Siemens Simatic S7-400 - PROFINET Interface

Configuration and operation
4.2 Security recommendations
CP 443-1 OPC UA
36 Operating Instructions, 01/2017, C79000-G8976-C427-02
● Keep the firmware up to date. Check regularly for security updates of the firmware and
use them.
● Check regularly for new features on the Siemens Internet pages.
– Here you will find information on network security:
Link: (http://www.siemens.com/industrialsecurity)
– Here you will find information on Industrial Ethernet security:
Link: (http://w3.siemens.com/mcms/industrial-communication/en/ie/industrial-ethernet-
security/Seiten/industrial-security.aspx)
– You will find an introduction to the topic of industrial security in the following
publication:
Link:
(http://w3app.siemens.com/mcms/infocenter/dokumentencenter/sc/ic/InfocenterLangu
agePacks/Netzwerksicherheit/6ZB5530-1AP02-
0BA4_BR_Network_Security_en_112015.pdf)
Physical access
Restrict physical access to the device to qualified personnel.
Network attachment
Do not connect the PC directly to the Internet. If a connection from the CP to the Internet is
required, arrange for suitable protection before the CP, for example a SCALANCE S with
firewall.
Security functions of the product
Use the options for security settings in the configuration of the product. These includes
among others:
● Protection levels
– Configure a protection level of the CPU.
– Configure the protection level "Status-dependent".
● Security function of the communication
– Enable the Security functions of the CP (HW Config).
– Enable secure OPC UA communication via a Security profile (SCT).
– Disable access to the Web server of the CPU (CPU configuration) and on the CP
(SCT).