Preface Table of Contents Introduction 1 SICAM / SIPROTEC Network Security 2 System Hardening for User Management 3 Substation Automation and Protection Logging 4 Malware Protection/Prevention 5 V01.30 Hardening 6 Appendix User Guide A List of Required Open Ports B Literature E50417-H8940-C619-A2 NOTE i For your own safety, observe the warnings and safety instructions contained in this document, if available. Disclaimer of Liability Copyright Subject to changes and errors. The information given in Copyright © Siemens 2019. All rights reserved. this document only contains general descriptions and/or The disclosure, duplication, distribution and editing of this performance features which may not always specifically document, or utilization and communication of the content reflect those described, or which may undergo modifica- are not permitted, unless authorized in writing. All rights, tion in the course of further development of the products. including rights created by patent grant or registration of a The requested performance features are binding only when utility model or a design, are reserved. they are expressly agreed upon in the concluded contract. Document version: E50417-H8940-C619-A2.01 Trademarks Edition: 11.2019 SIPROTEC™, DIGSI™, SIGRA™, SIGUARD™, SAFIR™, SICAM™, Version of the product described: V01.30 and MindSphere™ are trademarks of Siemens. Any unau- thorized use is prohibited. All other designations in this document may represent trademarks whose use by third parties for their own purposes may violate the proprietary rights of the owner. Preface Purpose of the Manual This document is a guideline for administrators and system engineers to design a substation based on SIPROTEC and SICAM products in a secure manner. The guideline addresses following domain: • Secure network topology • Firewalls and network-based Intrusion Detection Systems (NIDS) • Malware protection and prevention • User management and role-based access control • Business continuity and disaster recovery • System hardening Target Audience Protection system engineers, commissioning engineers, persons entrusted with the setting, testing and main- tenance of automation, selective protection and control equipment, and operational crew in electrical installa- tions and power plants, security experts, and security-versed administrators and integrators. Scope This manual applies to the substation automation systems based on SICAM, SIPROTEC, and SIMEAS products. Indication of Conformity This product complies with the directive of the Council of the European Communities on the approximation of the laws of the Member States relating to electromagnetic compatibility (EMC Council Directive 2004/108/EC) and concerning electrical equipment for use within specified voltage limits (Low-voltage Directive 2006/95 EC). This conformity is proved by tests conducted by Siemens AG in accordance with the Council Directive in agreement with the generic standards EN 61000-6-2 and EN 61000-6-4 for EMC directive, and with the standard EN 60255-27 for the low-voltage directive. The device has been designed and produced for industrial use. The product conforms with the international standards of the series IEC 60255 and the German standard VDE 0435. Standards IEEE Std C 37.90 The technical data of the product is approved in accordance with UL. For more information about the UL database, see ul.com You can find the product with the UL File Number E194016. IND. CONT. EQ. 69CA SICAM / SIPROTEC, System Hardening, User Guide 3 E50417-H8940-C619-A2, Edition 11.2019 Preface Additional Support For questions about the system, contact your Siemens sales partner. Customer Support Center Our Customer Support Center provides a 24-hour service. Siemens AG Customer Support Center Humboldtstrasse 59 90459 Nuremberg Germany E-mail: [email protected] Training Courses Inquiries regarding individual training courses should be addressed to our Training Center: Siemens AG Phone: +49 (911) 433-7415 Siemens Power Academy TD Fax: +49 (911) 433-7929 Humboldtstrasse 59 E-mail: [email protected] 90459 Nuremberg Internet: www.siemens.com/poweracademy Germany Notes on Safety This document is not a complete index of all safety measures required for operation of the equipment (module or device). However, it comprises important information that must be followed for personal safety, as well as to avoid material damage. Information is highlighted and illustrated as follows according to the degree of danger: ! DANGER DANGER means that death or severe injury will result if the measures specified are not taken. ² Comply with all instructions, in order to avoid death or severe injuries. ! WARNING WARNING means that death or severe injury may result if the measures specified are not taken. ² Comply with all instructions, in order to avoid death or severe injuries. ! CAUTION CAUTION means that medium-severe or slight injuries can occur if the specified measures are not taken. ² Comply with all instructions, in order to avoid moderate or minor injuries. 4 SICAM / SIPROTEC, System Hardening, User Guide E50417-H8940-C619-A2, Edition 11.2019 Preface NOTICE NOTICE means that property damage can result if the measures specified are not taken. ² Comply with all instructions, in order to avoid property damage. NOTE i Important information about the product, product handling or a certain section of the documentation which must be given attention. SICAM / SIPROTEC, System Hardening, User Guide 5 E50417-H8940-C619-A2, Edition 11.2019 Table of Contents Preface..........................................................................................................................................................3 1 Introduction..................................................................................................................................................9 1.1 Scope/Overview................................................................................................................ 10 1.2 Principles.......................................................................................................................... 10 2 Network Security........................................................................................................................................ 11 2.1 Principles of a Secure Substation Configuration................................................................. 12 2.2 Network Segmentation..................................................................................................... 12 2.3 Recommendations............................................................................................................ 13 2.4 VPN.................................................................................................................................. 13 2.4.1 General....................................................................................................................... 13 2.4.2 Windows IPSec Implementation................................................................................... 14 2.4.2.1 General..................................................................................................................14 2.4.2.2 Windows IPSec Configuration................................................................................. 14 2.4.2.3 IP Security Monitoring............................................................................................ 50 2.4.3 IPSec VPN Appliance Siemens SCALANCE S...................................................................51 2.4.3.1 General..................................................................................................................51 2.4.3.2 Siemens SCALANCE S Configuration....................................................................... 52 2.5 Firewall.............................................................................................................................59 2.5.1 Host-Based Firewalling................................................................................................ 59 2.5.2 SCALANCE S Firewall Functionality...............................................................................61 2.6 Parallel Redundancy Protocol (PRP)....................................................................................61 2.7 Secure Communication with the IEC 60870-5-104 Protocol............................................... 62 2.7.1 Fulfilling the IEC 62351-3............................................................................................ 62 2.7.2 IEC 60870-5-104 protocol............................................................................................64 2.7.3 Preconditions.............................................................................................................. 65 2.7.4 Creating Key Material.................................................................................................. 65 2.7.5 Building Your Own PKI (Public Key Infrastructure).........................................................66 2.7.5.1 Preparation of OpenSSL and Easy-RSA-PKI Scripts....................................................66 2.7.5.2 Usage of Easy-RSA-PKI............................................................................................ 69 2.7.6 Securing Application with Stunnel............................................................................... 77 2.7.6.1 General..................................................................................................................77 2.7.6.2