Example of a defense-in-depth security architecture

With advancing standardization, openness and networking, the security risks for process control systems have risen significantly. The danger potential arising from malicious programs such as computer viruses, worms and trojans or from access by unauthorized personnel ranges from network overloads or failures and theft of passwords and data to unauthorized interventions in the process automation. Apart from property damage, targeted sabotage can also have dangerous consequences for personnel and the environment.

With the security concept developed for SIMATIC PCS 7 you have comprehensive protection for your process control system against these various dangers. Siemens supports you with additional services as needed, including security assessment, security implementation and security management during operation (for details see section "Plant Security Services).

SIMATIC PCS 7 security concept

The SIMATIC PCS 7 security concept, which is described in the "Security concept PCS 7 & WinCC (Basic)" manual and in detail in other documents, provides far-reaching recommendations (best practices) for safeguarding process plants based on a defense-in-depth security architecture. It is not restricted to the use of individual security methods (e.g. encryption) or devices (e.g. firewalls).

The strengths of this holistic concept lie rather in the interaction of a host of security measures in the plant network:

• Formation of a network architecture with defense-in-depth security, combined with segmenting of the plant into security cells
• Network administration, assignment of IP addresses, and division into subnetworks
• Operation of plants in Windows domains (active directory)
• Administration of Windows operator authorizations and SIMATIC PCS 7 operator authorizations; integration of SIMATIC PCS 7 operator authorizations into the Windows administration
• Reliable control of time synchronization
• Management of security patches for Microsoft products
• Use of virus scanners, whitelisting software and firewalls
• Establishment and operation of support access and remote access (VPN, IPSec)

The manual "PCS 7 & WinCC security concept, basic document" is available from the Siemens Industry Online Support:

https://support.industry.siemens.com/cs/ww/en/view/26462131