Kongsberg EA440 - Network Security Considerations

14
392616/B
systems.Theyarestand-aloneeventhoughtheymaybeconnectedtoanetworkfor
sensorinterfacesand/ordatadistribution.
Note
NonetworksafetyapplicationsareinstalledonanyKongsbergMaritimecomputers.
Thecomputersarethusnotprotectedagainstviruses,malwareorunintentionalaccess
fromexternalusers.
SecuringtheEA440systemitselfhasnomeaningunlessthereisapolicyinplacethat
securesallcomputersinthenetwork.Thispolicymustincludephysicalaccessby
trainedandtrustedusers.Thecustomer/enduseroftheEA440systemwillalwaysbe
inchargeofdeningandimplementingasecuritypolicy,andprovidingtherelevant
networksecurityapplications.
Note
KongsbergMaritimewillnotacceptanyresponsibilityforerrorsand/ordamagescaused
byunauthorizeduseoraccesstotheEA440.
IfyouwishtoconnecttheEA440systemtotheship'slocalareanetwork,youmust
implementthesamesecuritymechanismsontheEA440computer(s)asfortherestof
thenetwork.Thisisataskforthenetworkresponsiblepersononboard.Somekey
elementsheremustbe:
•Thesameanti-virusprotectiononallcomputers,includingroutinesforupdating
thisprotection.
•Thesamesettingsfortherewallonallcomputers.
•Controlledphysicalaccesstocomputersonthenetwork.
•Trustedandtrainedoperators.
•Log-inaccessmechanisms.
•Samepolicyforattachingperipheralequipmenttothecomputers(USBdevices,
harddrivesetc).
•Installationofprogramsonanycomputerinthenetwork,vericationthateach
programisauthentic.
•Denitionofwhichprogramsareallowedtorunoneachcomputer.
•Loggingmechanismofcomputeractivity,andinspectionoftheselogs.
Howtodeneandimplementtheserulesdependsoneachenduser'snetworksystem
conguration,whichagainmustbearesultofthepoliciesandthreatlevelstheenduser
hasdenedforthecompleteinstallation.Forsomeproductsthenetworkconsistsofonly
processorunitsand/orworkstations,transceiversandafewsensors.Onothervessels,
largercomputersystemscanbeinstalledtoincludenumerousproductsanddatasystems.
Theremustbeoneresponsiblepersonforthesecurityofthesystem,largeorsmall.
EA440Installationmanual