plc.myforum.ro

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

Protection of an Automation Cell Using the SCALANCE S602 V3 and SCALANCE S623 Security Modules via a Firewall

https://support.industry.siemens.com/cs/document/22376747/protection-of-an-automation-cell-using-the-scalance-s602-v3-and-scalance-s623-security-modules-via-a-firewall

With the advance of Industrial Ethernet solutions, increased networking with the office world and a large number of unsecured interfaces at the field level, security is of greatest importance also in industrial automation. To protect the internal secure network against threats from the office and IT environment, it is mandatory to control external access to the network or not to allow direct access.
The task of this application is to implement a security concept that meets the special requirements of industrial communication.

Setting up Demilitarized Zone (DMZ) Setting up Demilitarized Zone (DMZ)

Setting up Demilitarized Zone (DMZ) Setting up Demilitarized Zone (DMZ)

First variant:
An automation cell is to be connected to the company network so that, via access control, only certain devices or communication services have access to the internal nodes.
Second variant: Network nodes (e.g., FTP server) are to be accessible from both the secured and unsecured network without a direct connection between the networks.

Setting up Demilitarized Zone (DMZ) Setting up Demilitarized Zone (DMZ)

The SCALANCE S602 V3 or SCALANCE S623 Security Modules of SIMATIC NET meet these requirements. These modules are part of the Siemens security concept and were developed specifically for industrial automation engineering. They can be configured as a firewall and thus be used to protect automation cells/components.

Second variant:
In this document, a demilitarized zone (DMZ) is set up with the SCALANCE S623 to implement a security concept. The external network and the internal network are isolated from one another via the additional network.
This example provides a detailed description of:

Setting up a demilitarized zone with the SCALANCE S623 in routing mode.
Configuring the firewall for setting up the DMZ.
Symbolic addressing of internal nodes.

The following points are used as test scenarios:
Access to CPU data from the external network via the DMZ by means of FTP.
Sending Syslog messages from the internal network to the DMZ.

Protection of an Automation Cell Using the SCALANCE S602 V3 Security Module via a Firewall (Bridge/Routing)
https://support.industry.siemens.com/cs/attachments/22376747/22376747_Firewall_S602_DOKU_V30_en.pdf
STEP 7 projects
https://support.industry.siemens.com/cs/attachments/22376747/22376747_Firewall_S602_CODE_V30.zip

Setting up da Demilitarized Zone (DMZ) with the Aid of the SCALANCE S623
https://support.industry.siemens.com/cs/attachments/22376747/22376747_DMZ_S623_DOKU_V10_en.pdf
https://support.industry.siemens.com/cs/attachments/22376747/22376747_DMZ_S623_CODE_V10.zip

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

SIMATIC Process Control System PCS 7 Symantec Endpoint Protection 11.0 Configuration
https://support.industry.siemens.com/cs/attachments/38004530/vir005_b_en-US.pdf

https://support.industry.siemens.com/cs/document/92605897/all-round-protection-with-industrial-security-system-integrity

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

Symantec Endpoint Protection 12.1 Configuration
https://support.industry.siemens.com/cs/attachments/71874887/Configuration_Symantec_Endpoin_Protection_12_1_en-US_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

SIMATIC Process Control System PCS 7 McAfee VirusScan (V8.5; V8.5i; V8.7) Configuration
https://support.industry.siemens.com/cs/attachments/38006821/vir006_b_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

PCS 7 Configuration McAfee VirusScan Enterprise 8.8
https://support.industry.siemens.com/cs/attachments/66475606/configuration_McAfee_VirusScan_Enterprise_enEN_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

PCS 7 Trend Micro Office Scan configuration V7.3
https://support.industry.siemens.com/cs/attachments/38006151/vir002_b_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

SIMATIC Process Control System PCS 7 Compendium Part F - Industrial Security (V8.2)
https://cache.industry.siemens.com/dl/files/220/109742220/att_898787/v1/pcs7_compendium_part_f_en-US_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

SIMATIC Process Control System PCS 7 Security concept PCS 7 & WinCC (Basic)

https://support.industry.siemens.com/cs/attachments/60119725/Main_de_Sicherheitskonzept_SIMATIC_b_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

SIMATIC PCS 7 V8.2 GMP Engineering Manual
Good Manufacturing Practice Manual
https://cache.industry.siemens.com/dl/files/641/109744641/att_908806/v1/GMP-Manual_PCS7-V8-2_en_en-US.pdf

maersk · Member 3 Joined: 17 Aug 2014 Posts: 891

Configuring of Electronic Signatures in SIMATIC PCS 7
https://support.industry.siemens.com/cs/document/66926225/configuring-of-electronic-signatures-in-simatic-pcs-7
In many industries, especially the pharmaceutical and food sector, there are often situations requiring different critical operator actions which have to be authorized by means of an Electronic Signature. Such kinds of operator actions may include, for example:
adjusting a setpoint value
executing a switching operation
starting a sequence of operations
starting a batch operation

Depending on the specific task, an operation may require a 4-eyes principle. This means that an operation must be approved by at least two different persons. Release shall be given with the help of an Electronic Signature which, for traceability purposes, shall be stored in a long-term archive. The archive entries must be suitable to identify which operations have been performed by whom and when, including the date and time of their acknowledgement.

Setting up Demilitarized Zone (DMZ) Setting up Demilitarized Zone (DMZ)

In order to perform critical operator actions at the PCS 7 operator systems, this intervention must be verified by one or more users with an Electronic Signature. Authentication of the individual users is effected with SIMATIC Logon by means of an authorization prompt. The persons with Electronic Signature authorization are defined in the different user groups. When all required signatures are available, the critical operation will be executed. The associated signature data (time, user, operator action, operator station) will be written to the PCS message archive in the form of an audit trail.

Setting up Demilitarized Zone (DMZ) Setting up Demilitarized Zone (DMZ)

Features
dialog-based configuration of multiple, role-based Electronic Signatures
easy integration of the “Electronic Signature” functions in a PCS 7 project
reduced costs and minimized configuration time through the use of preconfigured modules
the plant is operated only by authorized personnel, thus increasing the protection against faults and errors
excellent traceability of significant operator actions
easy documentation by means of automatically generated audit trails in PCS 7
long-term archiving of the Electronic Signatures ensured by the PCS 7 archiving concept

This application example supports you in engineerinig of electronic signature functions. The downloadable ZIP archive contains the installation files. With the installation all necessary files and scripts as well as a demo project are copied onto your computer. In the documentation you will find the description to the demo project as well as step-by-step instructions for configuring of electronic signatures.

Validity
The instructions and the demo project were created with SIMATIC PCS 7 V8.0 SP1 and SIMATIC Logon V1.5.

https://support.industry.siemens.com/cs/attachments/66926225/66926225_PCS7_ElectronicSignature_en.pdf
https://support.industry.siemens.com/cs/attachments/66926225/66926225_PCS7_ElectronicSignature_Setup.zip