Operational Application Environment And Security Assumptions; Intended Use - Siemens SIMATIC ET 200eco PN M12-L System Manual

Consideration of the risks posed by cyber attacks in the Threat and Risk Assessment (TRA)
Make an inventory of all software, hardware, and infrastructure devices, in order to identify
risks to the location or organization. Incident response procedures must be incorporated into
all IT and manufacturing processes. The choice of risk mitigation measures should be based
on a cost-benefit analysis and classification of risks. This is followed by the introduction of
cybersecurity rules and procedures and the training of personnel.
Living the concept
Technical solutions alone are not sufficient to effectively counter threats.
Cybersecurity must be part of the corporate culture and process landscape and must be
internalized and lived by all employees.
Continuously monitoring the security situation
Continuous monitoring of the cybersecurity situation through:
• Setting anomaly references and creating allow and deny lists based on normal network
communication and production machine behavior
• Establishment of an intrusion detection system (IDS) that generates alarms when unusual
behavior occurs in the network
• Introduction of a Security Incident and Event Management (SIEM) system to collect,
analyze, and evaluate events in real time to enable early countermeasures
• Measures regarding network security: e.g. network segmentation, firewalls, VPN, DMZ
(demilitarized zones)
4.5

Operational application environment and security assumptions

4.5.1

Intended use

SIMATIC products are intended for use in industry. If you plan to use the product in a different
environment, check the conditions required for such use.
The product may be operated only by personnel qualified for the specific task in accordance
with the relevant documentation, in particular its warning notices and safety information.
Qualified personnel are those who, based on their training and experience, are capable of
identifying risks and avoiding potential hazards when working with these products.
Operational reliability and intended use
Read the "Special information" in the Introduction (Page 8) section.
Area of application
Observe the "Area of application" section in System overview (Page 34) chapter.
Distributed I/O system ET 200eco PN M12-L
System Manual, 11/2023, A5E48753295-AG
4.5 Operational application environment and security assumptions
Industrial cybersecurity
27