Siemens ET 200SP Operating Instructions Manual page 40

Configuration and operation
4.1 Security recommendations
Network attachment
Do not connect the PC directly to the Internet. If a connection from the CP to the Internet is
required, arrange for suitable protection before the CP, for example a SCALANCE S with
firewall or use the CP 1543SP-1.
Security functions of the product
Use the options for security settings in the configuration of the product. These includes
among others:
● Protection levels
Configure a protection level of the CPU.
You will find information on this in the information system of STEP 7.
● Disabling the bus adapter ports
In the configuration disable a port of the bus adapter being used that is not required.
● Security function of the communication
– Enable the Security functions of the CP and set up the firewall.
– Use the secure protocol variants NTP (secure) and SNMPv3.
– Use the Security functions of the telecontrol protocols. e.g. the DNP3 Security options.
– Use the secure Open User Communication (Secure OUC) via the appropriate program
– Leave access to the Web server of the CPU (CPU configuration) and to the Web
● Protection of the passwords for access to program blocks
Protect the passwords stored in data blocks for the program blocks from being viewed.
You will find information on the procedure in the STEP 7 information system in the topic
"Know-how protection".
● Logging function
Enable the function in the Security configuration and check the logged events regularly
for unauthorized access.
Passwords
● Define rules for the use of devices and assignment of passwords.
● Regularly update the passwords to increase security.
● Only use passwords with a high password strength. Avoid weak passwords for example
"password1", "123456789" or similar.
40
If you connect to public networks, you should use the firewall. Think about the services
you want to allow access to the station via public networks. By using the "bandwidth
limitation" of the firewall, you can restrict the possibility of flooding and DoS attacks.
blocks.
server of the CP disabled.
CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1
Operating Instructions, 01/2017, C79000-G8976-C426-03