SIMATIC PCS 7 Process Control System - Siemens

■ Overview
Plant bus 1
INTERNET
Example of "defense in depth" security architecture
INTERNET
The progressive standardization, opening and networking of
control systems has been accompanied by an enormous increase
in security risks. The potential dangers arising from destructive
programs such as computer viruses, worms or trojans
or from access by unauthorized personnel range from network
overloads or failures, theft of passwords and data, to unauthorized
access to the process automation. Apart from material
damage, specifically targeted sabotage can also have dangerous
consequences for people and the environment.
■ Function
With its pioneering security concept, SIMATIC PCS 7 offers comprehensive
solutions for safeguarding a process engineering
plant that are based on a hierarchical security architecture (defense
in depth). The special feature of this concept is its integrated
approach. It is not just restricted to the use of individual
security methods (e.g. encryption) or devices (e.g. firewalls). Its
strengths lie more in the interaction of a host of security measures
in the plant network. The security concept is described in
detail in the manual "SIMATIC PCS 7 recommendations and information",
and comprises advice and recommendations (best
practices) on the following topics:
• Creation of a network architecture with defense in depth, combined
with the segmentation of the plant into security cells
• Network administration with name resolution, assignment of
IP addresses and division into subnetworks
• Operation of plants in Windows domains (active directory)
• Administration of the Windows and SIMATIC PCS 7 operator
privileges; integration of the SIMATIC PCS 7 operator privileges
into the Windows administration
• Reliable control of the clock synchronization in the Windows
network
• Management of security patches for Microsoft products
• Use of antivirus software and firewalls
• Support and remote access (VPN, IPSec)
© Siemens AG 2007
Firewall
Firewall Firewall
Terminal bus 1 (OS-LAN) Terminal bus 2 (OS-LAN)
Security cell
Security cell
Enterprise Resource
Planning (ERP)
Manufacturing Execution
System (MES)
Communication
Industrial Security
INTERNET
Plant bus 2
Siemens ST PCS 7 · November 2007
Introduction
On the system side, SIMATIC PCS 7 V7.0 supports the implementation
of guidelines and recommendations of the security
concept by means of:
• Compatibility with the current versions of the antivirus software:
Trend Micro OfficeScan, Symantec Norton AntiVirus and
McAfee Virusscan
• Application of the local Windows XP firewall
• SIMATIC security control (SSC) for automatic setting of safetyrelated
parameters of DCOM, registry and Windows firewall
during the setup
• User administration and authentication by means of SIMATIC
Logon
• Integration of the SCALANCE S602, S612 and S613 industrial
security modules of SIMATIC NET
The manual "SIMATIC PCS 7 Security Concept, Recommendations
and Advice" is available on the Internet via the SIMATIC
Guide for Technical Documentation under "SIMATIC PCS 7
Process Control Systems & Migration".
You can find the SIMATIC Guide for Technical Documentation on
the Internet.
Additional information is available in the Internet under:
http://www.siemens.com/simatic-docu
9/33
9