapon.1 This makes Stuxnet’s importance as a cyber event unparalleled in modern cyber history and specifically worth understanding.
    [Show full text]