Siemens SIRIUS 3RW5 - Page 17

Safety information
2.3 Data security in automation
SIRIUS 3RW5 Modbus communication module
Equipment Manual, 03/2020, A5E43676481002A/RS-AC/003
17
Precautions
The most important precautions against manipulation and loss of data security in an
industrial environment are:
● Filtering and verification of data traffic through virtual private networks (VPN). A virtual
private network is used to exchange private data in a public network (e.g. the Internet).
The most common VPN technology is IPsec. IPsec is a collection of protocols based on
the IP protocol at the network layer.
● Segmentation into protected automation cells. The aim of this concept is to protect
devices in the network through security modules. A group of protected devices forms a
protected automation cell. Only security modules in the same group or the device
protected by you can be interchanged.
● Authentication (identification) of the networked devices. The security modules identify
themselves to each other via a secure (encrypted) channel using authentication
procedures. This prevents access to a protected segment by unauthorized persons from
outside.
● Encryption of the data traffic. The confidentiality of the data is ensured by encrypting the
data traffic. For this purpose, every security module is given a VPN certificate which
includes the encryption key.
VDI guidelines on information security in industrial automation
The VDI/VDE Association of German Engineers "Measurement and Automation" has
published a guideline for implementation of a security architecture in the industrial
environment in the VDI guideline "VDI/VDE 2182 Sheet 1, IT Security for Industrial
Automation - General Model". You will find the guideline under "VDI Standards" on the VDI
home page (https://www.vdi.de/richtlinien
).