Belden HIRSCHMANN HiOS-2A - Page 22

66 pages

Save Page as PDF

To Next Page

To Previous Page

Security planning

1.4

Impact of device requirements on system planning

UM Security BRS-2A

Release

8.7

05/2022

Main Page

Table of Contents3
Document History7
Safety Instructions9
About this Manual11
Key12
Security Planning13
Introduction13
Subject13
Audience13
Scope13
Capability Security Level14
Document Outline14
Defense in Depth15
Purpose15
Defense in Depth Vs. Hardening15
Responsibilities15
Example15
Impact of the System Lifecycle to the Device Lifecycle17
VLAN Plan17
Impact of Device Requirements on System Planning18
Secure Installation Location18
Plan a Dedicated User Account Login Policy19
Plan a Dedicated User Account Password Policy19
Plan a Dedicated User Account Name and Access Role Policy for Device Management20
Plan a Dedicated Logging Policy20
VLAN Plan Considerations Depending on Redundancy Protocols21
Network Time Synchronization Considerations21
Device Security23
Security Vs. Functionality23
Prerequisites for Installation and Setup24
Recommended Installation Work Step Sequence25
Reasons for the Recommended Installation Work Step Sequence25
Recommended Preparation for Installation25
Choice of a Secure Installation Location26
Device Availability Requirements26
Software Update27
Security Configuration28
Assign a Static IP Address for the Device Management29
Disable Hidiscovery Access29
Configure a VLAN Dedicated to Management Access29
Disable Logical Access to the Signal Contact30
Disable Logical Access to the Digital Input30
Disable Logical Access to Unused Ports and SFP Slots30
Configure Power over Ethernet30
Disable Booting from an External Memory31
Disable Automatic Device Software Update from an External Memory31
Disable Writing a Configuration Profile to an External Memory31
Disable Loading a Configuration Profile from an External Memory31
Disable Loading a Configuration Profile that Lacks a Valid Fingerprint32
Disable Insecure Management Protocols32
Configure Management IP Access Restrictions32
Configure a Dedicated HTTPS Certificate33
Configure a Dedicated SSH Host Key Pair33
Configure a Dedicated User Account Login Policy33
Configure a Dedicated User Account Password Policy34
Configure Dedicated User Account Names and Access Roles for Device Management34
Adapt Session Timeouts35
Configure Time Synchronization35
Configure Logging36
Configure Dedicated Login Banners36
Configure Advanced Device Security36
Configure Advanced User Authentication36
Create a Backup of Device-Specific Data37
Possible Hardware Modifications for Security38
Restrict Physical Access to the USB Port38
Restrict Physical Access to Network Ports or SFP Slots38
Restrict Physical (Visual) Access to the Device and Port Leds38
Restrict Physical Access to the Signal Contact38
Restrict Physical Access to the Digital Input38
Device Installation39
Data Connections39
Signal Contact Considerations39
Digital Input Considerations39
Operation40
Environmental Conditions40
Connectivity40
Maintenance41
Software Update41
Hardware Enhancement41
Hardware Replacement41
Hardware Repair41
Decommissioning42
Destruction of Confidential Data and Secrets42
Secure Physical Destruction of Device and Components42
Network Security Support43
Introduction43
Prerequisites for Setting up Network Security44
Employ Defense in Depth for Your Network Infrastructure45
Hardening the Network Infrastructure46
Measures to Secure the Network Infrastructure47
Restrict Logical Access to Your Network48
Configure a Dedicated Management VLAN48
Configure VLAN Segregation48
Disable GVRP and MVRP48
Configure Port Security48
Configure Acls48
Secure the Network Protocols Used49
Disable GMRP and MMRP49
Secure the Redundancy Protocols Used50
Secure RSTP Guards and Helper Protocols50
Secure MRP50
Secure HIPER Ring50
Secure Ring/Network Coupling50
Configure Attack Protection Functions51
Configure Denial of Service (Dos) Protection51
Configure Rate Limiters51
Configure Network Time Synchronization52
Configure Logging53
Configure an Audit Trail53
A Index55
B Further Support63
C Readers' Comments64

Belden HIRSCHMANN HiOS-2A - Page 22

Table of Contents

Related product manuals