Siemens SIMATIC S7-1200 - 10.3 Configuring the axis

Programming concepts
7.6 Protection
S7-1200 Programmable controller
System Manual, V4.2, 09/2016, A5E02486680-AK
211
Passwords are case-sensitive. To configure the protection level and passwords, follow these
steps:
1. In the "Device configuration", select the CPU.
2. In the inspector window, select the "Properties" tab.
3. Select the "Protection" property to select the protection level and to enter passwords.
When you download this configuration to the CPU, the user has HMI access and can access
HMI functions without a password. To read data or compare Offline/Online code blocks, the
user must enter the configured password for "Read access" or the password for "Full access
(no protection)". To write data, the user must enter the configured password for "Full access
(no protection)".
WARNING
Unauthorized access to a protected CPU
Users with CPU full access privileges have privileges to read and write PLC variables.
Regardless of the access level for the CPU, Web server users can have privileges to read
and write PLC variables. Unauthorized access to the CPU or changing PLC variables to
invalid values could disrupt process operation and could result in death, severe personal
injury and/or property damage.
Authorized users can perform operating mode changes, writes to PLC data, and firmware
updates. Siemens recommends that you observe the following security practices:
• Password protect CPU access levels and Web server user IDs (Page 1005) with strong
passwords. Strong passwords are at least ten characters in length, mix letters, numbers,
and special characters, are not words that can be found in a dictionary, and are not
names or identifiers that can be derived from personal information. Keep the password
secret and change it frequently.
• Enable access to the Web server only with the HTTPS protocol.
• Do not extend the default minimum privileges of the Web server "Everybody" user.
• Perform error-checking and range-checking on your variables in your program logic
because Web page users can change PLC variables to invalid values.