Schneider Electric Modicon Controllers Platform - Cyber Security Reference manual

Cyber Security

Important Information

Read these instructions carefully, and look at the equipment to become familiar with the device before trying to install, operate, service, or maintain it. The following special messages may appear throughout this documentation or on the equipment to warn of potential hazards or to call attention to information that clarifies or simplifies a procedure.

The addition of this symbol to a “Danger” or “Warning” safety label indicates that an electrical hazard exists which will result in personal injury if the instructions are not followed.

This is the safety alert symbol. It is used to alert you to potential personal injury hazards. Obey all safety messages that follow this symbol to avoid possible injury or death.

DANGER

DANGER indicates a hazardous situation which, if not avoided, will result in death or serious injury.

WARNING

WARNING indicates a hazardous situation which, if not avoided, could result in death or serious injury.

CAUTION

CAUTION indicates a hazardous situation which, if not avoided, could result in minor or moderate injury.

NOTICE

NOTICE is used to address practices not related to physical injury.

EIO0000001999.09

Cyber Security

Please Note

Electrical equipment should be installed, operated, serviced, and maintained only by qualified personnel. No responsibility is assumed by Schneider Electric for any consequences arising out of the use of this material.

A qualified person is one who has skills and knowledge related to the construction and operation of electrical equipment and its installation, and has received safety training to recognize and avoid the hazards involved.

Before You Begin

Do not use this product on machinery lacking effective point-of-operation guarding. Lack of effective point-of-operation guarding on a machine can result in serious injury to the operator of that machine.

WARNING

UNGUARDED EQUIPMENT

• Do not use this software and related automation equipment on equipment which does not have point-of-operation protection.

• Do not reach into machinery during operation.

Failure to follow these instructions can result in death, serious injury, or equipment damage.

This automation equipment and related software is used to control a variety of industrial processes. The type or model of automation equipment suitable for each application will vary depending on factors such as the control function required, degree of protection required, production methods, unusual conditions, government regulations, etc. In some applications, more than one processor may be required, as when backup redundancy is needed.

Only you, the user, machine builder or system integrator can be aware of all the conditions and factors present during setup, operation, and maintenance of the machine and, therefore, can determine the automation equipment and the related safeties and interlocks which can be properly used. When selecting automation and control equipment and related software for a particular application, you should refer to the applicable local and national standards and regulations. The National Safety Council's Accident Prevention Manual

(nationally recognized in the United States of America) also provides much useful information.

In some applications, such as packaging machinery, additional operator protection such as point-of-operation guarding must be provided. This is necessary if the operator's hands and

EIO0000001999.09

Cyber Security other parts of the body are free to enter the pinch points or other hazardous areas and serious injury can occur. Software products alone cannot protect an operator from injury. For this reason the software cannot be substituted for or take the place of point-of-operation protection.

Ensure that appropriate safeties and mechanical/electrical interlocks related to point-ofoperation protection have been installed and are operational before placing the equipment into service. All interlocks and safeties related to point-of-operation protection must be coordinated with the related automation equipment and software programming.

NOTE: Coordination of safeties and mechanical/electrical interlocks for point-ofoperation protection is outside the scope of the Function Block Library, System User

Guide, or other implementation referenced in this documentation.

Start-up and Test

Before using electrical control and automation equipment for regular operation after installation, the system should be given a start-up test by qualified personnel to verify correct operation of the equipment. It is important that arrangements for such a check are made and that enough time is allowed to perform complete and satisfactory testing.

EQUIPMENT OPERATION HAZARD

WARNING

• Verify that all installation and set up procedures have been completed.

• Before operational tests are performed, remove all blocks or other temporary holding means used for shipment from all component devices.

• Remove tools, meters, and debris from equipment.

Failure to follow these instructions can result in death, serious injury, or equipment damage.

Follow all start-up tests recommended in the equipment documentation. Store all equipment documentation for future references.

Software testing must be done in both simulated and real environments.

Verify that the completed system is free from all short circuits and temporary grounds that are not installed according to local regulations (according to the National Electrical Code in the U.S.A, for instance). If high-potential voltage testing is necessary, follow recommendations in equipment documentation to prevent accidental equipment damage.

Before energizing equipment:

• Remove tools, meters, and debris from equipment.

EIO0000001999.09

Cyber Security

• Close the equipment enclosure door.

• Remove all temporary grounds from incoming power lines.

• Perform all start-up tests recommended by the manufacturer.

Operation and Adjustments

The following precautions are from the NEMA Standards Publication ICS 7.1-1995 (English version prevails):

• Regardless of the care exercised in the design and manufacture of equipment or in the selection and ratings of components, there are hazards that can be encountered if such equipment is improperly operated.

• It is sometimes possible to misadjust the equipment and thus produce unsatisfactory or unsafe operation. Always use the manufacturer’s instructions as a guide for functional adjustments. Personnel who have access to these adjustments should be familiar with the equipment manufacturer’s instructions and the machinery used with the electrical equipment.

• Only those operational adjustments actually required by the operator should be accessible to the operator. Access to other controls should be restricted to prevent unauthorized changes in operating characteristics.

EIO0000001999.09

About the Book

Cyber Security

Document Scope

WARNING

UNINTENDED EQUIPMENT OPERATION, LOSS OF CONTROL, LOSS OF DATA

The system owners, designers, operators, and those maintaining equipment utilizing

Control Expert software must read, understand, and follow the instructions outlined in this document, Modicon Controllers Platform Cyber Security, Reference Manual (part number:

EIO0000001999).

Failure to follow these instructions can result in death, serious injury, or equipment damage.

This manual defines the cyber security elements that help you configure a system that is less susceptible to cyber attacks.

NOTE: The terms ‘security’, ‘secure; ‘secured’, securing’ are used throughout this document in reference to cyber security topics.

Validity Note

This documentation has been updated for EcoStruxure ™ Control Expert 15.2

The technical characteristics of the devices described in the present document also appear online. To access the information online, go to the Schneider Electric home page www.se.

com/ww/en/download/ .

The characteristics that are described in the present document should be the same as those characteristics that appear online. In line with our policy of constant improvement, we may revise content over time to improve clarity and accuracy. If you see a difference between the document and online information, use the online information as your reference.

Information Related to Cyber Security

Information on cyber security is provided on Schneider Electric website: http://www2.

schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page

Document available for download on cyber security support section:

EIO0000001999.09

Cyber Security

Title of Documentation

How can I ... Reduce Vulnerability to Cyber

Attacks? System Technical Note, Cyber

Security Recommendations

Webpage Address www.se.com/ww/en/download/document/STN v2

About the Book

Related Documents

Title of Documentation

Modicon M580 System Planning Guide

Modicon M580 Hardware Reference Manual

Modicon M580 BMENOC0301/11, Ethernet

Communication Module, Installation and Configuration

Guide

Modicon M340 for Ethernet, Communications Modules and Processors, User Manual

Quantum using EcoStruxure

Configuration, User Manuall

Premium and Atrium using EcoStruxure

Expert, Ethernet Network Modules, User Manuall

EcoStruxure ™ Control Expert, Operating Modes

Quantum using EcoStruxure

Hardware Reference Manual

Quantum using EcoStruxure

Manual

™

Control Expert, TCP/IP

Control Expert, 140

NOC 771 01, Ethernet Communication Module, User

Premium using EcoStruxure ™ Control Expert, TSX

ETC 101, Ethernet Communication Module, User

Manual

Modicon M340, BMX NOC 0401 Ethernet

Communication Module, User Manual

™ Control

Control Expert,

Reference Number

HRB62666 (English), HRB65318 (French), HRB65319

(German), HRB65320 (Italian), HRB65321 (Spanish),

HRB65322 (Chinese)

EIO0000001578 (English), EIO0000001579 (French),

EIO0000001580 (German), EIO0000001582 (Italian),

EIO0000001581 (Spanish), EIO0000001583

(Chinese)

HRB62665 (English), HRB65311 (French), HRB65313

(German), HRB65314 (Italian), HRB65315 (Spanish),

HRB65316 (Chinese)

31007131 (English), 31007132 (French), 31007133

(German), 31007494 (Italian), 31007134 (Spanish),

31007493 (Chinese)

33002467 (English), 33002468 (French), 33002469

(German), 31008078 (Italian), 33002470 (Spanish),

31007110 (Chinese)

35006192 (English), 35006193 (French), 35006194

(German), 31007214 (Italian), 35006195 (Spanish),

31007102 (Chinese)

33003101 (English), 33003102 (French), 33003103

(German), 33003104 (Spanish), 33003696 (Italian),

33003697 (Chinese)

35010529 (English), 35010530 (French), 35010531

(German), 35013975 (Italian), 35010532 (Spanish),

35012184 (Chinese)

S1A33985 (English), S1A33986 (French), S1A33987

(German), S1A33989 (Italian), S1A33988 (Spanish),

S1A33993 (Chinese)

S1A34003 (English), S1A34004 (French), S1A34005

(German), S1A34007 (Italian), S1A34006 (Spanish),

S1A34008 (Chinese)

S1A34009 (English), S1A34010 (French), S1A34011

(German), S1A34013 (Italian), S1A34012 (Spanish),

S1A34014 (Chinese)

10 EIO0000001999.09

About the Book

Cyber Security

Title of Documentation

Quantum EIO, Control Network, Installation and

Configuration Guide

EcoStruxure ™ Control Expert, Communication, Block

Library

Quantum using EcoStruxure

Modicon M580 BME CXM CANopen Modules, User

Manual

™ Control Expert,

Ethernet Network Modules, User Manual

MC80 Programmable Logic Controller, User Manual

Reference Number

S1A48993 (English), S1A48994 (French), S1A48995

(German), S1A48997 (Italian), S1A48998 (Spanish),

S1A48999 (Chinese)

33002527 (English), 33002528 (French), 33002529

(German), 33003682 (Italian), 33002530 (Spanish),

33003683 (Chinese)

33002479 (English), 33002480 (French), 33002481

(German), 31007213 (Italian), 33002482 (Spanish),

31007112 (Chinese)

EIO0000002129 (English), EIO0000002130 (French),

EIO0000002131 (German), EIO0000002132 (Italian),

EIO0000002133 (Spanish), EIO0000002134

(Chinese)

EIO0000002071 (English)

You can download these technical publications and other technical information from our website at www.se.com/ww/en/download/ .

EIO0000001999.09

Cyber Security

Presentation

Introduction

The goal of this book is to present the cyber security solutions implemented in modicon controllers and associated software applications. In addition to the solutions presented in this book, apply the guidelines provided in Schneider Electric cyber security technical notes available on the Schneider Electric website .

Schneider Electric Guidelines

Introduction

Your PC system can run various applications to enhance security in your control environment. The system has factory default settings that require reconfiguration to align with Schneider Electric device hardening recommendations of the defense-in-depth approach.

A topic dedicated to cyber security is available in the support area of the Schneider Electric website .

Defense-In-Depth Approach

In addition to the solutions presented in this book, the recommendation is to follow the

Schneider Electric defense-in-depth approach as described in the following STN guide:

• Book title: How can I ... Reduce Vulnerability to Cyber Attacks? System Technical

Note, Cyber Security Recommendations

• Website link description (book description): How Can I Reduce Vulnerability to

Cyber Attacks in PlantStruxure Architectures?

Managing Vulnerabilities

Reported vulnerabilities from Schneider Electric devices are notified in the Cybersecurity support webpage: http://www2.schneider-electric.com/sites/corporate/en/support/ cybersecurity/cybersecurity.page

12 EIO0000001999.09

Presentation

Cyber Security

If you face a cyber security incident or vulnerability not mentioned in the list provided by

Schneider Electric, you can report this incident or vulnerability by clicking Report an incident or vulnerability button in the Cybersecurity support webpage.

EIO0000001999.09

Cyber Security

Introduction

This chapter describes the actions to accomplish in Modicon controllers platform architecture in order to make it more secure.

System View

System Architecture

The following PlantStruxure architecture highlights the necessity to have a multi-layered architecture (with a control network and a device network) that can be more secured. A flat architecture (all equipment connected to the same network) cannot be secured properly.

14 EIO0000001999.09

Cyber Security

More Secured Communication

Equipment in the control room is more exposed to attacks than equipment connected to the device network. Therefore, implement more secured communication between the control room and the PAC and devices. Isolate the device network from the other network levels

(such as control networks and remote networks).

In the system architecture above, the control room area is grayed to distinguish it from the

PAC and devices.

More Secured Access to the USB Ports

The physical access to the CPU USB ports needs to be controlled.

NOTE: Securing the CPU USB ports can only be done by physical means (for example cabinet or physical key).

More Secured Access to the Hot Standby Link and

Device Network

Control the physical access to the Hot Standby link and to the device network.

Testing

Control Expert provides a simulator that you can use to test your application before commissioning it as part of your industrial automation system. The simulator conforms to the cyber security requirements that:

• The simulator can be operated only with an application open in Control Expert.

• The application open in the simulator cannot be uploaded from the simulator to the

PLC.

For information on how to operate the simulator, refer to the help for the EcoStruxure™

Control Expert, PLC Simulator .

EIO0000001999.09

Cyber Security

Setting Passwords in Control Expert

Use Control Expert software to set passwords that help secure your project. The following passwords can be set:

• Application password, with or without file encryption

• Safe area password

• Firmware upgrade password

• Program unit, section, and subroutine password

• Data storage/web password

Application Password

Control Expert provides a password mechanism to help guard against unauthorized access to the application. Control Expert uses the password when you:

• Open the application in Control Expert.

• Connect to the PAC in Control Expert.

Application protection by a password helps prevent unwanted application modification, download, or opening of application files. The password is stored encrypted in the application.

In addition to the password protection you can encrypt the .STU, .STA and .ZEF files. The file encryption feature in Control Expert helps prevent modifications by any malicious person and reinforces protection against theft of intellectual property. The file encryption option is protected by a password mechanism.

NOTE: When a controller is managed as part of a system project, the application password and file encryption are disabled in Control Expert editor and need to be managed by using the Topology Manager.

For information on how to set and use application passwords, refer to the Application

Protection topic in the EcoStruxure ™ Control Expert Operating Modes manual.

Safe Area Password

Safety CPUs include a safe area password protection function, which is accessible from the

Properties screen of the project. This function is used to help protect project elements located within the safe area of the safety project.

When the safe area password protection function is active, the safe parts of the application cannot be modified.

16 EIO0000001999.09

Cyber Security

For information on how to set and use safe area passwords, refer to the Safe Area

Password Protection topic in the EcoStruxure ™ Control Expert Operating Modes manual.

Firmware Upgrade Password

Firmware protection by a password helps prevent unwanted access to the module firmware via FTP.

For information on how to set and use firmware passwords, refer to the Firmware Protection topic in the EcoStruxure ™ Control Expert Operating Modes manual.

Program Unit, Section, and Subroutine Password

The program unit, section, and subroutine protection function — when enabled — uses a password to help protect these program elements. This function can be set and accessed from the Properties screen of the project in offline mode.

For information on how to set and use program unit, section, and subrouting passwords, refer to the Program Unit, Section, and Subroutine Protection topic in the EcoStruxure ™

Control Expert Operating Modes manual.

Data Storage/Web Password

For Modicon M580 CPUs in a project created by Control Expert with version:

• Earlier than version 15.1, you can provide password protection for data storage access.

• Version 15.1 or later, you can provide password protection for both web diagnostics and data storage access.

Protection by a password helps prevent unwanted access to the data storage zone of the

SD memory card (if a valid card is inserted in the CPU).

For information on how to set and use data storage/web passwords, refer to the Data

Storage/Web Protection topic in the EcoStruxure ™ Control Expert Operating Modes manual.

Hardening the PC

Workstation PCs located in the control room are highly exposed to attacks. Those PCs supporting EcoStruxure ™ Control Expert or EcoStruxure ™ Server Expert need to be hardened.

EIO0000001999.09

Cyber Security

Attack Surface Reduction, page 18

As these applications all run on the Windows OS, this chapter offers guidelines on how to how to harden a PC by focusing on security for Windows 10.

Hardening the Engineering Workstation

The following key features are used to help secure the workstation. Click on an item for more information about that feature:

•

•

Security Policy Configuration and Checking, page 19

•

User Account Management, page 19

•

Access Control Management, page 20

•

Securing Network Services, page 20

, including:

◦

Disabling Remote Desktop Protocol, page 21

◦

Disabling LANMAN and NTLM, page 21

◦

Disabling Unused Network Interface Cards, page 22

◦

Configuring the Local Area Connection, page 22

•

Enable or Install Antivirus Protection Tool, page 23

•

Systematic Patch Management, page 23

•

Backup Management, page 23

•

Confidentiality Management, page 24

•

Audit Management, page 24

This topic also includes references to several

Windows 10 cybersecurity configuration guides, page 24

Attack Surface Reduction

The attack surface of your networked system is the collection of areas where an intruder can attempt to add or extract data.

To help reduce the potential attack surface:

• Disable all software applications, services, and communication ports that are not used.

• Disable or restrict access to removable storage devices (for example, USB).

• Use the workstation for only a single function (for example, install OPC UA Server

Expert and Control Expert on different PCs).

18 EIO0000001999.09

referenced below., page 24

Cyber Security

Security Policy Configuration and Checking

Windows Security Policy can be set through Group Policy objects.

A Group Policy Object (GPO) is a set of configuration changes that can be applied to a PC workstation. For more information about Local Group Policy Editor, refer to the security configuration guides from the Center for Internet Security (CIS)

Domain GPOs can also be defined in Windows Active Directory.

Security configurations need to be checked regularly and automatically.

User Account Management

• Change Default Passwords :

Before deploying any new asset, change all default passwords to values that are consistent with administrative level accounts.

Disable Windows automatic login.

For a description of Windows account password settings, refer to the security configuration guides from the Center for Internet Security (CIS)

referenced below., page

• Setup User Accounts :

The user accounts can be defined either locally (workgroup) on a standalone computer or through a Windows Active Directory domain controller that allow to centralize the management of all users in a system.

Follow these recommendations when setting up user accounts:

◦ Use a standard individual user account (without Administrator privilege) to run the software applications that are configured to run as standalone applications (for example, Control Expert).

◦ Use a local system account for the software applications that are configured to run as a Service (for example, OFS UA).

◦ Use a dedicated Administrative account to install the software applications and to configure IPSec.

◦ Set up a password manager to manage your passwords (for example, KeyPass).

◦ Disable all accounts that are not associated to business (for example, Debug accounts).

Refer to CIS control 16.8., page 24

◦ Automatically disable dormant accounts after a set period of inactivity.

Refer to CIS control 16.9., page 24

◦ Automatically lock workstation sessions after a standard period of inactivity.

Refer to

CIS control 16.11., page 24

EIO0000001999.09

Cyber Security

Access Control Management

Access to all information stored on systems with file system, network share, claims, application, or database needs to be controlled. These controls enforce the Least Privilege

Principle , i.e., that only authorized individuals can access information, and the information they can access is only the information they minimally require given their responsibilities.

Permissions are related to objects. Depending on the objects, permission can be implemented based on:

• Windows Active Directory objects.

• NTFS Files access through discretionary access control list (DACLs).

• Shared folder permissions.

• Remote Registry service (enable/disable).

Privileges are user rights that are not tied to an object, but are instead machine-specific.

They can be managed through Group Policy settings, for example, “Removable storage access” settings in Local group policy editor can restrict access to USB device storage (read or write).

Helping Secure Network Services

The best way to help secure a service is to uninstall or disable it. We recommend that you disable or uninstall all unnecessary services.

There are several ways to disable a service (Services Tool, Security Template, Group Policy

Objet, PowerShell, SC.exe).

In addition, we recommend that you use Windows firewall with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.

• Firewall usage :

The Windows firewall is needed for IPSEC configuration on Windows 10. In recent versions of Windows operating systems, including Windows 10, the firewall is enabled by default. More details on Windows Firewall settings refer to the security configuration guides from the Center for Internet Security (CIS) referenced below.

• Server Manager tool :

Server Manager lets you view all the dependencies of a feature so you can determine if it is wise to remove it from a Windows Server.

Server roles can be selected (for example, Web Server (IIS), DNS Server, and so forth).

Server features can be selected (for example, BitLocker, .NET Framework, and so forth).

20 EIO0000001999.09

Refer to the link, below., page 24

Cyber Security

• Internet Information Server (IIS) – Web Server Security :

Use a minimal installation of the latest version.

Configure IIS Access Control (TLS and user authentication).

Enable logging and review the logs for hacking signatures.

More details on IIS settings are provided in the CIS benchmark document (

• Disabling SMBv1 :

Server Message Block version 1 (SMBv1) is a protocol used for sharing services (such as printing, files and communication) between PCs on a network. SMBv1 has been demonstrated to present the vulnerability of allowing remote code execution on the host

PC.

We recommend that you disable SMBv1,

Disabling the Remote Desktop Protocol

Schneider Electric’s defense-in-depth approach recommendations include disabling remote desktop protocol (RDP) unless your application requires the RDP. The following steps describe how to disable the protocol:

Step

Action

In Windows 10, disable RDP via Computer

Settings .

> System Properties > Advanced System

On the Remote tab, deselect the Allow Remote Assistance Connections to this Computer check box.

Select the Don’t Allow Connection to this Computer check box.

Disabling LANMAN and NTLM

We recommend that you disable both the Microsoft LAN Manager protocol (LANMAN and its successor NT LAN Manager (NTLM). Both protocols have vulnerabilities that make their use in control applications inadvisable.

The following steps describe how to disable LANMAN and NTLM in a Windows 10 system:

Step

Action

In a command window, execute secpol.msc

to open the Local Security Policy window.

Open Security Settings > Local Policies > Security Options .

EIO0000001999.09

Cyber Security

Step

Action

Select Send NTLMv2 response only. Refuse LM & NTLM in the Network Security: LAN

Manger authentication level field.

Select the Network Security: Do not store LAN Manager hash value on next password change check box.

In a command window, enter gpupdate to commit the changed security policy.

Disabling Unused Network Interface Cards

We recommend that network interface cards not required by the application are disabled.

For example, if your system has 2 cards and the application uses only one, verify that the other network card (Local Area Connection 2) is disabled.

To disable a network card in Windows 10:

Step

Action

Open Control Panel

Adapter Settings .

> Network and Internet > Network and Sharing Center > Change

Right-click the unused connection. Select Disable .

Configuring the Local Area Connection

Various Windows network settings provide enhanced security aligned with the defense-indepth approach that Schneider Electric recommends.

In Windows 10 systems, access these settings by opening Control Panel > Network and

Internet > Network and Sharing Center > Change Adapter Settings > Local Area

Connection (x).

This list is an example of the configuration changes you might make to your system on the

Local Area Connection Properties screen:

• Disable all IPv6 stacks on their respective network cards.

• Deselect all Local Area Connection Properties items except for QoS Packet

Scheduler and Internet Protocol Version 4 .

• Under the Wins tab on Advanced TCP/IP Settings , deselect the Enable LMHOSTS and Disable NetBIOS over TCP/IP check boxes.

• Enable File and Print Sharing for Microsoft Network .

Schneider Electric’s defense-in-depth recommendations also include the following:

22 EIO0000001999.09

Configure devices to not auto-run content from removable media: USB ( Refer to CIS control 8.5)., page 24

• Define only static IPv4 addresses, subnet masks, and gateways.

• Do not use DHCP or DNS in the control room.

Cyber Security

Enable or Install Antivirus Protection Tools

You can improve the system response against viruses and malicious code using your built-in tools in Windows 10. You can also install additional antivirus software if necessary.

Enterprise editions of Windows 10 include Windows Defender Advanced Threat Protection , a security platform that monitors endpoints, such as Windows 10 PCs using behavioral sensors. Microsoft’s SmartScreen technology is another built-in feature that scans, downloads and blocks the access to websites and downloads that are known to be malicious.

More details on Windows Defender settings are provided in the Center for Internet Security

(CIS) document referenced below, including:

• Ensure that the organization’s anti-malware software updates its scanning engine and signature database on a regular basis (CIS Control 8.2).

• Configure Anti-Malware Scanning of Removable Media: USB (Refer to

CIS Control

8.4)., page 24

•

Systematic Patch Management

Always install the last stable version of any security-related updates of the Operating

System, Applications (including web browsers and e-mail client), Drivers.

Enable auto update in Windows 10.

More details are provided in the Center for Internet Security (CIS) document

referenced below., page 24

Backup Management

Ensure that:

• All system data is automatically backed up on a regular basis (

Refer to CIS control

10.1)., page 24

EIO0000001999.09

Cyber Security

processes such as imaging, to enable the quick recovery of an entire system. ( Refer to

• The organization’s key systems are backed up as a complete system, through

CIS control 10.2)., page 24

• Backups are properly protected via physical security or encryption when they are stored, and also when they are moved across the network. This includes remote

backups and cloud services. ( Refer to CIS control 10.4)., page 24

• All backups have at least one offline (i.e., not accessible via a network connection)

backup destination ( Refer to CIS control 10.5)., page 24

You can:

• Use File History and other free tools in Windows 10 to create file backups.

• Create a recovery drive to restore your system from an image backup.

• Use a storage-sync-and-share service, to put your backups in the cloud. These are easy to set up, especially some of the most popular ones like OneDrive , Dropbox , or

Google Drive .

More details on Windows File History, backup/restore settings are provided in CIS document referenced below.

Confidentiality Management

Remove sensitive data or systems not regularly accessed by the organization from the network. These systems can be used as stand-alone systems (disconnected from the network) of the business unit that needs to occasionally use them, or can be completely virtualized and powered off until needed. Refer to the CIS document referenced below.

(

Refer to CIS control 13.2)., page 24

Turn on disk encryption with Bitlocker . More details on Bitlocker settings are provided in the

CIS Document referenced below.

Audit Management

Ensure that local security logging has been configured on Windows hosts. For details on

Audit Policy configuration,

refer to the CIS Document referenced below., page 24

Windows 10 Cybersecurity Configuration Guides

To have a complete set of Windows 10 Cybersecurity settings it is highly recommended to use Windows configuration guides, including

24 EIO0000001999.09

Cyber Security

• Security configuration guides from Center for Internet Security – CIS https://www.cisecurity.org/press-release/cis-controls-microsoft-windows-10-cyberhygiene-guide/

◦ IG1 Level: https://www.cisecurity.org/cis-benchmarks/ https://www.cisecurity.org/benchmark/microsoft_windows_desktop/ https://www.cisecurity.org/benchmark/microsoft_iis/

• Security configuration guidelines developed by United States Department of Defense

(DISA STIG) https://www.stigviewer.com/stig/windows_10/2020-06-15/

Both the "CIS benchmarks" document and “STIG Windows 10 Security technical implementation guide” propose optional profiles. Your choice of a profile depends on the criticality of your applications running on Windows.

Disable Unused Embedded Communication

Services

Embedded Communication Services

Embedded communication services are IP-based communication services used in server mode on an embedded product (for example HTTP or FTP).

Recommendation to Disable Unused Services

To reduce the attack field, Schneider Electric strongly recommends that you disable any unused embedded service — for example HTTP and FTP — to close potential communication doors.

Disable Ethernet Services in Control Expert

You can enable/disable Ethernet services using the Ethernet tabs in control Expert. Tabs description is provided for each of the following platform:

•

Modicon M340, page 98

•

Modicon M580, page 99

EIO0000001999.09

Cyber Security

Modicon X80 modules, page 101

•

Modicon Quantum, page 99

•

•

Modicon Premium/Atrium, page 103

Set the Ethernet tabs parameters before you download the application to the CPU.

The default settings (maximum security level) reduce the communication capacities. If services are needed, they have to be enabled.

NOTE: On some products, the ETH_PORT_CTRL (see EcoStruxure™ Control

Expert, Communication, Block Library) function block allows to disable a service enabled after configuration in Control Expert application. The service can be enabled again using the same function block.

Restrict Data Flow from Control Network (Access

Control)

Data Flow from Control Network

Data flow from control network is an IP-based data flow initiated on the control network.

Description

In order to control the access to communication servers in an embedded product, the access control management restricts the IP-based data flow from control network to an authorized source or subnet IP address.

26 EIO0000001999.09

Cyber Security

Architecture Example

The purpose of the following figure is to show the role and impact of the access control settings. The access control manages the Ethernet data flow from devices communicating on the operation and control networks (located in the grayed out area).

(*) Some services require access to the device network (for example: firmware update, at source time stamping). In such cases, an optional router/VPN helps secure the access control.

Setting the Authorized Addresses in the Architecture

Example

Access control goals:

EIO0000001999.09

Cyber Security

• Any equipment connected to the operation network (IP address = 192.200.x.x) can access the CPU Web server.

• Any equipment connected to the control network (IP address = 192.200.100.x) can communicate with the CPU with Modbus TCP and can access the CPU Web server.

To restrict data flow in previous architecture example, the authorized addresses and services are set as follows in Control Expert access control table:

Source IP address Subnet Subnet mask EIP SNMP

No –

FTP

–

TFTP

–

HTTP

HTT-

–

Port502

– – + Network manager

Operation network

Automation

Device

Maintenance /

Unity Loader

192.200.50.2

192.200.0.0

192.200.100.2

Control network

+ Selected

192.200.100.0

– Not selected or no content

Yes

255.255.0.0

–

255.255.255.0

–

Settings Description

An authorized address is set for devices authorized to communicate with the CPU using

Modbus TCP or EtherNet/IP.

Services settings explanation for each IP address in previous example:

192.200.50.2 (SNMP): Set to authorize the access from the network manager using SNMP.

192.200.0.0 (HTTP/

HTTPS):

Operation network subnet is set to authorize all Web browsers connected to the operation network to access the CPU web browser.

192.200.100.2 (FTP): Set to authorize the access from Automation Device Maintenance / Unity Loader with FTP.

192.200.100.0 (Port502): Control network subnet is set to authorize all equipment connected to the control network (OFS, Control Expert, Automation Device Maintenance, Unity Loader) to access the CPU via Port502 Modbus.

28 EIO0000001999.09

Cyber Security

NOTE: The access list analysis goes through each access control list entry. If a successful match (IP address + allowed service) is found, then the other entries are ignored.

In Control Expert security screen, for a dedicated subnet enter the specific rules before the subnet rule. For example: To give a specific SNMP right to device 192.200.50.2, enter the rule before the global subnet rule 192.200.0.0/255.255.0.0 which allows HTTP access to all the devices of the subnet.

Set Up Encrypted Communication

Introduction

The goal of encrypted communication is to help protect the communication channels that allow remote access to the critical resources of the system (such as PAC embedded application, firmware). IPsec (Internet Protocol Security) is an open standard defined by the

IETF to provide protected and private communications on IP networks provided by using a combination of cryptographic and protocol security mechanisms. Our IPsec protection implementation includes anti-replay, message integrity check, and message origin authentication.

IPsec is supported on Microsoft Windows versions 7 and 10. It is initiated from the PC operating system.

Description

The IPsec function helps to secure:

• The control room Modbus access to the PAC CPU through the BMENOC0301/11 module.

• The control room access to the communication services running inside the

BMENOC0301/11 module in server mode (Modbus, EtherNet/IP, HTTP, FTP, SNMP).

NOTE: IPsec is intended to help secure services running in server mode in the PAC.

Secure client services initiated by the PAC are outside the scope of this manual.

Wireless connection: When a PMXNOW0300 wireless module is used to configure a wireless connection, configure this module with the maximum security settings available

(WPA2-PSK).

EIO0000001999.09

Cyber Security

Architecture Example

The purpose of the following figure is to illustrate through an example the various protocols or services involved in a encrypted communication from the control room to a Modicon

M580 PAC.

Encrypted communication (IPsec).

Non IPsec communication.

EIO0000001999.09

Cyber Security

Data Flow with Encrypted Communication Capability

Use these services to facilitate communications when IPsec is enabled:

Ethernet Service

EIP class 3 server

FTP server, TFTP server

HTTP

ICMP (ping, etc.)

Modbus server (port 502)

ARP

LLDP loop check protocol

Modbus scanner

RSTP

DHCP, BootP client

DHCP, BootP server

EIP class 1, TCP (forward open)

EIP class 1, UDP (data exchange)

Modbus client

NTP client

SNMP agent

SNMP traps

Syslog client (UDP)

Data Flows Security

These services are supported through encrypted connections.

These services are supported through encrypted and unencrypted connections.

NOTE: This traffic bypasses the IPsec protocol handling in the BMENOC and therefore does not use IPsec.

These services are not supported when IPSec is enabled.

NOTE: Before IKE/IPsec is initiated by the peer (PC), this traffic is not secured by IPSec. After IKE/IPSec is established, this traffic is encrypted by IPsec. Protocol could be supported, but only if packet recipient is a PC with IPSec configured and enabled.

NOTE:

• IPsec is an OSI layer 3 protection. OSI layer 2 protocols (ARP, RSTP, LLDP, loop check protocol) are not protected by IPsec.

• Global Data communication flow (using BMXNGD0100 modules) cannot be secured by IPsec. Use such a configuration on an isolated network.

EIO0000001999.09

Cyber Security

architecture example figure, page 30 ).

Limitations

IPsec limitations in the architecture: BMENOC0301/11 does not support IP forwarding to device network.

If transparency is required between control and device network, an external router/vpn is needed to provide an encrypted communication between the control and device network (as shown in previous

Transparency is required to perform the following operations from the control network:

• Update Modicon M580 CPU firmware from the Automation Device Maintenance through HTTPS service or from Unity Loader software through FTP service.

• Perform a network diagnostic of Modicon M580 CPU from a network management tool through SNMP service.

• Diagnose a Modicon M580 CPU from a DTM through EIP service.

• Diagnose a Modicon M580 CPU from a Web browser through HTTP service.

• Log Modicon M580 CPU cyber security events in a syslog server through syslog service.

• Synchronize Modicon M580 CPU time from a global time server through NTP service.

Setting Up IPsec Communication in the System

Architecture

Proceed with the following steps to set up the IPsec communication:

• In the control room, identify the client authorized applications that need to communicate with the PAC using Modbus (Control Expert, Automation Device Maintenance, Unity

Loader, OFS, customer applications such as SGBackup, ...).

Configure IPsec on each PC supporting these authorized applications.

• In the control room, identify the client authorized applications that need to communicate with each BMENOC0301/11 module configured in the local rack (Control Expert DTM,

Automation Device Maintenance, Unity Loader, SNMP manager, Web browser, Web designer for FactoryCast BMENOC0301/11 module).

Configure IPsec on each PC supporting these authorized applications.

32 EIO0000001999.09

Hardening the PC topic , page 17 .

Cyber Security

• Incorporate a BMENOC0301/11 module with IPsec function on the backplane of each

PAC connected to the control network.

To configure the IPsec function on a BMENOC0301/11 module, proceed in 2 steps:

◦ Enable IPsec function.

◦ Configure a pre-shared key. A pre-shared key is used to build a shared secret allowing two devices to authenticate each other.

NOTE: Because IPsec relies on this shared secret, it is a key element in the security policy that is managed by the security administrator only. To increase the security of the pre-shared key, we recommend that you use an external tool such as

KeePass, page 33

to generate an appropriate character string.

The BMENOC0301/11 module configuration is performed with Control Expert. The application is initially downloaded through USB link, future downloads are performed through Ethernet with an IPsec function if IPsec is enabled.

Each PC supporting IPsec needs to comply with the following requirements for IPsec configuration:

• Use Microsoft Windows 10 OS.

• Have the administrator rights to configure IPsec.

Once the IPsec configuration is performed, set the Windows account as a normal user account without administrator privilege.

• Harden the PC as explained in the

More details on configuration are provided in the Configuring IP Secure Communications topic (see Modicon M580, BMENOC0301/0311 Ethernet Communications Module,

Installation and Configuration Guide).

Generate Pre-Shared Keys with the Highest Security

The security of IPsec communications relies on the complexity of the pre-shared key. We recommend the use of specialized tools to generate pre-shared keys of the highest security.

One such tool is KeePass, which you can download as freeware from the Internet.

Download and install KeePass to your PC and launch it.

Configure and use KeePass v2.34 to generate passwords that can be used as pre-shared keys:

Step

Action

Create a new key database folder ( File

New ),

In the Create New Password Database dialog box, enter a folder name in the File name field and record your modifications.

EIO0000001999.09

Cyber Security

Step

Action

In the Create Composite Master Key dialog box, enter a Master password . Enter the password again in the Repeat password field.

Press OK to open Step 2 and press OK again.

In the new database dialog box, expand New Database .

Select Network and add an entry ( Edit > Add Entry ).

In the Title field, enter a name for your module (for example, eNOC).

In the User name field, enter a user name.

Click the Generate a password icon.

Select Open password generator .

Press OK to populate the Password and Repeat fields.

Open the Password Generation Options dialog box ( Tools > Generate Password ).

Make these selections at Generate using character set :

• Upper-case (A, B, C, …)

• Lower-case (a, b, c, …)

• Digits (0, 1, 2, …)

• Minus (-)

• Underline (_)

• Special (!, $, %, &, …)

• Brackets ([, ], [, (, ), <, >)

NOTE: These characters are not accepted for use in the pre-shared key:

• {

• }

• ;

• #

Press OK .

Right-click on your device in the Database list and scroll to Copy Password .

Open the security configuration screen in Control Expert.

Paste the key in the IPsec configuration screen.

34 EIO0000001999.09

Cyber Security

Diagnose IPsec Communication in the System

Architecture

Information on IPsec diagnostic in the system architecture is provided in the Configuring IP

Encrypted Communications topic (see Modicon M580, BMENOC0301/0311 Ethernet

Communications Module, Installation and Configuration Guide).

CSPN Security Target

CSPN Introduction

CSPN (Certification de Sécurité de Premier Niveau) is a cyber security certification currently used in the country of France. A product with CSPN certification is expected to withstand a cyber attack driven by two man months of skilled hackers.The Modicon M580 platform is

CSPN-certified. This topic describes the environment, programmable automation controller

(PAC) configurations, and parameters that meet CSPN requirements to effect the highest level of security.

M580 Introduction

The M580 PAC is designed to control and command an industrial process continuously without human intervention. At each step, the PAC processes the data received from its inputs, the sensors, and sends commands to its outputs, the actuators. Exchanges with the supervision (HMI, SCADA) are performed via a BMENOC0301/0311 Ethernet communication module on the local rack with the PAC.The PAC can run in a hostile environment despite humidity, dust, or unusual temperatures for IT systems and strong EMC or mechanical constraints.

EIO0000001999.09

Cyber Security

The following illustration describes a typical M580 platform architecture that can be vulnerable to a security attack:

1 operator using Control Expert

2 attacker

3 supervision network

4 field network with no attacker

EIO0000001999.09

Cyber Security

M580 Features

The M580 PAC offers the following features:

Feature user program execution input/output management communication with the supervision administrative functions remote logging

Description

An M580 PAC runs a user program that processes the inputs and updates the outputs.

An M580 PAC can read local inputs and write local outputs. These inputs/outputs can be digital or analog and allow the M580 PAC to control and command the industrial process.

An M580 PAC can communicate with SCADA to receive commands and transmit process data using the Modbus protocol.

An M580 PAC includes administrative functions, which are provided in Control Expert , for configuration and programming.

An M580 PAC supports the definition of a remote logging policy; it can log security and administrative events.

M580 Configuration

A CSPN-certified M580 configuration includes these components:

Module

BMEP58•0•0

BMENOC0301/0311

Firmware

V2.20 or later

V2.11 or later

Description

This CPU follows the security rules described in the security documents (see assumptions).

This Ethernet module manages the encrypted communications with the upper layer (supervision and engineering software

Control Expert ).

NOTE: Control Expert programming software, PCs, other PAC modules, and backplane components are not included in the scope of the certification.

User Profiles

Users that interact with the PAC for an improved implementation have the following predefined Control Expert Security Editor’s profiles:

EIO0000001999.09

Cyber Security

User Profile

ReadOnly

Operate

Program

Description

No application modification is authorized.

Only application execution and parameter modification are enabled.

All functions are enabled.

Improved Implementation

These items contribute to a healthy environment for an improved implementation:

Item security documentation administrators premises unevaluated services disabled user application verification active logging log checking first configuration firmware upgrade strong passwords

Security Considerations

All recommendations in the documentation (user guides, white papers, etc) are applied prior to the evaluation.

System administrators are competent, trained, and trustworthy.

Access to the PAC location is restricted to trustworthy people. In particular, an attacker does not have access to the physical ports of the PACs. Since identical products can be purchased freely, the attacker can obtain one to research vulnerabilities by any possible means.

Any services that are not covered by the security target are disabled in the configuration or by a user program (as described in the security documentation).

The integrity of the Control Expert application is controlled by the administrator before it is loaded in the PAC.

The logging function is operational and the logs are not corrupt.

System administrators regularly check the local and remote logs.

The initial configuration is uploaded to the PAC through the USB interface, and the PAC is unplugged from the network.

The firmware upgrade is performed through the USB interface, and the PAC is unplugged from the network.

System administrators employ strong passwords that combine uppercase letters, lowercase letters, numbers, and special characters.

Operating Modes

The following operating modes are compliant with CSPN requirements:

38 EIO0000001999.09

Cyber Security

• During commissioning phase, initial configuration of the PAC can be done with either a

Control Expert engineering station connected in point-to-point to the Ethernet port or to the local USB port of the PAC.

• In normal operating conditions (running mode, SCADA connected on the Ethernet control network), confirm that Control Expert is disconnected.

• Perform any further modification of the configuration or application program with Control

Expert connected to the USB port of the PAC.

Cyber Security Parameters

This table describes the cyber security parameters:

Parameter

ACL activated.

IPsec activated on BMENOC0301/0311 with maximum security.

Enforce security selected (FTP, TFTP, HTTP,

DHCP/BOOTP, SNMP, EIP, NTP protocols deactivated).

Log activated.

Topic

Configuring Security Services

RUN/STOP by input only activated.

Memory protection activated.

Helping secure a project:

• Application locked with login and password.

• Section protection activated.

No upload information stored inside CPU.

Default password for FTP service changed.

Application sections are set with no read/write access.

Logging DTM and Module Events to the Syslog Server

Managing Run/Stop Input

Memory Protect

Helping Secure a Project in Control

Expert

PAC Embedded Data

Firmware Protection

Section and Subroutine Protection

User Guide

Modicon M580

BMENOC0301/0311

Ethernet

Communications

Module User Guide

Modicon M580

Hardware Reference

Guide

EcoStruxure ™ Control

Expert, Operating

Modes

Critical Assets

Environment : This table shows the assets that are critical to the environment:

EIO0000001999.09

Cyber Security

Asset control-command of the industrial process engineering workstation flows

Description for Proper Use

The PAC controls and commands an industrial process by reading inputs and sending commands to actuators. The availability of these actions is protected.

The flows between the PAC and the engineering workstation are protected in integrity, confidentiality, and authenticity.

Security requirements for the environmental critical assets:

Confidentiality Asset control-command of the industrial process engineering workstation flows

Availability

Integrity Authenticity

X X

PAC : This table shows the assets that are critical to the PACs:

Asset firmware

PAC memory execution mode user secrets

Description for Proper Use

The firmware is protected both in integrity and authenticity.

The PAC memory contains the PAC configuration and a program that is loaded by the user.

Its integrity and authenticity are protected while it is running.

The integrity and authenticity of the execution mode of the PAC are protected.

All passwords that are used to perform authentication are held in the confidence by the appropriate users.

Security requirements for the PAC critical assets:

Availability Confidentiality Asset firmware

PAC memory execution mode user secrets X

Integrity

Authenticity

Security Threats

Threats considered by attackers controlling a device plugged into the supervision network:

40 EIO0000001999.09

Cyber Security denial of service firmware alteration execution mode alteration memory program alteration flows alteration

Av: availability

I: integrity

C: confidentiality

Au: authenticity

Control-Command of the Industrial

Process

Engineering

Workstation Flows

Firmware PAC

Memory

Execution

Mode

I, Au

Av Au, C, I

Firmware

Alteration

Execution Mode

Alteration

I, Au

, AuI

Memory

Alteration

User

Secrets

Flows

Alteration

C, I

Type of Threat Description denial of service firmware alteration

The attacker manages to generate a denial of service on the PAC by performing an unexpected action or by exploring a vulnerability (sending a malformed request, using a corrupted configuration file...). This denial of service affect the entire PAC or only some of its functions.

The attacker manages to inject and run a corrupted firmware on the PAC. The code injection may be temporary or permanent, and does not include any unexpected or unauthorized code execution. A user may attempt to install that update on the PAC by legitimate means. Finally, the attacker manages to modify the version of the firmware installed on the PAC without having the privilege to do so.

execution mode alteration memory alteration

The attacker manages to modify the execution mode of the PAC without being authorized (a stop command for instance).

The attacker manages to modify, temporarily or permanently, the user program or configuration that run in the PAC memory.

flows alteration The attacker manages to corrupt exchanges between the PAC and an external component without being detected. He can perform attacks such as credential theft, access control violation, or control-command of the industrial process mitigation.

Persistent

Denial of

Service malformed input management X storage of secrets athentication on administrative interface

EIO0000001999.09

Cyber Security

access control policy firmware signature integrity and authenticity of

PAC memory integrity of the PAC execution mode more secure communication

Persistent

Denial of

Service

Firmware

Alteration

Execution Mode

Alteration

Memory

Alteration

Flows

Alteration

Type of Threat malformed input management strength of secrets authentication on administrative interface access control policy firmware signature integrity and authenticity of

PAC memory

Description

The PAC has been developed to correctly handle malformed input, particularly malformed network traffic.

• the PSK used to mount the IPsec tunnel

• the application password used to read the .STU Control Expert file and connect the file to the PAC

• other services passwords (like FTP)

Session tokens are protected against hijack and replay; they have a short lifespan. The identity and permissions of the user account are systematically checked before any privileged action.An application password is set in each configuration, which helps prevent any modification of the PAC from a nonauthentic user.

The access control policy helps guarantee the authenticity of privileged operations, i.e., operations that can alter identified critical assets.The access control list (ACL) is activated in each configuration, and only identified IP addresses can connect to the PAC.

At each firmware update, integrity and authenticity of the new firmware are checked before updating.

The memory protection feature is activated in each configuration, which helps prevent the modification of the running program without an action in specific inputs or outputs. If no input/output module is installed, the programming interface is blocked.The PAC helps ensure the integrity and authenticity of the user program, so that only authorized users can modify the program.

The memory protection also helps ensure the configuration protection, which includes several security parameters:

• Access control policy.

• RUN/STOP by input only activated.

• Memory protection activated.

• Enabled/disabled services (FTP, TFTP, HTTP, DHCP, SNMP, EIP, NTP).

• IPsec parameters.

42 EIO0000001999.09

Cyber Security

Type of Threat integrity of the PAC execution mode encrypted communication

Description

• Syslog parameters.

The PAC helps ensure that the execution mode can only be modified by authorized users that are authenticated.The RUN/STOP by input only feature is activated, which helps prevent the possibility of changing the RUN/STOP status through the Ethernet interface.

The PAC supports encrypted communication, protected in integrity, confidentiality, and authenticity (IPsec encrypted with ESP).The FTP protocol is disabled, and

IPsec helps secure Modbus communication through the BMENOC0301/0311 module.

Set Up Cyber Security Audit (Event Logging)

Logging events and logging analysis are essential. The analysis traces user actions for maintenance and abnormal events that can indicate a potential attack.

The complete system needs to have a robust logging system distributed in all devices. The events related to cyber security are logged locally and sent to a remote server using Syslog protocol.

In the system architecture, event logging involves two parties:

• A log server that receives all the cyber security events of the system through Syslog protocol.

• Log clients (Ethernet connection points where cyber security events are monitored: device, Control Expert).

Event Log Service Description

Each log client role is to:

• Detect and time-stamp events.

A single NTP reference needs to be configured in the system to time-stamp the cyber security events.

EIO0000001999.09

Cyber Security

• Send the detected events to the event logging server.

The events are exchanged between the client and the server using Syslog protocol

(RFC 5424 specification).

The Syslog messages respect the format described in RFC 5424 specification.

Syslog exchanges are done with TCP protocol.

On devices, events are not lost in case of transient network breakdown. Events are lost in case of device reset (except for M580 CPU firmware ≥ 4.0).

Facility Values for Event Types

Syslog message facility values as per RFC 5424 specification associated with event types:

16...23

Facility value

Description

Kernel messages.

User-level messages.

Mail system.

System daemons.

Security / authorization messages.

Messages generated internally by Syslog.

Line printer subsystem.

Network news subsystems.

UUCP subsystem

Clock daemon.

Security / authorization messages.

FTP daemon.

NTP subsystem.

Log audit.

Log alert.

Clock daemon.

Local use 0...7.

44 EIO0000001999.09

Cyber Security

Severity Values for Event Types

Syslog message severity values as per RFC 5424 specification associated with event types:

Severity Value

Keyword

Emergency

Alert

Critical

Error

Warning

Notice

Informational

Debug

Description

System is unusable.

Action must be taken immediately.

Critical conditions.

Error conditions.

Warning conditions.

Normal but significant condition.

Informal messages.

Debug-level messages.

EIO0000001999.09

Cyber Security

Architecture Example

The following figure highlights the position of logging server in a system architecture:

Syslog messages.

Logged Event Message Structure for M580 CPU

(Firmware Versions 4.0 and later), BMECRA31310, and

BMENOR2200H (Firmware Versions 3.01 and later)

Fields

PRI

VERSION

Description

Facility and severity information: "FACILITY" = 10 for cybersecurity events

Version of the Syslog protocol specification (Version = 1 for RFC 5424.).

EIO0000001999.09

Cyber Security

Fields

TIMESTAMP

HOSTNAME

APP-NAME

Description

Time stamp format is issued from RFC 3339 that recommends the following ISO8601

Internet date and time format: YYY MM DD T hh : mm : ss .

nnn Z

NOTE: , T , : , .

, Z are mandatory characters and they are part or the time stamp field.

T and Z need to be written in uppercase.

Z specifies that the time is UTC.

Time field content description:

• YYY: Year

• MM: Month

• DD: Day

• hh: Hour

• mm: Minute

• ss: Second

• nnn: Fraction of second in millisecond (0 if not available)

Identifies the machine that originally sent the Syslog message: fully qualified domain name

(FQDN) or source static IP address if FQDN is not supported.

Source @IP address = @IP address A OR @IP address B in case of HSBY CPU

Identifies the application that initiates the Syslog message. It contains information that identifies the entity sending the message (for example, subset of commercial reference).

PROCID Process or protocol name that originated the message (e.g., Modbus, HTTPS, LocalHMI,

….)

An identifier of the type of the event. (eg: CONNECTION_FAILURE_AND_BLOCK).

MSGID

Event information <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac: macro-id="30296255-e8b7-4cf1-982e-2c45b17b1f06"><ac:plain-text-body><![CDATA[ [ authn@3833 ] , [ authz@3833 ] , [ config@3833 ] , [ cred@3833 ], [ backup@3833 ], [ plc@3833 ] [ system@3833 ]

See STRUCTURED-DATA description below.

MSG

Message containing the event-specific result (see Event Logging Message Descriptions)

EIO0000001999.09

Cyber Security

• STRUCTURED-DATA : mandatory event information.

◦ [ meta ] : mandatory structured-data to provide meta-information about the message.

Where parameter is:

– sequenceId : the event identifier (rollover to 1 when maximum value 2147483647 is reached).

– sysUpTime : this value should be included when component is incapable of obtaining system time (integer containing the time in 1/100th of the second since the system was last re-initialized).

◦ STRUCTURED-DATA : event information depending on event category.

– [ authn@3833 ] : structured-data used for authentication events. Where parameters are:

◊ itf : the interface where the user is connected to, either a network port or a local interface (hmi, usb , …).

◊ peer : the FQDN or IP address of the component from which the user is connected, plus it’s port (ipAddress:port), optional in case of local interface

◊ user : the user name (component or human), optional if user name unknown.

– [ authz@3833 ] : structured-data used for authorization events. Where parameters are:

◊ user : the user name (component or human)

◊ object : the object access by the user, object is product dependant.

◊ action : the action performed on the object: Create, Read, Update, Delete

(CRUD)

– [ config@3833 ] : structured-data used for configuration events. Where parameters are:

◊ object : the name of the security object to configure (Firmware, RBAC,

Security Policy, Device Setting, Trust Anchor, product dependant objects)

◊ value : optional version or value of the new object

– [ cred@3833 ] : structured-data used for credential management events. Where parameters are:

◊ name : the common name of the certificate or the user login name

– [ system@3833 ] structured-data for system events. Where parameters are:

◊ object : the name of the system object that change (PLC, module, Rotary

Switch, SD Card, product dependant object)

– [ backup@3833 ] : structured data used for backup. Where parameters are:

◊ object : the part of the component that has been backup/restore, object is product dependant.

– Structured data can also be defined by each application for specific events.

48 EIO0000001999.09

Cyber Security

Logged Event Message Structure for M580 CPU

(Firmware earlier than Version 4.0), BMENUA0100

(Firmware Versions 1.10 & 2.0), and BMENOR2200H

(Firmware earlier than Version 3.01)

Syslog message structure for M580 CPU firmware and the BMENUA0100:

Field

PRI

VERSION

TIMESTAMP

HOSTNAME

APP-NAME

PROCID

MSGID

MESSAGE

TEXT

Description

Facility and severity information (description provided in following tables).

Version of the Syslog protocol specification (Version = 1 for RFC 5424.).

Time stamp format is issued from RFC 3339 that recommends the following ISO8601 Internet date and time format: YYY MM DD T hh : mm : ss .

nnn Z

NOTE: , T , : , .

, Z are mandatory characters and they are part or the time stamp field.

T and Z need to be written in uppercase.

Z specifies that the time is UTC.

Time field content description:

• YYY: Year

• MM: Month

• DD: Day

• hh: Hour

• mm: Minute

• ss: Second

• nnn: Fraction of second in millisecond (0 if not available)

Identifies the machine that originally sent the Syslog message: fully qualified domain name

(FQDN) or source static IP address if FQDN is not supported.

Identifies the application that initiates the Syslog message. It contains information that identifies the entity sending the message (for example, subset of commercial reference).

Process or protocol name that originated the message (e.g., Modbus, HTTPS, LocalHMI, ….)

Receives NILVALUE if not used.

Identifies the type of message on which the event is related to, for example HTTP, FTP,

Modbus.

Not used (NILVALUE).

This field contains several information:

• Issuer address: IP address of the entity that generates the log.

• Peer ID: Peer ID if a peer is involved in the operation (for example, user name for a logging operation). Receives null if not used.

• Peer address: Peer IP address if a peer is involved in the operation. Not used (null).

• Type: Unique number to identify a message (description provided in following tables).

• Comment: String that describes the message (description provided in following tables).

EIO0000001999.09

Cyber Security

Setting Up a Syslog Server in the System Architecture

A wide variety of Syslog servers are available for various operating systems.

NOTE: Syslog servers need to be compliant with RFC 5424.

Examples of Syslog server providers:

• WinSyslog: For Windows operating system.

Link: www.winsyslog.com/en/ .

• Kiwi Syslog: For Windows operating system.

Link: www.kiwisyslog.com/products/kiwi-syslog-server/product-overview.aspx

• Splunk: For Windows and Unix operating systems.

Link: www.splunk.com/ .

• Rsyslog: For Unix operating system.

Link: www.rsyslog.com/ .

• Syslog-ng: Open source for Unix operating system.

Link: www.balabit.com/network-security/syslog-ng/opensource-logging-system .

• Syslog Server: Open source for Windows operating system.

Link: sourceforge.net/projects/syslog-server/ .

Setting Up Syslog Clients in the System Architecture

Event logging is managed in Control Expert for all devices, DTMs, and Control Expert.

The event logging function, server address, and port number are configured in Control

Expert as follows, and these parameters are sent to each client in the system after the Build action:

Step

Action

Click Tools > Project Settings .

Click Project Settings > General > PLC diagnostics .

Select Event Logging check box (deselected by default).

NOTE: A project with this setting checked can only be opened in Unity Pro (Control

Expert) 10.0 or later.

Enter a valid SYSLOG server address and SYSLOG server port number .

Perform a Build after configuring this setting (you are not required to select Analyze

Project ).

50 EIO0000001999.09

Cyber Security

Diagnose Event Logging

The following table displays the type of event logging diagnostic available for various devices:

Devices

Control Expert

BMENOC0301/11 device DDT

( SERVICE_STATUS2 parameter)

Modicon M580 CPU device DDT

BMECXM Device DDT

Diagnostic information

If a communication error with the Syslog server occurs, the detected error is recorded in the event viewer. To enable the event viewer in Control Expert, select

Audit check box in the Policies tab of the Security Editor (see EcoStruxure ™

Control Expert, Security Editor, Operation Guide).

Two diagnostic information is available:

• EVENT_LOG_STATUS: Value = 1 if event log service is operational or disabled.

Value = 0 if event log service is not operational.

• LOG_SERVER_NOT_REACHABLE: Value = 1 if the Syslog client does not receive the acknowledge of the TCP messages from the Syslog server.

Value = 0 if the acknowledge is received.

Event Log Message Descriptions for Control

Expert

Application action

Creation of a new Control Expert Application

Opening of an existing Control Expert Application

Saving of the currently opened application

Saving of the currently opened application using a different file

Importing of an application

Application build in offline mode

Application build in on-line mode PAC in Stop

Application build in Offline mode PAC in RUN

Start / stop / initialize the PAC

6 create a new project

6 open an existing project

6 save a project

6 save as a project

6 import a project

6 build offline

6 build on-line stop

6 build on-line run

6 start stop or initialize the PAC

EIO0000001999.09

Cyber Security

Update initial values with current values

Upload of the application from the PAC

Download of the application to the PAC transfer data values from file to PAC restore project backup in PAC to project backup in PAC

Change PAC address connection

Control Expert options modifications

Variable value modification inside the PAC

Variable forcing value modification inside the PAC: internal bits

Variable forcing value modification inside the PAC: outputs

Variable forcing value modification inside the PAC: inputs

Task management

Task cycle time modification

Suppress message in diag viewer

Debug executable

Replace project variable

Create libraries or families inside the library

Delete libraries or families inside the library

Copy element (DFB/DDT) from the application into the library

Delete element (DFB/DDT) into the library

Copy element (DFB/DDT/EF/EFB) from the library into the application

Modify documentation (application printing)

Modify functional view

6 Update init values with current values

6 transfer project from PAC

6 transfer project to PAC

6 transfer data values from file to

PAC

6 restore project backup in PAC

6 save to project backup in PAC

6 Set address

6 Modify options

6 Modify variable values

6 Force internal bits

10 6 Force outputs

10 6 Force inputs

6 Task management

6 Task cycle time modification

6 Suppress message in diag viewer

6 Debug executable

6 Replace project variable

6 Create libraries or families

6 Delete libraries or families

6 Put object into library

6 Delete object from library

6 Get object from library

6 Modify documentation

6 Modify functional view

EIO0000001999.09

Cyber Security

Modify animation tables

Modify constant values

Modify program structure

Modify program sections

Modify Project settings

Variable created / removed into Data editor

Variable attribute modified

DDT Created / Removed into Data Editor

DDT Modified into Data Editor

DFB Created / Removed into Data Editor

DFB structure modified into Data Editor

DFB sections modified

DFB instance Modification into data editor

DFB instance Minor Attributes modification into Data

Editor

PAC Configuration modification

PAC I/O Sniffing

PAC I/O Configuration modification

PAC I/O Configuration adjust

PAC I/O Configuration Save Param from I/O Screen

Operator Screens modification

Modify messages

Operator Screens : Family / Screen added / removed

Move FFB block

Move Contact/Coil

6 Modify animation tables

6 Modify constant values

6 Modify program structure

6 Modify program sections

6 Modify Project settings

6 Variable Add Remove

6 Variable Main Attributes modification

6 Variable Minor Attributes modification

6 DDT Add Remove

6 DDT modification

6 DFB type Add Remove

6 DFB type structure modification

6 DFB type sections modification

6 DFB instance Modification

6 DFB instance Minor Attributes modification

6 Modify configuration

6 IO sniffing

6 Modify the IO configuration

6 Adjust the IO

6 Save param

6 Restore param

6 Modify screens

6 Modify messages

6 Add/Remove screens or families

6 Move component

EIO0000001999.09

Cyber Security

DTM action

Insert FFB Block

Insert Contact/Coil

Delete FFB Block

Delete Contact/Coil

Set Effective parameter on FFB Block

Set Effective parameter on Contact/Coil

Remove Effective parameter on FFB Block

Remove Effective parameter on Contact/Coil

Change Effective parameter on FFB Block

Change Effective parameter on Contact/Coil

Make a link between two pins

Change size of extensible FFB block

Change size of vertical/horizontal link

Rename effective parameter

Delete one single row

Delete multiple rows

Delete one single column

Delete multiple columns

Insert one single row

Insert multiple rows

Insert one single column

Insert multiple columns

DTM Download parameter finished in error

DTM Download parameter finished without error

DTM Upload parameter finished in error

DTM Upload parameter finished without error

6 Insert component

6 Delete component

6 Add variable

6 Delete variable

6 Modify variable

6 Link pin

6 Scale component

6 Rename variable

6 Delete row

6 Delete rows from

6 Delete column

6 Delete columns from

6 Insert row

6 Insert rows from

6 Insert column

6 Insert columns from

6 Download parameters to device service finished in error

6 Download parameters to device service finished without error

6 Upload parameters from device service finished in error

6 Upload parameters from device service finished without error

EIO0000001999.09

Cyber Security

Password action

Connection to the DTM is not established

Connection to the DTM succeeded

Connection to the DTM is not closed

Connection to the DTM closed successfully

DTM FDR download parameters service is not performed

DTM FDR download parameters service succeeded

DTM FDR upload parameters service is not performed

DTM FDR upload parameters service succeeded

Download parameters to device service is not performed

Download parameters to device service succeeded

Upload parameters from device service is not performed

Upload parameters from device service succeeded

Audit Trail Function Event

Audit Trail Device Status Event

No device status message

Status information

Access right : Read / Write

Enumerator entry

Problem at application PSW changing

Problem at application PSW verification

Problem at section PSW verification

PSW "DataStorage" changed

6 Go on-line service failed

6 Go on-line service succeeded

6 Go offline service failed

6 Go offline service succeeded

6 FDR download parameters service failed

6 FDR download parameters service succeeded

6 FDR upload parameters service failed

6 FDR upload parameters service succeeded

6 Download parameters to device service failed

6 Download parameters to device service succeeded

6 Upload parameters from device service failed

6 Upload parameters from device service succeeded

6 Audit Trail Function Event

6 Audit Trail Device Status Event

6 No device status message

6 Status information

6 Access right : Read / Write

6 Enumerator entry

6 CyberSecurity - Modifying

Password > Incorrect Password

6 CyberSecurity - Verifying

Password > Incorrect Password

6 CyberSecurity - Verifying Section

Password > Incorrect Password

6 CyberSecurity - Data Storage

Password Modified

EIO0000001999.09

Cyber Security

PSW "FW Download" changed

Problem at application PSW verification

6 CyberSecurity - Firmware

Password Modified

6 CyberSecurity - Verifying

Password > Incorrect Password

SYSLOG address changed SYSLOG configuration changed

File action

CyberSecurity - Event Logging project setting has changed - Event Logging, SYSLOG server address, port or protocol

File XXXXX open

0 6 XXXXX file has been opened

PAC disconnected = @XXXXXX driver = YYYYYY 0 6 Disconnection from PAC

@=XXXXXX dirver= YYYYY

6 Close application XXXXXX Application XXXXXX close 0

Transfer from PAC to PC 0 6 project has been transfered from

PAC to PC

1. MSG content includes the concatenation of the Username, the PID of Control Expert, plus the message.

NOTE: The fields HOSTNAME, APP-NAME, PROCID, MSGID, and STRUCTURED-

DATA do not apply to Control Expert messages.

Event Log Message Descriptions M580 CPUs

(firmware V4.0 and later), BMECRA31310, and

BMENOR2200H (firmware V3.01 and later)

This topic presents event log message descriptions for:

• M580 CPUs with firmware version 4.0 and later (abbreviated “CPU” in column

Devices ), and

• BMECRA31310 adapters (abbreviated “CRA” in column Devices )

• BMENOR2200H RTU modules with firmware version 3.01 and later (abbreviated

“eNOR” in column Devices )

56 EIO0000001999.09

Cyber Security

Successful connection

All successful connection from a user

(human or a component) to a component whether through an encrypted protocol or through an unencrypted protocol if allowed by the customer security policy

Successful login (Web

Server via

HTTPS)

Successful login

(Firmware upgrade via

HTTPS)

Successful login (OPC-

UA)

6 "HTTP-

6 "OPC-

UA"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_

SUCCESS"

EIO0000001999.09

Successful login (Unity

Application password via

Modbus-

Umas)

Mode standard only

Successful

Modbus

TCP connection

(no user)

6 "MOD-

BUS-

UMAS"

6 "MOD-

BUS"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_

SUCCESS"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN:

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"Logon" CPU, eNOR

"Logon" CPU

CRA, eNOR

"Socket connection"

CPU

"Logon" CPU

"Socket connection"

CPU

CRA, eNOR

Cyber Security

Connection

Problem

All unsuccesful connections from a user

Successful

HTTP/

DPWS connection

Successful

EIP Explicit

TCP connection

(no user)

Successful

DNP3 connection

(no user)

Successful

IEC 60870 connection

(no user)

(Unity

Application password

"HTTP"

"EIP"

"DNP3"

"IE-

C60870-

"MOD-

BUS-

UMAS"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_

SUCCESS"

"CONNEC-

TION_FAILURE" peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num]

[authn@3833 itf=localPort | localInterface peer= peerFQDN: peerPort user= username]"

"[meta sequenceId= num]

[authn@3833 itf=localPort | localInterface peer= peerFQDN: peerPort user= username]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort |

"Socket connection"

CPU

"Socket connection"

CPU

CRA

"Socket connection" eNOR

"Invalid password"

CPU

58 EIO0000001999.09

Cyber Security

Human user

(human or a component) to a component whether through an encrypted protocol or through an unencrypted protocol if allowed by the customer security policy via

Modbus-

Umas)

Modbus

TCP connection problem (no user)

EIP Explicit

TCP connection problem (no user)

The security

DNP3 connection problem (no user)

IEC60870 connection problem (no user)

"MOD-

BUS"

"EIP"

"DNP3"

5 "IE-

C60870-

"HTTP-

"CONNEC-

TION_FAILURE"

"CONNEC-

TION_FAILURE"

"CONNEC-

TION_FAILURE"

"CONNEC-

TION_FAILURE"

"CONNEC-

TION_ localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num]

[authn@3833 itf=localPort | localInterface peer= peerFQDN: peerPort user= username]"

"[meta sequenceId= num]

[authn@3833 itf=localPort | localInterface peer= peerFQDN: peerPort user= username]"

"[meta sequenceId=

"Max connections reached"

"Filtered data flow"

CPU

CRA, eNOR

"Max connections reached"

"Filtered data flow"

CPU

CRA

"Max connections reached" eNOR

"Invalid CPU, eNOR

EIO0000001999.09

Cyber Security

account locking due to too many problems during the authentication attempts

Denied login

(account is blocked) policy may request to block a human user account after a configurable number of attempts.

This event informs administrator about potential attack & that the human user account must be unlocked.

(Web

Server via

HTTPS).

Human user account locking due to too many problems during the authentication attempts

(firmware upgrade via

HTTPS).

Human user account locking due to too many unsuccessful authentication attempts

(OPC-UA).

Human user account locking due to too many problems during the authentication attempts

A human user tries to connect on an account already blocked.

(Web

Server via

HTTPS).

Denied login

1 "HTTP-

1 "OPC-

UA"

1 "HTTP-

FAILURE_AND_

BLOCK" num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"CONNEC-

TION_

FAILURE_AND_

BLOCK"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"CONNEC-

TION_

FAILURE_AND_

BLOCK"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"CONNEC-

TION_

FAILURE_ON_

BLOCKED"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: certificate"

"Invalid password"

"Invalid certificate"

"Invalid password"

CPU

CRA, eNOR

"Invalid certificate""

Invalid password"

—

"" CPU, eNOR

60 EIO0000001999.09

Cyber Security

Disconnection

A human or a component disconnect manually of after a timeout due to inactivity.

(account is blocked)

(firmware upgrade via

HTTPS).

Denied login

(account is blocked)

1 "HTTP-

(OPC-UA).

Denied login

(account is blocked)

HTTPS disconnection (Web

Server)

HTTPS disconnection

(Firmware

Upgrade)

OPC-UA disconnection

"OPC-

UA"

"HTTP-

6 "HTTP-

"OPC-

UA"

"CONNEC-

TION_

FAILURE_ON_

BLOCKED"

"CONNEC-

TION_

FAILURE_ON_

BLOCKED"

"DISCONNEC-

TION"

"DISCONNEC-

TION"

"DISCONNEC-

TION" peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort |

"Manual logout"

"Socket disconnection"

CPU

CRA

—

CPU, eNOR

CPU

CRA, eNOR

CPU

EIO0000001999.09

Cyber Security

Modbus disconnection

6 "MOD-

BUS"

"DISCONNEC-

TION"

EIP Explicit disconnection

6 "EIP" "DISCONNEC-

TION"

HTTP disconnection

(DPWS)

6 "HTTP" "DISCONNEC-

TION"

HTTPS

Disconnection triggered by a timeout

6 "HTTP-

"DISCONNEC-

TION" localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"Socket disconnection"

CPU

CRA

"Socket disconnection"

"Timeout logout"

CPU

CRA

CPU

CRA, eNOR

EIO0000001999.09

Cyber Security

Major parameter change at

Run Time

Backup operation

OPC-UA

Disconnection triggered by a timeout

DNP3 disconnection

IEC 60870 disconnection

Export of

Cybersecurity

"OPC-

UA"

"DNP3"

6 "IE-

C60870-

"Backup"

"DISCONNEC-

TION"

"DISCONNEC-

TION"

"DISCONNEC-

TION"

Major

Parameters run time change that can cause significant impact on the system

PLC application parameters change: cycle time

Backup of part or total of component

Download of

Application from the

PLC

6 "Configuration"

6 "Backup"

"PARAMETER_

SET"

"BACKUP"

"[meta sequenceId= num ]

[authn@3833 itf= localPort | localInterfacepeer= peerFQDN: peerPort user= username ]"

"[meta sequenceId= num]

[authn@3833 itf=localPort | localInterface peer= peerFQDN: peerPort user= username]"

"[meta sequenceId= num]

[authn@3833 itf=localPort | localInterface peer= peerFQDN: peerPort user= username]"

"[meta sequenceId= num ]

[config@3833 object="PLC application" value= value ]"

"[meta sequenceId= num ]

[backup@3833 object="PLC application"]"

"[meta sequenceId= num ]

"Timeout logout"

—

"Socket disconnection" eNOR

"Scan time"

CPU

CPU eNOR

EIO0000001999.09

Cyber Security

Restore operation

Firmware update

Restore of part or total of component

A new firmware has been successfully verified and installed.

Configuration from

BME NUA or BME

NOR web pages

Upload of a configuration inside a

Module

Upload of

PLC

Application/

Configuration inside the PLC

Restore of

PLC

Application inside the

PLC

Import of

Cybersecurity

Configuration from

BME NUA or BME

NOR web pages

Upload of a new firmware in the device

PLC,

Copro, Web pages

6 "Backup"

"Configuration"

"Backup"

"Configuration"

[backup@3833 object=

"Cybersecurity configuration"]"

"CONFIGURA-

TION_CHANGE"

"[meta sequenceId= num ]

[config@3833 object="Module"

"CONFIGURA-

TION_CHANGE"

"[meta sequenceId= num ]

[config@3833 object= Object

Object = "PLC application" or

"PLC configuration"

"RESTORE"

"FIRMWARE_

UPDATE"

"[meta sequenceId= num ]

[backup@3833 object="PLC application"]"

"[meta sequenceId= num ]

[backup@3833 object=

"Cybersecurity configuration"]"

"[meta sequenceId= num ]

[config@3833 object= Object value= version ]"Object

= "Firmware",

"Safety copro",

"Web pages"

CRA

CPU

CPU eNOR

CPU

CRA, eNOR

64 EIO0000001999.09

Cyber Security

Invalid firmware update

Modification of the time of the device

Time signal out of tolerance

Hardware change

A new firmware was not installed due to an error.

A human user request to change time and date.

The component shall validate time synchronization messages received through time synchronization channels and alarm if the time synchronization message is not within the tolerances of the component internal/ local clock

(time in the past, far away, …)

Change detected in network topology

—

A new firmware was not installed because of an incompatible version or invalid signature

— network physical port change:

6 "System"

"Configuration"

"FIRMWARE_

INVALID"

"TIME_

CHANGE"

1 "Configuration"

"TIME_

UNEXPECTED"

"[meta sequenceId= num ]

[config@3833 object= Object value= version ]"Object

= "Firmware",

"Safety copro",

"Web pages"

"[meta sequenceId= num ]

[config@3833 object= "Time" value= datetime ]"

"Incompatible version"

"Invalid signature"

"[meta sequenceId= num ]

[config@3833 object="Time" value= datetime ]"

"Time signal out of tolerance"

CPU

CRA, eNOR

CPU

—

"HARDWARE_

CHANGE"

[system@3833 object= Object

Object = "eth"

]

"Port link up"

"Port

CPU

CRA

EIO0000001999.09

Cyber Security

Operating mode change

Invalid configuration

(Outside

Cybersecurity)

Change detected in

Hardware

Program

Operating

Mode change

(Run, Stop,

Init, halt)

Mode

Maintenance /

SafeRun /

Stop SAFE

Task port link up/ down

Any topology change detected from RSTP

/ HSR /

PRP

M580 SD card insertion/ extraction

—

"System"

"HARDWARE_

CHANGE"

"HARDWARE_

CHANGE"

"OPERATING_

MODE_

CHANGE"

A new (not cybersecurity) configuration was not installed due to an error.

Data integrity error (PLC

Application,

…)

1 "Configuration"

"CONFIGURA-

TION_INVALID" followed by decimal number

[system@3833 object= Object ]

Object = "eth" followed by decimal number

[system@3833 object=

"SDCard" ]

[system@3833 object=Object ]

Object = "PLC" or "PLC safe task" or

"Module"

"[meta sequenceId= num ]

[config@3833 object= Object value= version ]" Object =

"PLC application" or

"Module configuration"

"Insertion"

"Extraction"

"Init"

"Run"

"Stop"

"Halt"

"Maintenance mode"

"Safe mode"

"Hsby primary"

"Hsby secondary"

"Hsby wait"

"Master"

"Non master"

"Invalid format"

"Incompatible version" link down"

Port enable

Port disable

Port learning

Port forward

Port blocking

CPU

CRA

CPU

CRA

—

66 EIO0000001999.09

Cyber Security

Reboot Hardware reset or automatic reset after firmware upload

—

Product certificate

(and/or keys) modification

Certificate

Management:

SL1Product

Self-Signed certificate creation

—

1 "System"

6 "Credential"

"REBOOT"

"CERTIFICATE_

CHANGE"

—

"[meta sequenceId= num ]

[cred@3833 name=

CommonName ]"

"Firmware update"

"Reset button"

"Certificate creation"

CPU

CRA

CRA does not implement

Reboot event after

Reset button.

CPU

CRA

NOTE: In addition to the structure described above, each message will also contain the following two fields and values:

• Facility = 10

• HOSTNAME = Fully Qualified Domain Name (FQDN) or local IP address

• APPNAME = Commercial reference name, for example, BMEP584040

EIO0000001999.09

Cyber Security

Example of Syslog Server Messages

Event Log Message Descriptions for M580 CPUs

(Firmware earlier than Version 4.0), BMENUA0100 and BMENOR2200H (Firmware earlier than Version

3.01)

This topic presents event log message descriptions for:

• M580 CPUs with firmware earlier than version 4.0 (abbreviated “CPU” in column

Devices ), and

• BMENUA0100 OPC UA communication modules (abbreviated “NUA” in column

Devices ), and

• BMENOR2200H remote terminal unit (abbreviated “eNOR” in column Devices )

68 EIO0000001999.09

Cyber Security

Successful connection to or from a tool or a device:

Successful login

Successful

TCP connection

Successful login

(Data Storage via

FTP, FDR Server via

FTP, Firmware upload via FTP)

Successful login

(Web Server via

HTTPS)

Successful login

(firmware upgrade via HTTPS)

Successful login

(OPC-UA)

Successful login

(Unity Application password via

Modbus-Umas)

Successful login

(Web Server via

HTTP)

Successful TCP connection (no user)

Successful connection on DNP3 communication protocol (about

DNP3 master and outstation)

Successful connection on

IEC60870 communication protocol (about

IEC60870 client and server)

6 FTP

HTTPS

OPC-UA

DEVICE_

MANAG-

HTTP remote ip address

"(null)"

Li1:

Successful connection

(MNT_

ENG_

MSG_TYP_

CNCTN_

SUCCESS)

"Successful login"

"(null)" "Successful login"

CPU

NUA

"(null)"

"Successful login"

NUA

CPU

MODBUS

EIP

DNP3 remote ip address

"(null)" remote ip address

"Successful login" OR

"Successful connection"

(if no User

Web pages)

"Successful connection"

CPU

CPU eNOR

IEC60870 remote ip address

"Successful connection" eNOR

EIO0000001999.09

Cyber Security

Connection problem to or from a tool or a device:

*TCP connection problem due to ACL check

(source IP address/

TCP port filtering)

* Login problem

Storage via FTP,

FDR Server via FTP,

Firmware upload via

FTP)

Server via HTTPS)

(firmware upgrade via HTTPS)

(OPC-UA)

Server via HTTP)

4 FTP

HTTPS

OPC-UA

HTTP remote ip address

"(null)"

Li2:

Unsuccessful connection

(wrong credential)

(MNT_

ENG_

MSG_TYP_

CNCTN_

FAILURE)

"Failed login"

CPU

NUA

"(null)" "Failed login" NUA

"(null)" remote ip address

"Failed login" NUA

"Failed login"

OR "Failed connection"

(if no User

"Failed login"

CPU

CPU Login problem (Unity

Application password via

Modbus-Umas)

TCP connection problem (no user)

Connection problem on DNP3 communication protocol (about

DNP3 master and outstation)

Connection problem on IEC60870 communication protocol (about

IEC60870 client and server)

DEVICE_

MANAG-

ER remote ip address

MODBUS

EIP

DNP3 remote ip address remote ip address remote ip address

IEC60870 remote ip address

"Failed connection"

CPU

CPU eNOR eNOR

70 EIO0000001999.09

Cyber Security

Disconnection triggered by local or peer:

* TCP disconnection

* On demand logout

Automatic logout

(inactivity timeOut)

HTTPS

OPC-UA disconnection triggered by either the peer/user/local disconnection triggered by either the peer/user/local disconnection triggered by either the peer/user/local disconnection triggered by either the peer/user/local

—

Disconnection triggered by a timeout

6 FTP

HTTPS

OPC-UA

"(null)"

Li5: disconnection triggered by the peer/ user(MNT_

ENG_

MSG_TYP_

DISCON-

NECTION)

"Disconnection"

—

NUA

"Disconnection"

NUA

MODBUS remote ip address

"Disconnection"

CPU

DNP3

IEC60870

HTTPS

OPC-UA

"(null)" or remote ip address

"(null)"

"Disconnection"

Li6:

Disconnection triggered by a timeout

(MNT_

ENG_

MSG_TYP_

DSCNCT_

TIMEOUT)

"Auto logout"

"Auto logout" eNOR eNOR

NUA

Major

Changes in the system:

Parameters run time change outside

Disconnection triggered by a timeout

Major change of cycle time or watch dog PLC application parameters change

(cycle time, watch dog)

13 5 DEVICE_

MANAG-

"(null)" Li87:

System parameter update

(MNT_

ENG_

MSG_TYP_

"XXXX parameter update" (with

XXXX that identifies the parameter)

XXXX =

"Cycle time"

CPU

EIO0000001999.09

Cyber Security

configuration

Major

Changes in the system:

Application or

Configuration download from the device

* Export

(recording) cybersecurity configuration files from the device

Major

Changes in the system

Download of a configuration file from the device

Upload of

Application/

Configuration or

Configuration only into the device

(including CCOTF)

Import (restore) cybersecurity configuration file into the device

6 MODBUS "(null)"

HTTPS

MODBUS

HTTPS

"(null)"

Major

Changes in the system

Upload of Web pages into the device

13 6 FTP

PARAME-

TER_

UPDATE)

Li8:

Download of a configuration file from the device

(MNT_

ENG_

MSG_TYP_

CONF_DL)

Example:

Cycle time parameter update

"Application download" or

"Configuration download"

"Cybersecurity configuration backup"

CPU

NUA

"(null)"

Li9: Upload of a configuration file into the device

(MNT_

ENG_

MSG_TYP_

CONF_UL)

"Application upload" or"

Configuration upload"

Li10:

Upload of a new firmware in the device

(MNT_

ENG_

MSG_TYP_

FIRM-

WARE_

UPDATE)

"Cybersecurity configuration restore"

"Web pages upload"

CPU

NUA

CPU

72 EIO0000001999.09

Cyber Security

Upload of new safety copro

Major

Changes in the system

Upload of a new firmware in the device

Modification of the time of the device

Communication parameters run time

Successful change outside configuration

Enable/disable of communication services

FTP

HTTPS

6 DEVICE_

MANAG-

"(null)"

4 DEVICE_

MANAG-

"(null)"

"Safety copro firmware upload"

"Firmware upload"

CPU

"Firmware upload"

NUA

LI15:

Modification of the time of the IED

Li18: Any port, either physical

(Serial,

USB) or logical

(telnet,

FTP) activation/ deactivation

(MNT_

ENG_

MSG_TYP_

PORT_

MANAGE-

MENT)

"Time major update"

"Major communication parameter update:

XXXX

YYYY"XXXX

= "EIP" or

"DHCP" or

"FTP" or

"MODBUS" or

"SNMP" or

"HTTP" or

"SECURITY" or "NTP" or

"IPSEC" or

"DEVICE_

MANAGER"

For NUA only:

XXXX =

"Control

Expert Data

Flows to CPU only" or

"Control

Expert Data

Flows to

Device

Network" or

"CPU to CPU

Data Flows"

For NOR only:XXXX =

"DNP3 over

TLS channel

[" channel

NUA

CPU

NUA eNOR

EIO0000001999.09

Cyber Security

network physical port change: port link up/ down

Any network physical port status change.

Can be the simple status of a Ethernet port, or information gathered from RSTP

/ HSR / PRP algorithm for redundant systems

10 4 DEVICE_

MANAG-

"(null)"

Any topology change detected:

Any topology change detected from RSTP

/ HSR / PRP

10 4 RSTP

"(null)"

LI19: Any network physical port status change.

Can be the simple status of a

Ethernet port, or information gathered from RSTP

/ HSR /

PRP algorithm for redundant systems

(MNT_

ENG_

MSG_TYP_

NETWK_

PORT_

CHG) name" ]" or

"IEC60870 over

TLS"YYYY=

"enable" or

"disable"Example:"Major communication parameter update: FTP enable"

"Major network physical port status change:

XXXX link

YYYY" XXXX

= "ETH" following by decimal number for the port or

"FRONT port"

YYYY = "link up" or "link down"

Example:

"Major network physical port status change:

ETH1 link up)

LI20: Any topology change detected from RSTP

/ HSR /

PRP algorithms for redundant systems

(MNT_

ENG_

MSG_TYP_

NTWK_

"Topology change detected" or

"Topology change detected:

XXXX YYYY"

XXXX =

"ETH" following by decimal number for the port or

"FRONT port"

YYYY =

CPU

NUA

CPU

NUA

EIO0000001999.09

Cyber Security

Integrity check error:

* Digital

Signature error,

* Integrity only (hash mac)

Major

Changes in the system:

Reboot

Firmware integrity error

Data integrity error:

CS Conf, cert, whitelist, or RBAC)

Reboot after firmware upload

Major

Changes in the system

PLC Operating Mode change (Run, Stop,

Init, halt)

Maintenance Mode

Safety Operating

Modes change

(SafeRun, Stop Safe task)

6 DEVICE_

MANAG-

DEVICE_

MANAG-

"(null)"

4 DEVICE_

MANAG-

"(null)"

5 DEVICE_

MANAG-

"(null)"

TPLGY_

CHG)

"enable",

"disable",

"learning",

"forward",

"blocking"

"Firmware integrity error"

CPU

NUA

LI84: Data

Integrity

Error MNT_

ENG_

MSG_

DATA_

INTEGRI-

TY_

ERROR

"Data integrity error"

NUA

LI14: MNT_

ENG_

MSG_TYP_

REBOOT_

ORDER

LI85:

Operating mode change

MNT_

ENG_

MSG_

OPERAT-

ING_

MODE_

CHANGE

"Restart"

"XXXX state update:

YYYY" (with

XXXX that identifies the object which state change and YYYY that identifies the new state

) XXXX =

"PLC" or

"PLC safe task" or

"Device"

YYYY =

"INIT" or

"STOP" or

"RUN" or

"HALT" or

"Maintenance mode" or

"Safe mode"

EXAMPLES:

"PLC state update: RUN"

"PLC state update:

Maintenance mode"

CPU

NUA

CPU

EIO0000001999.09

Cyber Security

Major

Changes in the system:

Hardware change operation on SDCard for module that have

Rotary Wheel position change:

Reset, Advanced

6 DEVICE_

MANAG-

DEVICE_

MANAG-

"(null)"

LI26:

Hardware change

MNT_

ENG_

MSG_

HARD-

WARE_

CHANGE

Li11: MNT_

ENG_

MSG_TYP_

RBAC_

UPDATE

"Hardware update:

XXXX" (with

XXXX that describes the update)

XXXX = "SD card insertion" or

"SD card extraction"

"Hardware update:

XXXX" (with

XXXX that describes the update)

XXXX = "back to factory mode" or

"secure mode"

"Update

RBAC"

CPU

NUA

NUA Major change in

Cybersecurity

RBAC

(done through

Cybersecurity configuration web pages).

Major change in

Cybersecurity Policy

(done through

Cybersecurity configuration web pages).

Create user account

Delete user account

Update user account

Network services

Event log

Security policy

Security banner

HTTPS

4 HTTPS

"(null)" Li12:MNT_

ENG_

MSG_TYP_

SECURI-

TY_

UPDATE_

UPDATE

"Major Cyber

Security parameter update: network services"

"Major Cyber

Security parameter update: event log" "Major

Cyber

Security parameter update: security policy" "Major

NUA

EIO0000001999.09

Cyber Security

Major change in

Cybersecurity device specific parameters

(done through

Cybersecurity configuration web pages).

Authorization problem

Enable/Disable & configure IPSEC

Enable/Disable & configure OPC-UA

Enable/Disable & configure DNP3

An action on a resource from a user or machine is not authorized

10 Certificate

Management

Add/remove Client certificate

Certificate

Management:

* Certificate expired server certificate expiration detection on restart

4 HTTPS

HTTPS

3 DEVICE_

MANAG-

"(null)"

Li13: MNT_

ENG_

MSG_TYP_

DSS_

UPDATE

Cyber

Security parameter update: security banner"

"Major Cyber

Security parameter update:

IPSEC"

"Major Cyber

Security parameter update: OPC-

UA"

NUA

Li21: MNT_

ENG_

MSG_TYP_

AUTH_

REQ

Li89:

Certificate

Management

(MNT_

ENG_

MSG_TYP_

CERT_

MGT)

"Failed authorization"

"Add client certificate"

"Remove client certificate"

Li29:

Certificate

Management

(MNT_

ENG_

MSG_TYP_

CERT_

EXPIRE)

"Certificate expired"

—

NUA

Specific for eNOR project:

— Authentication problem

10 4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

Li100:

MNT_

ENG_

MSG_

"channel

[" channel name "] eNOR

EIO0000001999.09

Cyber Security unexpected response

—

No response

—

Aggressive mode not supported

—

MAC algorithm not supported

—

Key wrap algorithm not supported

—

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

TYPE_

AUTHENTI-

CATION_

FAILUE

Li101:

MNT_

ENG_

MSG_

TYPE_

UNEXPEC-

TED_

RE-

SPONSE

Li102:

MNT_

ENG_

MSG_

TYPE_NO_

RE-

SPONSE

Li103:

MNT_

ENG_

MSG_

TYPE_

AGGRES-

SIVE_

MODE_

NOT_

SUPPOR-

TED

Li104:

MNT_

ENG_

MSG_

TYPE_

MAC_

ALGO-

RITHM_

NOT_

SUPPOR-

TED

Li105:

MNT_

ENG_

MSG_

TYPE_

KEY-

WRAP_ authentication failed"

"channel

[" channel name "] unexpected response"

"channel

[" channel name "] no response"

"channel

[" channel name "] aggressive mode not supported"

"channel

[" channel name "] MAC algorithm not supported"

"channel

[" channel name "] key wrap algorithm not supported" eNOR eNOR eNOR eNOR eNOR

EIO0000001999.09

Cyber Security

Authorization problem

—

Update key change method not permitted

—

Invalid signature

—

Invalid certification data

—

Unknown

User

—

EIO0000001999.09

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

ALGO-

RITHM_

NOT_

SUPPOR-

TED

Li86:MNT_

ENG_

MSG_TYP_

AUTHORI-

ZATION_

FAILURE)

"channel

[" channel name "] authorization failed"

Li108:

MNT_

ENG_

MSG_

TYPE_

INVALID_

CERTIFI-

CATION_

DATA

Li109:

MNT_

ENG_

MSG_

TYPE_

UN-

KNOWN_

USER

Li106:

MNT_

ENG_

MSG_

TYPE_

UPDATE_

KEY_

CHANGE_

METHOD_

NOT_

PERMIT-

TED

Li107:

MNT_

ENG_

MSG_

TYPE_

INVALID_

SIGNA-

TURE

"channel

[" channel name "] update key change method not permitted"

"channel

[" channel name "] invalid signature"

"channel

[" channel name "] invalid certification data"

"channel

[" channel name "] unknown user" eNOR eNOR eNOR eNOR eNOR

Cyber Security

Max session key status request exceed

—

Session key change success

—

4 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

6 "DNP3_

Master" or

"DNP3_

Outstation" remote ip address

Li110:MNT_

ENG_

MSG_

TYPE_

MAX_

SESSION_

KEY_

STATUS_

REQ_

EXCEED

Li111:MNT_

ENG_

MSG_

TYPE_

SESSION_

KEY_

CHANGE_

SUCCESS

"channel

[" channel name "] max session key status request exceed"

"channel

[" channel name "] session key change success" eNOR eNOR

NOTE: In addition to the structure described above, each message will also contain the following fields and values following the Severity field::

• HOSTNAME = Local IP address or null.

• APPNAME = Commercial reference name, for example, BMEP584040.

• PROCID is not used.

• MSG:IssuerAdress = Local IP Address.

• MSG:Peer is not used.

Control Identification and Authentication

Managing Accounts

Schneider Electric recommends the following regarding account management:

• Create a standard user account with no administrative privileges.

• Use the standard user account to launch applications. Use more privileged accounts to launch an application only if the application requires higher privilege levels to perform its role in the system.

• Use an administrative level account to install applications.

80 EIO0000001999.09

Cyber Security

Managing User Account Controls (UAC) (Windows 10)

To block unauthorized attempts to make system changes, Windows 10 grants applications the permission levels of a normal user, with no administrative privileges. At this level, applications cannot make changes to the system. UAC prompts the user to grant or deny additional permissions to an application. Set UAC to its maximum level. At the maximum level, UAC prompts the user before allowing an application to make any changes that require administrative permissions.

To access UAC settings in Windows 10, open Control Panel > User Accounts and Family

Safety > User Accounts > Change User Account Control Settings , or enter UAC in the

Windows 10 Start Menu search field.

Managing Passwords

Password management is one of the fundamental tools of device hardening, which is the process of configuring a device against communication-based threats. Schneider Electric recommends the following password management guidelines:

• Enable password authentication on all e-mail and Web servers, CPUs, and Ethernet interface modules.

• Change all default passwords immediately after installation , including those for:

◦ user and application accounts on Windows, SCADA, HMI, and other systems

◦ scripts and source code

◦ network control equipment

◦ devices with user accounts

◦ FTP servers

◦ SNMP and HTTP devices

◦ Control Expert

• Grant passwords only to people who require access. Prohibit password sharing.

• Do not display passwords during password entry.

◦ Require passwords that are difficult to guess. They should contain at least 8 characters and should combine upper and lower case letters, digits, and special characters when permitted.

• Require users and applications to change passwords on a scheduled interval.

• Remove employee access accounts when employment has terminated.

• Require different passwords for different accounts, systems, and applications.

• Maintain a secure master list of administrator account passwords so they can be quickly accessed in the event of an emergency.

EIO0000001999.09

Cyber Security

• Implement password management so that it does not interfere with the ability of an operator to respond to an event such as an emergency shutdown.

• Do not transmit passwords via e-mail or other manner over the insecure Internet.

Managing HTTP

Hypertext transfer protocol (HTTP) is the underlying protocol used by the Web. It is used in control systems to support embedded Web servers in control products. Schneider Electric

Web servers use HTTP communications to display data and send commands via webpages.

If the HTTP server is not required, disable it. Otherwise, use hypertext transfer protocol secure (HTTPS), which is a combination of HTTP and a cryptographic protocol, instead of

HTTP if possible. Only allow traffic to specific devices, by implementing access control mechanisms such as a firewall rule that restricts access from specific devices to specific devices.

You can configure HTTPS as the default Web server on the products that support this feature.

Managing FTP

File transfer protocol (FTP) provides remote file handling services through a TCP/IP-based network, such as Internet. FTP uses a client-server architecture as well as separate control and data connections between the client and the server.

Consider the following behavior of the FTP service provided by Schneider Electric:

• FTP protocol is disabled by default.

FTP protocol is necessary for specific maintenance and configuration activities only. We advise our customers to disable the entire set of FTP services when they are not required.

82 EIO0000001999.09

Communication, page 29 ).

Cyber Security

• FTP protocol is inherently unsecure and therefore must be used with care to avoid sensitive information disclosure and unauthorized access to the controllers:

◦ Change the default passwords of all devices that support FTP, when possible.

◦ Use Access Control List to restrict communication to the authorized IP addresses.

Refer to “Cyber Security Services Per Platform” for details on the concerned module.

◦ When using BMENOC module, configure the IPSEC feature (

Set Up Encrypted

◦ Block all inbound and outbound FTP traffics at the boundary of the enterprise network and operations network of the control room.

◦ Filter FTP commands between the control network and operations network to specific hosts or communicate them over a separate, encrypted management network.

◦ Use external module to setup a VPN between the Modicon PLC impacted modules and the engineering workstation on control network.

• BMENOC0301/11 does not support IP forwarding to the device network (IPsec limitations in the architecture).

If transparency is required between the control and device networks, an external router/

VPN is needed to provide an encrypted communication between the control and device networks (see the illustration in “CSPN Security Target”).

In FTP protocol, transparency is required to perform the following operations from the control network:

• Update of Modicon M580 CPU firmware from the Automation Device Maintenance or

Unity Loader software through FTP service

• Network diagnostics of Modicon M580 CPU executed from a network management tool through SNMP service

Managing SNMP

Simple network management protocol (SNMP) provides network management services between a central management console and network devices such as routers, printers, and

PACs. The protocol consists of three parts:

• Manager: an application that manages SNMP agents on a network by issuing requests, getting responses, and listening for and processing agent-issued traps

• Agent: a network-management software module that resides in a managed device. The agent allows configuration parameters to be changed by managers. Managed devices can be any type of device: routers, access servers, switches, bridges, hubs, PACs, drives.

EIO0000001999.09

Cyber Security

• Network management system (NMS): the terminal through which administrators can conduct administrative tasks

Schneider Electric Ethernet devices have SNMP service capability for network management.

Often SNMP is automatically installed with public as the read string and private as the write string. This type of installation allows an attacker to perform reconnaissance on a system to create a denial of service.

To help reduce the risk of an attack via SNMP:

• If SNMP v1 is required, use access settings to limit the devices (IP addresses) that can access the switch. Assign different read and read/write passwords to devices.

• Change the default passwords of all devices that support SNMP.

• Block all inbound and outbound SNMP traffic at the boundary of the enterprise network and operations network of the control room.

• Filter SNMP v1 commands between the control network and operations network to specific hosts or communicate them over a separate, encrypted management network.

• Control access by identifying which IP address has privilege to query an SNMP device.

• Use an external module to set up a VPN between the Modicon PLC impacted modules and the engineering workstation on the control network.

Managing Control Expert Application, Section, Data

Storage, and Firmware Password

In Control Expert, passwords apply to the following (depending on the CPU):

• Application

Control Expert and CPU application protection by a password helps prevent unwanted application modification, download, or opening (.STU, .STA and .ZEF files). The password is stored encrypted in the application.

In addition to the password protection you can encrypt the .STU, .STA and .ZEF files.

The file encryption feature in Control Expert helps prevent modifications by any malicious person and reinforces protection against theft of intellectual property. The file encryption option is protected by a password mechanism.

More details are provided in the Application Protection topic (see EcoStruxure ™ Control

Expert, Operating Modes).

84 EIO0000001999.09

Cyber Security

• Section

The section protection function is accessible from the Properties screen of the project in offline mode. This function is used to protect the program sections. More details are provided in the Section and Subroutine Protection topic (see EcoStruxure ™ Control

Expert, Operating Modes).

NOTE: The section protection is not active as long as the protection has not been activated in the project.

• Data Storage/Web

Data storage protection by a password helps prevent unwanted access to the data storage zone of the SD memory card (if a valid card is inserted in the CPU). It also helps prevent unwanted access to web diagnostics (for M580 CPU firmware ≥ 4.0). More details are provided in the Data Storage Protection topic. (see EcoStruxure ™ Control

Expert, Operating Modes)

• Firmware

Firmware download protection by a password helps prevent download of malicious firmware inside the CPU. More details are provided in the Firmware Protection topic

(see EcoStruxure ™ Control Expert, Operating Modes).

Control Authorizations

Control Expert Security Editor

A security configuration tool is used to define software users and their respective authorizations. Control Expert access security concerns the terminal on which the software is installed and not the project, which has its own protection system.

For more detailed information, refer to EcoStruxure ™ Control Expert, Security Editor,

Operation Guide .

Recommendation: Set a dedicated password to the super user and limit other users authorizations with a restricting profile.

Programming and Monitoring Mode

Two modes are available to access the CPU in Online mode:

• Programming mode: The CPU program can be modified. When a terminal is first connected to the CPU, the CPU becomes reserved and another terminal cannot be connected as long as the CPU is reserved.

EIO0000001999.09

Cyber Security

• Monitoring mode: The CPU program cannot be modified, but the variables can be modified. The monitoring mode does not reserve the CPU, and an already reserved

CPU can be accessed in monitoring mode.

To choose a mode in Control Expert , select: Tools > Options... > Connection > Default connection mode .

More details on those modes are provided in the Services in Online Mode topic (see

EcoStruxure ™ Control Expert, Operating Modes).

Recommendation: Set the Online CPU access mode to Monitoring whenever possible.

Program Sections Protection

Operating Modes).

NOTE: The section protection is not active as long as the protection has not been activated in the project.

Recommendation: Activate the sections protection.

CPU Memory Protection

The memory protection prohibits the transfer of a project into the CPU and modifications in online mode, regardless of the communication channel.

NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication.

The memory protection is activated as follows:

• Modicon M340 CPU: Input bit. More details in the Configuration of Modicon M340 processors section (see EcoStruxure ™ Control Expert, Operating Modes).

• Modicon M580 CPU: Input bit. More details in the Managing Run/Stop Input section

(see Modicon M580, Hardware, Reference Manual).

• Modicon Quantum CPU: Physical key switch on the CPU module, either for low end

(see Quantum using EcoStruxure ™ Control Expert, Hardware, Reference Manual) or high end (see Quantum using EcoStruxure ™ Control Expert, Hardware, Reference

Manual) CPU.

• Modicon Premium CPU: Input bit. More details in the Configuration of Premium processors section (see EcoStruxure ™ Control Expert, Operating Modes).

• Modicon MC80 CPU: Input bit. More details in Modicon MC80 CPU manual.

86 EIO0000001999.09

Recommendation: Activate the CPU memory protection whenever possible.

Cyber Security

CPU Remote Run/Stop Access

NOTE: The CPU remote run/stop access cannot be configured with Hot Standby CPUs.

In such cases, use IPsec encrypted communication.

The remote run/stop access management defines how a CPU can be started or stopped remotely and depends on the platform:

Modicon M580:

Modicon M340:

Modicon Premium:

Modicon Quantum:

Modicon MC80:

CPU remote access to run/stop allows one of the following:

• Stop or run the CPU remotely by request.

• Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

• Denies to run or stop the CPU remotely by request.

Refer to the Managing Run/Stop Input for CPU configuration options that help prevent remote commands from accessing the Run/Stop modes section (see

Modicon M580, Hardware, Reference Manual).

CPU remote access to run/stop allows one of the following:

• Stop or run the CPU remotely by request.

• Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

Refer to the Configuration of Modicon M340 Processors section (see EcoStruxure ™

Control Expert, Operating Modes).

CPU remote access to run/stop allows one of the following:

• Stop or run the CPU remotely by request.

• Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

Refer to the Configuration of Premium\Atrium Processors section (see

EcoStruxure ™ Control Expert, Operating Modes).

CPU remote access to run/stop allows to:

• Stop or run the CPU remotely via request.

CPU remote access to run/stop allows one of the following:

• Stop or run the CPU remotely by request.

• Stop the CPU remotely by request. Denies running the CPU remotely by request, only a run controlled by the input is available when a valid input is configured.

• Denies to run or stop the CPU remotely by request.

Refer to the Configuration of Modicon MC80 Processors section in MC80 user manual.

EIO0000001999.09

Cyber Security

Recommendation: Deny running or stopping the CPU remotely by request.

CPU Variables Access

Recommendation: To protect CPU data at run time from illegal read or write access, proceed as follows whenever possible:

• Use unlocated data.

• Configure Control Expert to store only HMI variables: Tools > Project Settings... >

PLC embedded data > Data dictionary > Only HMI variables .

Only HMI variables can be selected only if Data dictionary is selected.

• Tag as HMI the variables that are accessed from HMI or SCADA. Variables that are not tagged as HMI cannot be accessed by external clients.

• Connection with SCADA has to rely on OFS.

Data Memory Protection

You can activate data memory protection in Control Expert by navigating to Tools > Project

Setting > PLC embedded data , then select Apply . This feature helps protect both located and unlocated data.

For more information on the data memory protection feature, refer to the topic Data Memory

Protection in the EcoStruxure Control Expert Operating Modes document.

Manage Data Integrity Checks

Introduction

The automatic integrity check feature in Control Expert helps prevent Control Expert files and software from being changed via a virus / malware through the Internet. You can also launch the integrity check manually.

Automatic Integrity Check

Control Expert with Topology Manager is based on client / server architecture.

88 EIO0000001999.09

Cyber Security

For a Control Expert client, the Control Expert server can be local or remote whereas the

SODB server is always local.

By default only a local client (127.0.0.0) can connect to the Control Expert server. Remote

Control Expert clients can connect to a Control Expert server by changing the Listening IP address setting of the Control Expert server. For details, refer to the EcoStruxure Control

Expert Installation Manual and the topic Enabling Communication with Remote Clients and

Reinforcing Security .

The Control Expert and the SODB servers are configured to start automatically when the computer is powered-on or restarted. Before the servers start, an integrity check is performed on both.

Either server starts only if the integrity check completes without detecting corruptions.

If a corruption is detected on the SODB server

If a corruption is detected on the Control Expert server

THEN

You can check if any detected error is logged by using the

Event viewer (source SE.SODB.Host

You can check if any detected error is logged by using the

Event viewer (source SE.Automation.

SystemManager ).

An automatic integrity check is launched when you start Control Expert (with Topology

Manager) or Control Expert Classic. The instance execution is blocked until the integrity check result is returned. If a corruption is detected, a message box indicates the corrupted files. Click OK and the Control Expert instance closes.

Manual Integrity Check with Control Expert Classic

To perform a manual integrity check when an instance of Control Expert Classic is started, follow these steps:

Step

Action

Click Help

About Control Expert XXX .

In the Integrity check field, click Perform self-test .

Result : The integrity check runs in the background. Control Expert creates log of the successful and unsuccessful component login. The log file contains the IP address, the date and hour, and the result of the login.

NOTE: If an integrity check displays an unsuccessful component login, the Event Viewer displays a message. Click OK . Manually fix the items in the log.

EIO0000001999.09

Cyber Security

Manual Integrity Check with Control Expert

To perform a manual integrity check when an instance of Control Expert is started, follow these steps:

Step

Action

Click Help > About ...

in the Topology Manager toolbar.

In the About box, click the link Perform self-test .

Result : The integrity check runs in the background. Scans are performed on the local client, on

SODB server and on the Control Expert server (local or remote) the client is connected to. The client and the servers keep running until the integrity check result is returned.

Refer to the following table for the integrity check result consequences.

If a corruption is detected

If a corruption is detected on the client

If a corruption is detected on the SODB server

If a corruption is detected on the Control

Expertserver (local or remote)

THEN

The message self-test completed successfully is displayed.

Click OK .

A message box indicates the corrupted files. Click OK and

Control Expert client closes.

The SODB server stops. You can check if any detected error is logged by using the Event viewer (source SE.

SODB.Host

The Control Expert client does not close but deploy and system monitoring functionalities are no longer operational.

The Control Expert server stops and the client/server connection ends. You can check if any detected error is logged by using the Event viewer (source SE.

Automation.SystemManager

The Control Expert client does not close and you can connect to another Control Expert server.

M580 Firmware Integrity Check

The M580 PAC firmware integrity check is done automatically after a new firmware upload or restart of the M580 PAC.

Management of SD Card

Activate the application signature in order to avoid running a wrong application from an SD card.

EIO0000001999.09

Cyber Security

The SD card signature is managed using the SIG_WRITE and SIG_CHECK functions (see

EcoStruxure ™ Control Expert, Communication, Block Library ).

EIO0000001999.09

Cyber Security

Control Expert software, page 93

Introduction

This chapter lists the main cyber security services available per platform and indicates where to find detailed information in Control Expert help.

Cyber Security Services

Overview

Software, DTM, or devices are elements providing cyber security services in a global system. The available cyber security services are listed for the following elements:

•

•

Modicon M340 CPU, page 94

•

Modicon M580 CPU, page 94

• Modicon Momentum (Cyber security services are not implemented.)

•

Modicon Quantum CPU and communication modules, page 95

•

Modicon X80 modules, page 96

•

Modicon Premium/Atrium CPU and communication modules, page 97

The cyber security services listed below are described in previous chapter:

•

Disable unused services, page 25

•

Access control, page 26

•

Set Up Encrypted Communication, page 29

•

Event logging, page 43

•

Authentication, page 80

•

Authorizations, page 85

•

Integrity checks, page 88

92 EIO0000001999.09

Cyber Security

Cyber Security Services in Unity Pro/Control Expert

Software

NOTE:

Unity Pro is the former name of Control Expert for version 13.1 or earlier.

Cyber security services availability in Control Expert software:

Software

Reference

Cyber security services

Disable unused services

Access control

Encrypted communication

Encrypted communication with confidentiality

–

Event logging

– Unity Pro v8.1

Unity

Pro≥v10.0

–

N.A.

–

Unity

Pro≥v13.0

– N.A.

X Available, at least one service is implemented.

– Not available

N.A.

Not applicable

–

Authentication

Authorizations

Integrity checks

More secure password recovery mechanism availability in Control Expert software:

Software

Reference

Control Expert v15.0 SP1

Control Expert v15.1

Application v3.2

v3.2 (1) v4.0

–

Firmware

≤v3.2

–

≥v4.01

–

X Available

– Not available

EIO0000001999.09

Cyber Security

Cyber Security Services in Modicon M340 CPU

Minimum firmware version and cyber security services availability in Modicon M340 CPU:

CPU

Reference Min.

firmware

BMX P34 1000

BMX P34 2000

BMX P34 2010

2.60

BMX P34 20102 2.60

– Not available

Cyber security services

Disable unused services

Access control

–

BMX P34 2020

BMX P34 2030

2.60

BMX P34 20302 2.60

X X

X Available, at least one service is implemented.

–

Encrypted communication

–

Event logging

Authentication

Authorizations

–

Integrity checks

Cyber Security Services in Modicon M580 CPU:

Minimum firmware version and cyber security services availability in Modicon M580 CPU:

CPU

Reference

BME P58 1020

BME P58 2020

BME P58 2040

BME P58 3020

BME P58 3040

BME P58 4020

BME P58 4040

BME P58 5040

BME P58 6040

Min.

firmware

1.00

2.10

Cyber security services

Disable unused services

Access control

–

Encrypted communication

–

Event logging

Authentication

Authorizations

Integrity checks

94 EIO0000001999.09

Cyber Security

CPU Cyber security services

Reference

BME H58 2040

BME H58 4040

Min.

firmware

2.10

Disable unused services

Access control

BME H58 6040 2.10

X X

X Available, at least one service is implemented.

– Not available

–

Encrypted communication

–

Event logging

Authentication

Authorizations

Integrity checks

Cyber Security Services in Modicon Quantum CPU and

Modules

Minimum firmware version and cyber security services availability in Modicon Quantum

CPU:

CPU

Reference

140CPU31110

140CPU43412•

140CPU53414•

140CPU651•0

140CPU65260

140CPU65860

140CPU67060

140CPU67160

– Not available

Min.

firmware

3.20

Cyber security services

Disable unused services

Access control

–

140CPU6726• 3.20

X X

140CPU67861 3.20

X X

X Available, at least one service is implemented.

–

Encrypted communication

–

Event logging

Authentication

Authorizations

–

Integrity checks

Modicon Quantum modules supporting cyber security services:

EIO0000001999.09

Cyber Security

Module Cyber security services

Reference Min.

firmware

1.00

Disable unused services

–

Access control

140NOC7710• X

140NOC78000

140NOC78100

2.00

140NOE771••

140NWM10000

–

X Available, at least one service is implemented.

– Not available

–

Encrypted communication

– –

–

Event logging

–

Authentication

Authorizations

Integrity checks

–

Cyber Security Services in Modicon X80 Modules

Modicon X80 modules supporting cyber security services:

Module

Reference

BMECXM0100

BMENOC0301

BMENOC0311

BMXNOC0401.2

BMXNOE0100.2

BMXNOE0110.2

BMXPRA0100

BMENOC0301

BMENOC0311

BMXNOR0200H

2.90

6.00

2.60

2.11

1.01

2.05

Min.

firmware

Cyber security services

Disable unused services

Access control

Encrypted communication

–

Encrypted communication with confidentiality

Event logging

–

Authentication

Authorizations

Integrity checks

–

96 EIO0000001999.09

Cyber Security

Module

Reference Min.

firmware

Cyber security services

Disable unused services

Access control

Encrypted communication

Encrypted communication with confidentiality

BMENOR2200H

X Available, at least one service is implemented.

– Not available

Event logging

Authentication

Authorizations

Integrity checks

Cyber Security Services in Modicon Premium/Atrium

CPU and Modules

Minimum firmware version and cyber security services availability in Modicon Premium/

Atrium CPU:

CPU

Reference

TSXH57•4M

TSXP570244M

TSXP57•04M

TSXP57•54M

TSXP571634M

TSXP572634M

TSXP573634M

(through ETY port)

Min.

firmware

3.10

Cyber security services

–

Disable unused services

–

Access control

–

Encrypted communication

–

Event logging

Authentication

Authorizations

–

Integrity checks

EIO0000001999.09

Cyber Security

CPU

Reference Min.

firmware

3.10

Cyber security services

Disable unused services

Access control

Encrypted communication

– TSXP574634M

TSXP575634M

TSXP576634M

(embedded

Ethernet port)

X Available, at least one service is implemented.

– Not available

Event logging

–

Authentication

Authorizations

Integrity checks

X X –

Modicon Premium/Atrium modules supporting cyber security services:

Module Cyber security services

Reference

TSXETC101.2

TSXETY4103

TSXETY5103

Min.

firmware

2.04

5.70

5.90

Disable unused services

Access control

X Available, at least one service is implemented.

– Not available

–

Encrypted communication

–

Event logging

–

Authentication

Authorizations

–

Integrity checks

Modicon M340 Security Services

Overview

Communication security services settings description is provided for the Modicon M340

CPU in different manuals as described in the following topic.

Modicon M340 CPU with Embedded Ethernet Ports

Description of communication parameters related to cyber security is provided in the listed topics:

98 EIO0000001999.09

Cyber Security

Ethernet communication: Refer to Security section (see Modicon M340 for Ethernet, Communications

Modules and Processors, User Manual).

Access control: Refer to Messaging Configuration Parameters section (see Modicon M340 for

Ethernet, Communications Modules and Processors, User Manual).

Modicon M580 Security Services

Modicon M580 CPU

Description of communication parameters related to cyber security is provided in the topic that describes the Security Tab (see Modicon M580, Hardware, Reference Manual).

Modicon Quantum Security Services

Overview

Communication security services settings description is provided for the Modicon Quantum

CPU and Ethernet modules in different manuals as described in the following topics.

Modicon Quantum CPU with Embedded Ethernet Ports

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security (Enable / Disable HTTP, FTP, and TFTP) section (see Quantum using EcoStruxure ™ Control Expert, Ethernet Network Modules, User Manual).

Access control: Refer to Modicon Quantum with Control Expert Ethernet Controller Messaging

Configuration section (see Quantum using EcoStruxure ™ Control Expert, Ethernet

Network Modules, User Manual).

140 NOC 771 0x Module

Description of communication parameters related to cyber security is provided in the listed topics:

EIO0000001999.09

Cyber Security

Ethernet communication: Refer to Security (Enable / Disable HTTP, FTP, and TFTP) section (see Quantum using EcoStruxure ™ Control Expert, Ethernet Network Modules, User Manual).

Access control: Refer to Configuring Access Control section (see Quantum using EcoStruxure ™

Control Expert, 140 NOC 771 01 Ethernet Communication Module, User Manual).

140 NOC 780 00 Module

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security section (see Quantum EIO, Control Network, Installation and

Configuration Guide).

Access control: Refer to Configuring Access Control section (see Quantum EIO, Control Network,

Installation and Configuration Guide).

140 NOC 781 00 Module

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security section (see Quantum EIO, Control Network, Installation and

Configuration Guide).

Access control: Refer to Configuring Access Control section (see Quantum EIO, Control Network,

Installation and Configuration Guide).

140 NOE 771 xx Module

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security (Enable / Disable HTTP, FTP, and TFTP) section (see Quantum using EcoStruxure ™ Control Expert, Ethernet Network Modules, User Manual),

Security section (see Quantum using EcoStruxure ™ Control Expert, Ethernet

Network Modules, User Manual), and Establishing HTTP and Write Passwords section (see Quantum using EcoStruxure ™ Control Expert, Ethernet Network

Modules, User Manual).

100 EIO0000001999.09

Cyber Security

140 NWM 100 00 Module

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security (Enable / Disable HTTP, FTP, and TFTP) section (see Quantum using EcoStruxure ™ Control Expert, Ethernet Network Modules, User Manual).

Modicon X80 Security Services

Overview

Communication security services settings description is provided for the Modicon X80

Ethernet modules in different manuals as described in the following topics.

BMXNOC0401.2 Module

A description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to the Security section (see Modicon M340 for Ethernet, Communications

Modules and Processors, User Manual).

Access control: Refer to the Configuring Access Control section (see Modicon M340, BMX NOC

0401 Ethernet Communication Module, User Manual).

BMXNOE0100.2 and BMXNOE0110.2 Module

A description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to the Security section (see Modicon M340 for Ethernet, Communications

Modules and Processors, User Manual).

Access control: Refer to the Messaging Configuration Parameters section (see Modicon M340 for

Ethernet, Communications Modules and Processors, User Manual).

EIO0000001999.09

101

Cyber Security

BMXPRA0100 Module

The BMXPRA0100 module is configured as an Modicon M340 CPU. A description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to the Security topic (see Modicon M340 for Ethernet, Communications

Modules and Processors, User Manual).

Access control: Refer to the Messaging Configuration Parameters topic (see Modicon M340 for

Ethernet, Communications Modules and Processors, User Manual).

BMXNOR0200H Module

A description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to the Security topic (see Modicon X80 , BMXNOR0200H RTU Module, User

Manual).

Access control: Refer to the Messaging Configuration Parameters topic.

BMENOR2200H Module

A description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to the Security topic.

Access control: Refer to the Messaging Configuration Parameters topic.

BMECXM0100 Module

A description of communication parameters related to cyber security is provided in the

Ethernet Services Configuration chapter (see Modicon M580, BMECXM CANopen Modules,

User Manual).

102 EIO0000001999.09

Cyber Security

BMENOC0301/11 Module

A description of communication parameters related to cyber security is provided in the

Configuring Security Services topic (see Modicon M580, BMENOC0301/0311 Ethernet

Communications Module, Installation and Configuration Guide).

BMENUA0100 Module

A description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication:

Access control:

Refer to the Cybersecurity Settings topic (see M580, BMENUA0100 OPC UA

Embedded Module, Installation and Configuration Guide).

Refer to the Access Control topic.

Modicon Premium/Atrium Security Services

Overview

Communication security services settings description is provided for the Modicon Premium/

Atrium CPU and Ethernet modules in different manuals as described in the following topics.

Modicon Premium/Atrium CPU with Embedded Ethernet

Ports

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security Service Configuration Parameters section (see Premium and

Atrium Using EcoStruxure ™

Manual).

Control Expert, Ethernet Network Modules, User

Access control: Refer to Configuration of TCP/IP Messaging (TSX P57 6634/5634/4634) section

(see Premium and Atrium Using EcoStruxure ™ Control Expert, Ethernet Network

Modules, User Manual).

EIO0000001999.09

103

Cyber Security

Modicon Premium/Atrium CPU through ETY Ports

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security Service Configuration Parameters section (see Premium and

Atrium Using EcoStruxure ™ Control Expert, Ethernet Network Modules, User

Manual).

Access control: Refer to Configuration of TCP/IP Messaging section (see Premium and Atrium

Using EcoStruxure ™ Control Expert, Ethernet Network Modules, User Manual).

TSX ETC 101.2 Module

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security section (see Premium using EcoStruxure ™ Control Expert, TSX

ETC 101 Ethernet Communication Module, User Manual).

Access control: Refer to Configuring Access Control section (see Premium using EcoStruxure ™

Control Expert, TSX ETC 101 Ethernet Communication Module, User Manual).

TSX ETY x103 Module

Description of communication parameters related to cyber security is provided in the listed topics:

Ethernet communication: Refer to Security Service Configuration Parameters section (see Premium and

Atrium Using EcoStruxure ™ Control Expert, Ethernet Network Modules, User

Manual).

Access control: Refer to Configuration of TCP/IP Messaging section (see Premium and Atrium

Using EcoStruxure ™ Control Expert, Ethernet Network Modules, User Manual).

104 EIO0000001999.09

Cyber Security

How to protect M580 and M340 architectures with EAGLE40 using VPN

Introduction

This document explains how to improve protection in Modicon M340 architectures against cyber-attacks relying on a firewall device such as the EAGLE40-07 from Belden, configured to establish VPN connections. Deploying such device in an architecture allows to mitigate most of vulnerabilities existing in the devices and drastically reduce the attack surface of the different products.

In any cases, whether a device such as the EAGLE40-07 is used or not, we strongly recommend following good practices to harden the network, workstations and devices, as described in the Modicon Controllers Platforms Cyber Security, Reference Manual available for download at the following URL: https://www.se.com/ww/en/download/document/

EIO0000001999/

EAGLE40 Firewall

Why use a Firewall?

Relying on a firewall to reinforce the cybersecurity of an existing architecture brings the following advantages:

• The cybersecurity of the whole control networks and devices is reinforced.

• Reinforced cybersecurity relies on the strong IPSEC protocol.

• Impact on existing architecture and performances is minimum.

When properly configured, assuming the different client machines are not compromised, deploying such device in an architecture allows to mitigate most of vulnerabilities existing in the devices and drastically reduce the attack surface of the different products. In particular it provides a high level of protection against a large number of attacks such as “Man in the middle”, illegal modification of data, sensitive data protection against discovery , and so on...

EAGLE40 Main Features

M580, M340 and legacy Schneider Electric offers are continuously evolving to reinforce high level cyber security protection. However, in some cases relative to fixed design, or backward compatibility, vulnerabilities remain and have to be handled at another system level.

EIO0000001999.09

105

Cyber Security

To achieve this goal, different solutions have been evaluated. The EAGLE40 firewall is the preferred solution to cover or mitigate M340 cyber security enforcement remaining issues.

• Through powerful IPSEC VPN, EAGLE40 firewall provides expected confidentiality on network traffic to help prevent attacks conducted by "Man in the middle" way. It also ensures the authentication of the sender by helping to prevent from "spoofing" attacks.

Message integrity is also reinforced by cryptographic methods and cannot be tampered any more.

• Usual filtering capabilities are also available, allowing to control traffic and protocols based on IP, Mac address, and port of network devices.

• The EAGLE40 firewall is a scalable product that can be included in multi-point architectures, with rate and bandwidth performances ensuring network transparency.

Prerequisite and Limitations

Software Installation

A compatible VPN client software is necessary to establish a VPN tunnel based on IPSEC protocol between the client and the firewall.

The EAGLE40 firewall requires the use of the VPN client IPSEC/IKEV2.

NOTE: Schneider Electric recommends using the VPN client solution provided by

TheGreenBow.

In the configuration procedures described below we use this software that you can download at the following URL:

• https://www.thegreenbow.fr/vpn_client.html

, for Windows.

• https://www.thegreenbow.fr/vpn_linux.html

, for Linux

Machines and Operating Systems

Before configuring the firewall, you need to prepare all IP address in use in the architectures.

106 EIO0000001999.09

The following diagram is given as an example:

Cyber Security

EIO0000001999.09

107

Cyber Security

Typical Architecture

The architecture and configuration instructions in this document are provided as example and can be adapted to any king of architectures and platforms, especially your specific configuration.

As an example, the following mixed architecture, combining both Modicon M340 and

Modicon M580 PLCs is a typical architecture:

Configuring the Firewall

Web Configuration

To configure the firewall, open an Internet browser and enter the following URL: https://[IPFirewall]/admin

Click Enter and use default username/password combination admin/private to log in.

NOTE: On the first login you are required to change the password.

108 EIO0000001999.09

Configuring the Routes

To configure the routes, proceed as follows:

Action Step

Cyber Security

On the Navigation left pane open Routing the Ethernet interface you want to configure.

> Interfaces > Configuration webpage. Choose

Click the icon to launch the Configure VLAN Router Interface window.

Set an ID number to the VLAN you want to configure (1 in the example), then click Next .

EIO0000001999.09

109

Cyber Security

Step

Action

Set a route name to the VLAN you want to configure (RouteName in the example), then click Next .

4 Set the IP address of the Control Network and its mask, ( 192.168.30.254/16 in the example), then click Finish .

110

5 Repeat the steps 1 to 4 for the Machine Network using the second Ethernet interface.

EIO0000001999.09

Cyber Security

In the following example we have set the control network gateway interface of the firewall to

192.168.30.254/16 on the physical port n°1 and machine network to

139.160.235.254/16 on the physical port n°2.

Configuring the VPN in the Firewall

To configure the VPN, proceed as follows:

Step

Action

On the left pane of the web page, click on Virtual Private Network

Connections menu. Click the icon.

Choose an index number and a name then click Next .

Choose a password (PSK) then click Next .

EIO0000001999.09

111

Cyber Security

Step

Action

Fill up the IP addresses and masks according to your network.

• Remote endpoint : The computer connecting to the firewall via VPN.

• Local endpoint : The gateway configured in the Routes.

• Source address (CIDR) : The protected machine network accessible only once connected via VPN.

• Destination address (CIDR) : The computer connecting to the firewall via VPN.

Click Next .

Set a margin time. The default value is 150.

Set IKE Version to ikev2 then click Finish .

Configuring the VPN Client

NOTE: In our example we use the VPN client solution provided by TheGreenBow.

To configure the VPN client, proceed as follows:

Step

Action

Download and install the VPN client software.

On the left pane of the VPN Client window, right click VPN Configuration and choose Wizard .

Choose IKEv2 Tunnel and click Next .

112 EIO0000001999.09

Cyber Security

Step

Action

Set the IP address of the firewall accessible via the Control Network interface (192.168.0.254 in the example).

Enter the PSK previously selected.

Click Next , then click Finish .

On the left pane of the VPN Client window, right click on the Ikev2 tunnel just created and rename it.

Right click on the just renamed Ikev2 tunnel and select Open Tunnel .

A notification confirms that the secure connection has been established.

EIO0000001999.09

113

Cyber Security

Step Action