Table of Contents
Advertisement
2.6
FIRMWARE
From time to time, to provide new functionality or address known issues, Siemens may make new versions of the
FEC920 firmware available.
This firmware may be downloaded from the Siemens website, and transferred to a FEC920 instrument in the field,
via a USB memory stick (or FTP server).
Caution: Non-Schneider Electric firmware
2.7
SUPPORTED PROTOCOLS AND THREAT MITIGATIONS
The FEC920 supports the following protocols on Ethernet. For each protocol, a list of mitigations are provided.
As a general comment, the firewall is configured to block all ports except those required for installed/enabled
options.
2.7.1 FTP Client
An external FTP client can access the FTP server on the instrument. This FTP server has default remote
username & password for each of the default users, passwords can be modified. Additional users can be added
with configurable remote username and passwords.
To mitigate threats:
1.
Physically protect access to subnet(s) in use.
2.
Firewall to block TCP port 21.
3.
It is recommended that user's should change their passwords regularly, this could be done manually or by
using the password expiry feature.
2.7.2 FTP Server
Up to two external FTP servers can be configured. The FEC920 will then connect to these servers as an FTP
client and push archive files to the servers.
Threat mitigation as for FTP Client.
2.7.3 ICMP (ping)
The FEC920 will respond to a ping to aid network diagnostics.
To mitigate threats:
1.
Physically protect access to subnet(s) in use.
2.
Use a firewall to block ICMP / ping.
2.7.4 DHCP
The FEC920 can allocate its IP address using DHCP; however this is typically set to fixed IP address allocation
by configuration. The DHCP server could be spoofed allocating an invalid IP address to the instrument.
To mitigate threats:
1.
Use fixed IP address allocation.
2.
Physically protect access to subnet(s) in use.
Page 6
FEC920: USER GUIDE
There is a potential risk that an attacker could upgrade a FEC920 with non-
genuine firmware that contains malicious code. To mitigate this potential risk,
genuine FEC920 firmware upgrade utility executables are always supplied digitally
signed with the publisher as Schneider Electric. Do not use a firmware upgrade
utility if it has not been signed by Schneider Electric.
Failure to follow these instructions can result in injury or equipment damage.
A5E45696052A Rev-AA
September 18
Advertisement
Table of Contents
