Siemens SIMATIC NET S7-400 Manual page 38

Configuration and operation
6.1 Security recommendations
Security functions of the product
Use the options for security settings in the configuration of the product. These includes
among others:
● Protection levels
– Configure a protection level of the CPU.
– Configure the protection level "Status-dependent".
● Security function of the communication
– Enable the IP access protection of the CP (HW Config).
– Disable access to the Web server of the CPU (CPU configuration) and on the CP.
● Protection of the passwords of program blocks
Protect the passwords stored in data blocks for the blocks from being viewed. The
procedure is described below.
Know-how protection of blocks (STEP 7 V5)
You can prevent the contents of data blocks (e.g. passwords) being read out by protecting
the block with the "KNOW_HOW_PROTECT" option. Follow the steps outlined below in
STEP 7:
1. Select the DB in the block folder.
2. Open the block in the editor.
3. Close the block in the editor.
4. Generate a source from the block in the editor.
5. Select the source of the DB in the sources folder.
6. Open the source.
7. Insert an empty line in the header of the source and write "KNOW_HOW_PROTECT" in
this line.
8. Compile the source.
Result: The block is protected. You can recognize this by the padlock symbol in the block
folder.
If you want to later change parameters in a DB, for example a password, remember the
following: The contents of a DB with know-how protection are no longer visible and can only
be changed via the source or by direct assignment of parameters.
Passwords
● Define rules for the use of devices and assignment of passwords.
● Regularly update the passwords to increase security.
● Only use passwords with a high password strength. Avoid weak passwords for example
"password1", "123456789" or similar.
38
CP 443-1 RNA
Manual, 03/2019, C79000-G8976-C299-04