About this guideline Validity of this guideline The present documentation is not specifically related to any specific device or software version. It is rather to be understood as generic information which has to be supplemented by the related product-specific information given in the respective device manual or… Read More
VPN Via open Internet connections, criminals can copy data or make changes to the system. Using firewalls, the access to automation systems from the external networks can be restricted to authorized connections. In addition, remote connections via the Internet should always be encrypted, for example via a… Read More
Protection of project data on the hard disk and during transfer Engineering and parameterization tools (e.g. PLCnext Engineer) often store plain, i.e., unencrypted project data on the harddisk of your computer. The data is therefore unprotected against tampering and theft. Use a suitable encryption method: to… Read More
Plant management Making (physical) on-site access controllable In addition to the remote access, the “physical access” on site must also be controlled and restricted if necessary. To prevent damage due to unauthorized access: Make sure that only authorized access is possible. Protect the interfaces by… Read More
NAT and port forwarding General information Network Address Translation (NAT) separates internal (private) and external (public) network areas. A NAT device (which is usually located at the network or zone border) exchanges public and private IP addresses. This way, all internal network addresses are hidden behind the… Read More
Secure communication by encryption and authentication Main goals: integrity and authentication The implementations described in this chapter serve to pursue two main objectives of security engineering: to achieve data integrity and to authenticate users and data sources. Integrity: is the data unchanged? Checksums indicate the… Read More
Firewalls General information on firewalls A firewall is a system component which protects individual computers, IT systems and ICS networks from attacks and data corruption/misuse. Firewalls can prevent or restrict the spread of malware. The firewall is installed at a suitable system boundary. i.e., zone boundary… Read More
Technical PC hardening measures Any engineering tool, such as PLCnext Engineer, can manipulate devices or processes in your ICS. To reduce the risk of manipulation, perform security evaluations regularly. PC-based hardening and organization measures Protect any PCs used in automation solution environments against security-relevant manipulations. This… Read More
