System Integrity - Siemens SINAMICS Configuration Manual

General security measures

4.3 System integrity

4.3 System integrity
System integrity encompasses all of the measures to protect automation and drive systems –
along with control components, SCADA and HMI systems – that have to be protected against
unauthorized access and malware.
4.3.1 System hardening
4.3.1.1 Reduction of attack points
Services and ports
Activated services and ports represent a risk. Activate only the necessary services for all of
the automation components to minimize the risk. Ensure that all activated services are taken
into account in the security concept, especially web servers, FTP, remote maintenance, etc.
A description of all of the ports used can be found in chapter "Security Measures for
SINAMICS (Page 31)" or in the operating instructions and Function Manuals of the respective
products.
User accounts
Any active user account that allows access to the system is thus a potential risk. Therefore,
take the following security measures:
● Reduce the number of configured/activated user accounts to the actually needed minimum
● Use secure access data for existing accounts. This also involves assigning a secure
password.
● Regularly check the locally configured user accounts in particular.
● Regularly change the passwords.
PC in the industrial environment
PCs used in the industrial environment must comply with the generally valid security
recommendations. Therefore, take the following measures:
● Have the selected PC set up and administered by appropriate departments. Have the PC
checked regularly and kept up to date via patches. Thus it is ensured that software and
operating systems which are supported and maintained by the manufacturer are installed.
● Regularly install security updates and patches for the installed operating system. For more
information, refer to the Section "Patch management (Page 29)".
● Regularly install and update a current virus scanner on the PC that is used.
Alternatively, you can apply whitelisting (Page 29) and network segmentation (Page 21)
techniques.
● Configure the PC without administrator rights if possible.
26
Configuration Manual, 08/2017, A5E36912609A
Industrial Security