Siemens SIMATIC NET SCALANCE M812 Operating Instructions Manual page 14

Security recommendations
2.1 Passwords
• Replace the default passwords for all user accounts, access modes and applications (if
applicable) before you use the device. Create a separate user account for each user that will
receive access to the device.
• Define rules for the assignment of passwords.
• Use passwords with a high password strength. Avoid weak passwords, (e.g. Passwort1,
123456789, abcdefgh) or recurring characters (e.g. abcabc).
This recommendation also applies to symmetrical passwords/keys configured on the device.
• Make sure that passwords are protected and only disclosed to authorized personnel.
• Do not use the same passwords for multiple user names and systems.
• Store the user account details in a safe location to have them available if they are lost. You can
use password managers or encrypted files/drives for this purpose.
• A password must be changed if it is known or suspected to be known by unauthorized
persons.
• When user authentication is performed via RADIUS, make sure that all communication takes
place within the security environment or is protected by a secure channel. Use a RADIUS
connection with changing passwords, expiry time, etc.
• Watch out for link layer protocols that do not offer their own authentication between
endpoints, such as ARP. An attacker could use vulnerabilities in these protocols to attack
hosts, switches and routers connected to your layer 2 network, for example, through
manipulation (poisoning) of the ARP caches of systems in the subnet and subsequent
interception of the data traffic. Appropriate security measures must be taken for non-secure
layer 2 protocols to prevent unauthorized access to the network. Physical access to the local
network can be secured or secure, higher layer protocols can be used, among other things.
Certificates and keys
• There is a pre-installed Web server certificate (RSA, 2048 bit key length) and an SSH Private
Key in the device. Replace this certificate with a user-generated, high-quality certificate with
key. Use a certificate signed by a reliable external or internal certification authority. You can
install the certificate in the WBM via "System > Load and Save".
• Use the certification authority including key revocation and management to sign the
certificates.
• Use password-protected certificates in the format "PKCS #12".
• Use certificates with a key length of 4096 bits.
• Make sure that user-defined private keys are protected and inaccessible to unauthorized
persons.
• If there is a suspected security violation, change all certificates and keys immediately.
• SSH and SSL keys are available for admin users. Make sure that you take appropriate security
measures when shipping the device outside of the trusted environment:
– Replace the SSH and SSL keys with disposable keys prior to shipping.
– Decommission the existing SSH and SSL keys. Create and program new keys when the
14
device is returned.
Operating Instructions, 11/2023, C79000-G8976-C343-09
SCALANCE M812, M816