LENZE E94AMSE0024 E94AMSE0024 E94AMSE0024 E94AMSE0024 E94AMSE0024 E94AMSE0024

security goals. The approach of this strategy is a multi-layer security model
consisting of the following components:
? Plant Security
? Network security
? System integrityThe advantage of this strategy is the fact that an attacker first has to break through
several security mechanisms to do any damage. The security requirements of each
layer can be taken into account individually.
The solution for plant security
Implementation of an appropriate, comprehensive security management is the
basis for planning and realizing an industrial security solution.
Security management is a process mainly comprising four steps:
? Risk analysis with definition of risk reduction measures: These measures must
be defined for the plant, depending on the threats and risks identified.
? Determination of guidelines and coordination of organizational measures.
? Coordination of technical measures.
? A consistent security management process with regular or event-dependent
repetition of risk analysis.
The solution for network security
If controllers or other intelligent devices with no or minimum self-protection are
located in a network segment, a good option to consider is to create a secured
network environment for these devices. One approach to achieve this is by the use
of network security appliances. . Additional security can be provided by
segmenting individual sub-networks, e.g. through a cell protection concept or a
demilitarized zone (DMZ)The security solution was developed particularly for the requirements of
an automation environment, in order to meet the increasing demand of network
security, to reduce the susceptibility to failure of the entire production plant and
thus to increase its availability.In order to maintain the system integrity, it is important to minimize the
vulnerabilities in PC systems and in the control level. meets this
requirement with the following solutions:
? use of antivirus and whitelisting software,
? patch management,
? user authentication for machine or plant operators,
? integrated access protection mechanisms in automation components,
? protection of the program code through know-how protection, copy protection,
and assignment of passwordsThe security mechanisms integrated in PCs and Windows operating systems
generally provide a high level of security. However, these measures are typically
designed for the requirements of office environments. In industrial security, the
objects to be protected are quite similar, but, to some extent, their priorities differ
significantly. While the top priorities in office IT are typically the confidentiality and
integrity of information, plant availability or operability come first in industrial
security. When selecting appropriate security measures, it must always be ensured
that they provide the necessary level of protection without having unacceptable
impact on the actual operation.
of normal operation of a system against intentional or unintentional violations.
However safety systems also need to be particularly protected against such
violations.
It’s a machine vendor’s task to establish appropriate safety mechanisms. These
mechanisms must not primarily be included into the defense in depth concept,
even if they can contribute.
Whereas safety threats are basically static, security threats are dynamic during
lifetime of a machine / plant. Therefore the security protection needs to be
continuously revisedSecurity management is an integral part of an industrial security concept to
address all security-relevant aspects of an automation solution – either a single
machine, a plant section or an entire plant. As the potential threats to an
automation solution change over its life cycle a process to monitor and detect these
threats, known as security management, should be considered. The objective of
this process is to achieve the necessary security level of an automation solution
and to maintain it on a permanent basis. The risk analysis component contained
within a security management process ensures that only appropriate
countermeasures will be implemented to reduce the risks. An example of a security
management process is as follows:The following chapters show which integrated access protection mechanisms the
SIMATIC S7 controllers offer
2.1 Block protection
Overview
In STEP 7 V5.x and in STEP 7 (TIA Portal), there are different protection facilities -
to protect the know-how of the programs in the blocks against unauthorized
persons.
? Know-how protection
? S7 Block Privacy
If a block protected by this function is opened, only the block interface (IN, OUT