EcoStruxureTM Power
Guide for Designing and
Implementing a Cyber Secure
Digital Power System
Technical Guide
10/2021
ESXP2TG003EN

se.com/ww/ecostruxure-powerwww.se.com

www.se.com

Purpose of the Document
Target Audience

Important Information

This technical guide is intended for those responsible for designing
digitalized electrical distribution systems; such as electricaldesign consultants, as well as system integrators and applicationengineers responsible for configuration and implementation of
EcoStruxureTM Power systems.

This document is intended to provide an introduction for designing and implementing
a secure digital power system. It is not intended to replace any specific productdocumentation or site-specific design documentation.
The architectures and services described in this document are not a specific product in
the normal commercial sense. It describes an example of how Schneider Electric andthird-party components may be integrated to fulfill an industrial application.

Objective

It is the duty of any such user or integrator to perform the appropriate and complete
risk analysis, evaluation and testing of the products with respect to the relevant specificapplication or use thereof. Neither Schneider Electric nor any of its affiliates or subsidiaries
shall be responsible or liable for misuse of the information contained herein.

The objective of this document is to support the EcoStruxure™
Power Digital Application Design Guide, in which we introduce
the digital applications and describe their implementation forlarge buildings and critical facilities.
All the digital applications embedded in EcoStruxure™ Power
Edge Control Software need to collect data from the electricalinstallation to enable applications, for example: Cost Allocation,
Energy Usage Analysis, Power Event Analysis, etc., as wellas to perform general trending or diagnostics.
For information about EcoStruxure™ Power courses, contact:
Cybersecurity.Academy@se.com

When devices are used for applications with technical safety requirements, all pertinentstate, regional, and local safety regulations must be observed when deploying and using
the automation architectures recommended in this documentation.

Digital Applications forLarge Buildings andCritical Facilities
EcoStruxure™
Power Design Guide forNorth America
Ref: 0100DB1802R11/20

You agree not to reproduce, other than for your own personal, non-commercial use, allor part of this document on any medium whatsoever without permission of Schneider
Electric, given in writing. You also agree not to establish any hypertext links to thisdocument or its content.
Schneider Electric does not grant any right or license for the personal and noncommercial
use of the document or its content, except for a non-exclusive license to consult it on an"as is" basis, at your own risk. All other rights are reserved.
Failure to use Schneider Electric software or approved software with our hardware
products may result in injury, harm, or improper operating results.

2

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide3

www.se.com

www.se.com

Table of Contents

Overview of EcoStruxure™ Power (1/3)

INTRODUCTION................................................................... .............p. 5

Introduction
As shown in the diagram below, and indicated by the green arrows, EcoStruxure™ Power
is one of the six domains of EcoStruxure™, our IoT-enabled architecture and platform.
EcoStruxure™ Power plays a key role in all four End-Markets (Building, Data Center,Industry and Infrastructure). This involves bringing the world of electrical distribution
to those End-Markets.

SECTION 1 I Introducing Cybersecurity............................... .............p. 9
SECTION 2 I Designing the Network for Security................. ...........p. 15

1

4 End-Markets
addressed

SECTION 4 I Configuration of Servers.................................. ...........p. 32

End-to-end Cybersecurity

SECTION 3 I Configuration of Devices................................. ...........p. 28

Buildings

2

Data Centers

Industry

InfrastructureApps, Analytics & Services
Edge Control
Connected Products

SECTION 5 I Configuration of Software Products................. ...........p. 35

3
SECTION 6 I Integration and Hardening............................... ...........p. 41
BIBLIOGRAPHY.................................................................... ...........p. 46

6 EcoStruxure™
domains ofexpertise

EcoStruxure™
Power

EcoStruxure™
Building

EcoStruxure™
IT

EcoStruxure™
MachineEcoStruxure™
Plant

EcoStruxure™
Grid

EcoStruxure™’s integrated architecture serves four end markets with its six domains of expertise.

4

5

6

4

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

OUR VISION
OF A NEW
ELECTRICWORLD

The world is becoming more electric and digital, and power is becoming more distributed, more
complex to manage, and more integrated into our everyday lives. We envision a New Electric World
where building staff and occupants are safer, with zero electrical safety incidents. Where power is100% available, with zero unplanned downtime. Where energy and operations are more efficient,with zero energy waste. And where operational systems are resilient, with zero cyber intrusions.
We strive to make this vision a reality with our IoT-enabled EcoStruxure™ architecture and platform,
which we deliver through our connected energy management ecosystem – a collective of partners
and industry experts who are openly collaborating with us to push innovation, enhance productivity,
reduce risk, and unlock new growth opportunities.

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide5

www.se.com

www.se.com

Overview of EcoStruxure™ Power (2/3)

Overview of EcoStruxureTM Power (3/3)

EcoStruxure™ Power

Reference Documents• EcoStruxure™ Power digitizes and simplifies low and medium voltage electrical
distribution systems. It provides essential data to aid the decisions that help protect
people, safeguard assets, maximize operational efficiency and business continuity,and maintain regulatory compliance.
• EcoStruxure™ Power is an open architecture and platform designed with the intentionof making it easy to add, upgrade, and swap components. The world is full of electrical
distribution systems in various stages of maturity; from a variety of manufacturers.
Interoperability with EcoStruxure™ Power is essential to making these power distributions
systems future ready. The added benefit of a holistic Schneider Electric systemis the plug-and-play connectivity to achieve faster and lower risk integration andcommissioning.
• EcoStruxure™ Power architectures are cost-optimized to deploy, using only the righttechnology to deliver the desired business outcomes for our customers – no more,no less. However, customer needs or demands change over time.
• The EcoStruxure™ Power system is scalable from light commercial and industrial
buildings to critical facilities such as hospitals data centers or infrastructure like airports,
rail and oil and gas. Scalability of EcoStruxure™ Power also extends to growing andevolving with changing needs or demands through its modular architecture.
• EcoStruxure™ Power architectures are fully flexible power distribution systems withthe ability to adapt to dynamic and ever-changing conditions, such as balancing supply
and demand by the hour or minute or adding and then scaling on-site renewablegeneration capabilities over time. Connecting IT and OT systems into a single,
easy-to-manage Ethernet IP network is at the heart of our digitization story.
With EcoStruxure™ Power, facility managers can use the data they collect to makereal-time decisions to maximize business continuity and optimize operations.

ID

Document

R1

IEC62443-2-4: Security program requirements for IACS service providers

R2

IEC62443-3-3: System security requirements and security levels

R3Power Operation System Guide

R4Power Monitoring Expert (PME) System Guide

R5

Cybersecurity Admin Expert (CAE) User Guide

R6

Wireless Personal Area Network Security Recommendations

Terms and Abbreviations
Term

Description

CAE

Cybersecurity Admin Expert

DMZ

Demilitarized Zone

DPI

Deep Packet Inspection

HMI

Human Machine Interface

HP

Host Protection

IACS

Industrial Automation and Control Systems

IDS

Intrusion Detection System

NAT

Network Address Translation

NSA

National Security Agency

NTP

Network Time Protocol

OT

Operational Technology

PME

Power Monitoring Expert (Software)

PTP

Precision Time Protocol

SIEM Security Information and Event Management
VLAN Virtual Local Area Network
VPN

More about EcoStruxure™ Power

Virtual Private Networkhttps://www.schneider-electric.com/en/work/campaign/innovation/power-distribution.jsp

6

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide7

www.se.com

SECTION 1

About the Guide (3/3)
Structure of the Document
Section 1 explains why Cybersecurity is important while designing an EcoStruxure™ Powerdigital architecture and introduces the sample architecture.
Section 2 provides information about the methodology for designing the network for security,
design requirements and suggestions to achieve a proper defense.
Section 3 provides deeper information about the configuration of devices.
Section 4 provides deeper information about the configuration of servers.
Section 5 provides deeper information about the configuration of software products.
Section 6 provides information about the integration and hardening of servers andworkstations.

Introducing Cybersecurity
Introduction........................................................................... p. 10
Why Is Cybersecurity Important?.......................................... p. 11
Background.......................................................................... p. 12

The Bibliography quotes the sources of the information embedded in this guide andprovides links to useful documentation.

Sample Architecture............................................................. p. 14

8EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

SECTION 1 I Introducing Cybersecurity

www.se.com

Introduction

Why Is Cybersecurity Important?

Why Read this Section?

Introducing Cybersecurity

The objective of this section is to introduce the notion of cybersecurity, which isfundamental when implementing EcoStruxure™ Power Applications.

By using smart connected devices to collect and share data, teams manage theirprocesses and assets on premises or remotely. The Internet of Things is helping buildings
and facility organizations to improve productivity and profitability by unlocking the powerof data from the edges of their electrical distribution systems.

Contents of this Section

1

SECTION 1 I Introducing Cybersecurity

www.se.com

First, we explain the importance of cybersecurity.
Then, we explain the background and recommendations to understand it, its process andpillars.
Additionally, to illustrate why applications require different levels of security, we will review
a sample architecture diagram.

With IoT enabled systems, users can reach deeper into their electrical distribution to gain
insights into operational performance, as well as reliability of energy supply. As a result
they are improving safety, increasing efficiency and reducing downtime.

1

So, while implementing connected devices eases processes and improves efficiency, italso creates a security concern that must be addressed.
Cybersecurity threats are rising and operational systems with IoT and connectivity toenterprise software and the cloud are a new vector cyber intrusions. Strong cybersecurity
strategies are needed to mitigate the impact of cyber incidents (down time, data loss).

22

Additionally, cyber vulnerabilities can vary and aren't necessarily performed by external
hackers. Education, security process and technology are all required for a strong
cybersecurity strategy.
Cybersecurity is an enabler for the Industrial Internet of Things and is central to
EcoStruxureTM solutions, helping enhance resilience against cyber threats through an
end-to-end approach to security.

3

3

4

4

5

5

6

6

10

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

11

SECTION 1 I Introducing Cybersecurity

www.se.com

Background

Background

Project Scope

Architecting a system designed to protect and power critical infrastructure takes
considerable effort on many fronts. Many markets have regulatory requirements andstandards that must be met when designing, implementing and maintaining a system
This document is not designed to replace such standard; however it is designed to createalignment with the IEC 62443 family of standards. Note that this document does notconcentrate on Cybersecurity policies and procedures (including those referred to in
IEC 62443). Further, this document should not be considered a replacement of the official
standard documentation. The concepts presented in this document will assist in preparing
for a certification, but it is not a complete list of the standards (and not all standard
requirements are listed in this document).

This document will focus on the technical architecture methodology of the system as wellas the configuration of hardware and software components.

Description

1

SECTION 1 I Introducing Cybersecurity

www.se.com

Cyber attacks on power monitoring and control systems are becoming more prevalent.
These systems are generally easy targets for attackers due to their extended life
expectancy and their dependence on legacy technologies. Many systems did notconsider cybersecurity during their conceptual definition wich makes them vulnerable toeven the most basic of attacks.
Cybersecurity consists of three basic pillars: people, processes, and technology. This
guide focuses on the technology pillar. It is strongly recommended to understand thepeople (social engineering) and process pillars as they are fundamental to secure
integration, deployment, and maintenance.

1

Note that this technical reference does not cover the necessary testing required to meetmany regulations of deployed systems. For instance, many deployments require periodic
risk assessments. This testing should be done in accordance with the risk tolerance foreach specific customer and all relevant regulatory requirements.

2

2

3

3

4

4

5

5

6

6

12

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

13

SECTION 1 I Introducing Cybersecurity

www.se.com

Sample Architecture

SECTION 2
Billing
Application

Cloud
Applications

EcoStruxurePower Advisor

Corporate
Resources

CorporateLAN

The following architecture is presented as a reference to be used during discussion in
the document. It is intended to be sufficiently broad to cover many network architectures.
While the network is represented as a star design in this example, the implemented
architecture may take other forms (for example: redundant ring).

IDS
HP

Internet—public LAN/WAN
DMZ Network
Server Backplane
OT Network PowerOT Network (BMS)
Corporate LAN
Intrusion Detection System (IDS)
Host Protection (HP)
(Application Allow-listing/AV)

IDS

Introduction........................................................................... p. 16

Edge Firewall

1

Remote User

Operations
DMZ

Read-Only Displays Clients
EcoStruxure
EcoStruxure
Building Operation
Power Operation

EcoStruxure
Panel Server

VPN / Firewall

Designing the Network for Security....................................... p. 17

IDS

Com’X

WIFI
(HMI Access)

HP
HP

HP

Public Kiosk

HP

Data Diode

2

OT
Firewall

IDS

Supervisory
Control

Building
Operation

HP

Power Operation
Power
Primary
Secondary Monitoring Expert
HP

HP

BMS (Optional)
EcoStruxure
Building Operation

Control Clients
EcoStruxure
EcoStruxurePower Operation Power Monitoring Expert

Servers

HP

IDS

HP

HP
HP

OT Network

3

4

Designing the Network for Security

IDS

Equipment (local)
Medium Voltage
Switchgear

OTO
FirewallIDS

Equipment (local)
Low Voltage Switchgear
and Emergency Backup

O
OT
FirewallEasergy
P3 Relay

ION9000

Local Power Control Network

PM8000MasterPact
PowerPact
MTZPower Application
Equipment (remote)

Equipment (local)
Office Panelboards

EcoStruxure
Panel Server

IDS

O
OT
Firewall
EcoStruxure
Panel Server

Easergy T300

IDS

PM5000 PowerPact EM3550

IDS
ID
IDS

IDS
ID
IDS

VPN/
Firewall

VPN/
Firewall

PM8000Modicon M580
Remote Power Control Network

5

6

14

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

SECTION 2 I D esigning the Network for Security

www.se.com

2

3

4

						SECTION 2 I D esigning the Network for Security

Introduction

Designing the Network for Security

Why Read this Section?

Security Architecture Methodology

In Section 2, the purpose is to detail a security architecture methodology. We also discuss
the protection mechanisms in detail.

Designing a system for cyber security should involve a Defense in Depth approach.
Also called the Castle Approach, this is a military strategy adapted by the United States
National Security Agency (NSA) for use in cyber security.

Contents of this Section

1

www.se.com

This section will follow the security architecture methodology as follows:• Policies and Procedures• Physical Security• Network Security• Host Security• Application and Security• Network Provisioning and Isolation• Demilitarized Zone (DMZ)• Virtual Private Network (VPN)• Secure Network Integration• Virtual Local Area Networks (VLANs)• Server Network Backplanes• Firewalls• Perimeter Firewalls• OT Firewalls• Wireless Networks• Application-level usage (HMI, Historian, Client Apps)• Device Communication (Low-Level Protocols)• ZigBee-Specific Security Measure• Network Binding• IPv4 and IPv6 Considerations• OT Network Protocols• Intrusion Detection System• Unidirectional Gateways (Option)

Application Security:
Data control / encrypting
Patching
Configuration

1

Host Security:
Dynamic allow-listing
Eliminating Unwanted Services
Write and Read Protection
Network Security:
Firewall Monitoring
Network Segmentation
Virtual Private Networks
Alarms2

Physicial Security:
GuardsLocks
ID cards
CCTV
FencesAccess Control

3

Policies, Procedures, Awareness:
Risk / Incident Response Management
Password Policies
Training
Awareness

Networks for critical facilities have the potential for many layers of protection. The following
sections detail specific design requirements and suggestions to achieve a proper defense
in depth implementation.
A description of each layer of this approach subsequent. Later sections of this document
discuss the protection mechanisms in detail.

4

5

5

6

6

16

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

17

SECTION 2 I D esigning the Network for Security

www.se.com

Designing the Network for Security

4

5

Designing the Network for Security

Defense in Depth

Protection Mechanisms

Policies and Procedures
The outermost layer, or the perimeter, includes policies and procedures related toaccessing the network (these policies and procedures fall outside the scope of thisdocument and will not be discussed; refer to IEC 62443 for more information). This is an
important layer of the defense system and should be carefully designed. For example,
implementing training for IT and OT managers on proper practices for managing thedigital OT infrastructure should be provided. Specialists in OT cybersecurity like
Schneider Electric can help the organization organize and implement such training

Network Provisioning and Isolation
While complete network planning is outside the scope of this document, this section
will focus on cybersecurity-specific design elements such as network security
appliances (firewalls, etc.).
There is no "one size fits all" approach to secure network design and there aremany different network designs used in critical infrastructure. A redundant ring
design is a popular choice to build a resilient architecture, offering high availability
on a backbone and individual star networks spanning out to support downstream
devices. Some deployments do not offer redundant networking architectures.
Regardless of the network architecture selected, it is imperative to consider how
the Operational Technology (OT) network will be integrated with other networks (if atall), based on the risk tolerance deemed acceptable by the customer. Note that thisincludes performing a zone and conduit analysis (as required by IEC 62443-3-2).

Physical Security
Physical security is the next defense against eavesdropping or other unauthorized
connections. Firewalls and other security appliances are rendered useless if physicaldefenses are not properly designed to prevent access to the internal network.
All communicating devices must be physically protected from unauthorized access.

23						SECTION 2 I D esigning the Network for Security

It is possible to provide these protections using secured networking closets or server
racks with alarmed sensors to provide visibility and logging at the SCADA (supervisory)level. Additionally all Ethernet cable that is outside of the secured area (for example, acable leading to an external device such as a generator control panel) must be enclosed
in conduit or some similar tamperproof enclosure.
It is recommended to use tamperproof medium such as fiber-optic cable for exterior runs
(fiber-optic cable should be enclosed in conduit when present outside of a secure area).
Network Security
This layer concentrates on the traditional network appliance-type of protection, namely
firewalls, VPNs and network intrusion detection systems.
Host Security
This layer includes protections specifically available on the host (including computersand hardware devices). This includes anti-virus, application allow-listing and host-based
intrusion detection software.
Application and Security
The inner-most layer includes the timely patching of operating systems and applications aswell as any protections offered by the software running on the host. Common protections
offered by application software is encrypting data in transit or at rest and two-factor
authentication. This layer also includes setting security permissions on files and processes
as well as setting access to data on hardware devices (for example, allowing or restricting
access to specific Modbus registers on a device).

Demilitarized Zone (DMZ)
A DMZ is a subnetwork that provides a way to expose an organization's externalfacing services to an untrusted network. Part of the defense-in-depth strategy, theDMZ allows for appropriate data access protecting sensitive networks and systems
with firewalls.
If the OT network will be connected to any less secure network (corporate network
or Wide Area Network (WAN)), it must connect through a properly configured DMZ.
Deploying a DMZ consists of at least two firewalls and a server to provide the data
to the less secure network.
Keep in mind that IT departments may consider the corporate network to be moresecure than the "legacy based" OT network. However, a connection to the corporate
network expands the attack surface providing additional access to the OT network.
Additionally, OT network protocols might be invisible to IT network infrastructure (dueto the limitations of IT infrastructure understanding low-level OT network protocols).
For the purposes of this discussion, corporate networks are considered less-secure
when compared to OT networks.

2

3

4

Connections to less secure networks must be through a DMZ.
As shown in the following figure, web servers and database servers may be placedin the DMZ to allow access to less secure networks. Of note, it is not acceptable
to place Human Machine Interface (HMI) (with control capabilities) in the DMZ. If
control is required from outside of the OT network, appropriate secured remoteconnections should be established (VPN).

5

6

DMZ

6

1

Cloud
Applications

1

www.se.com

Web

Historian

Other DB

Plant

Control Clients
EcoStruxure
EcoStruxurePower Monitoring Expert
Power Operation

DCS

HistorianControl

Protective Relays, Controllers, RTUs

Easergy
P3 Relay

Modicon M580

MasterPact MTZ

PM8000PM5000

ION9000

Control clients (HMI) should never be placed in the DMZ Read-onlydisplay clients are acceptable in the DMZ.
18

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

19

SECTION 2 I D esigning the Network for Security

www.se.com

2

Designing the Network for Security

Virtual Private Network (VPN)
If control operations are necessary outside of the secure network, there must be a secure
mechanism to provide access (such as a VPN with 2-factor authentication and hostmanagement capabilities).

Virtual Local Area Networks (VLANs)
VLANs are commonly used to segment a network logically (not necessarily grouped byphysical location or network switch connection). VLANs are particularly helpful when you
have a common network that is being used for multiple purposes. For instance, a single
OT network may support a power monitoring and control system while simultaneously
supporting a building management system.

Two factor authentication requires a user to login with a password (something secretthat they know) and something they have (the second factor). Often this second factor
is a code sent by text message or a physical item such as a USB token. There is more
information on two-factor authentication in subsequent sections.
Host Access Control, or sometimes termed host management, involves the VPN client
application running security checks on the computer used to connect to the VPN. If the
security checks fail (for instance, out date antivirus), the VPN will refuse the connection.
Remote User
VPN / Firewall
IDS

3

HP

Securing Remote Access with Vericlave

45						SECTION 2 I D esigning the Network for Security

Designing the Network for Security

Remote control operations (outside of the secure network) must be
secured with an enterprise-grade VPN solution supporting
2-factor authentication and host management.

1

www.se.com

Vericlave is an alternative to a traditional VPN approach and offers considerable
advantages including performance and simplicity (both in footprint and simplicity ofusage). Vericlave is offered by Schneider Electric Cybersecurity Services and can be
deployed in a plug-n-play configuration. This solution can provide secure communications
between nodes in transit across any communication medium (including satellite,
microwave and GSM). This solution is particularly attractive where the end user may have
limited knowledge of security protocols and mechanisms (due to the ease of use).
Due to its ease of use, Vericlave is particularly attractive where the end user may have
limited knowledge of security protocols and mechanisms. For more information on
Vericlave, visit: www.vericlave.com.

To address data contamination issues (limiting the scope of broadcast messaging inspecific protocols like IEC 61850) and manage bandwidth, it is appropriate to use VLANs.
However, VLANs should never be used for security reasons (at least not by themselves).
Techniques exist that allow for "VLAN-hopping", reducing the security of VLANs. Great
care must be taken when designing and configuring VLANs to ensure that security is notcompromised. For more information, SANS has a very informative article on this topic at:https://www.sans.org/white-papers/1090/.
Consult with your Schneider Electric representative to obtain support on proper VLAN
configurations and maintenance to implement countermeasures to layer 2 attacks.

6

ID
IDS
DS

ID
IDS
DS

VPN/
Firewall

VPN/
Firewall3

Server network backplanes are generally confined to a server cabinet or server room andshould be protected by physical security. If the server backplane must span physicallocations, appropriate security measures should be placed (the server backplane shouldbe treated as an OT network).

4

Additionally, security configuration on the servers should prevent routing between NICs
and any changes to the configuration should be monitored to prevent unauthorized
modification.
Building
Operation

PM80002Server Network Backplanes
Most deployments contain some element of server redundancy. For instance,
EcoStruxureTM Power Operation is generally deployed on a primary and secondary server.
These servers frequently communicate with one another to offer heartbeats and backfill
data. It is suggested that a separate network is connected between the software servers
to remove this overhead from the standard OT network. This simple technique involves
two network interface cards (NICs) with one connected to the OT network and the second
connected to a smaller network (backplane) that is specifically for interconnecting theservers. Note that this is not a security requirement; it is mentioned as it will offer
additional bandwidth on the OT network.

Power Application
Equipment (remote)
EcoStruxure
Panel Server

1

HP

5

Servers
Power Operation
Power
Primary
Secondary Monitoring Expert
HP

HP

HP

6

IDS
Modicon M580

Remote Power Control Network

Secure Network Integration
Some installations require multiple secure networks to be bonded or connected. Consider
a deployment of a power system in a multi-building data center. Each building has aseparate network and these networks must be connected. The networks may be bondedby Ethernet (twisted pair in conduit), fiber-optic (in conduit) or wireless (802.11 with
WPA-2).
Regardless of the medium chosen, consider bonding these networks inside a VPN tunnel
for added security. This is especially recommended for wireless communications.
20

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

Note that some environments restrict the use of dual-homed or multiple NICs on a single
server. Ensure that the use of a dedicated server backplane is compliant with applicablepolicies.

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

21

SECTION 2 I D esigning the Network for Security

1

2

www.se.com

Designing the Network for Security

Designing the Network for Security

Firewalls
Considered the traditional protection against network breaches, firewalls are only one(albeit critical) component of a cybersecure network deployment. Firewalls offer themost visible element for use in defense in depth designs. A proper design includes many
firewalls at different levels, including IT (perimeter) firewalls and OT firewalls (sectioning off
a portion of the power monitoring and control network). Based on the situation a firewall
such as the Palo Alto Networks PA-220 or PA-220R may be used.

OT Firewalls
OT firewalls are specific to the Industrial Control System (ICS) space and understandlow-level protocols that are exchanged on the OT network. Examples of the protocols
include Modbus, IEC-61850 and DNP3. OT firewalls should be placed inside of theenclosures that include the connected downstream devices (for instance, an OT firewall
should be placed in the switchgear that contains ethernet-connected relays andgateways). These firewalls offer Deep Packet Inspection (DPI) for the OT protocols andthis allows for a much more restrictive filter to be placed on allowable traffic.

Perimeter Firewalls
Perimeter firewalls include any firewalls that interact at the application layer and allow(or deny) access to applications (or users). These firewalls are used commonly in the DMZ
and in any other situation where network security segmentation is desired. For instance,
two networks with the same security posture (such as two data center networks in different
buildings on the same campus) may be connected via firewall to provide further isolation.
These firewalls can be configured to respond to Intrusion Detection Systems (IDS) andisolate areas of the network in the event of an attack. There is more detailed information
on IDS provided in subsequent sections.
Perimeter firewalls must be used when connecting a secure
network to a less-secure network.
Perimeter firewalls may be used when connecting two secure networks.

34						SECTION 2 I D esigning the Network for Security

www.se.com

Traditional IT-centric firewalls are typically used as a perimeter firewalls in OT systems.
These firewalls are usually capable of understanding application-specific protocols andfeatures as well as integrate well within an existing enterprise installation. Many customers
will have a brand of firewall that is familiar to their IT and may require that the firewall
meets their guidelines for consistency.

For instance, in addition to standard IP and port-based filtering, these firewalls can restrict
Modbus "write" operations to a specific range of registers.
OT firewalls must be used when connecting to a secure network outside ofa locked enclosure. This typically means one firewall per switchboard.
Make sure that the OT firewall selected meets the DPI criteria for the protocols used in
the network. Inspect the DPI feature set carefully as this functionality varies widely fromone manufacturer to another.

Billing
Application3

Palo Alto Networks is one common provider of OT firewalls that meet ICS / OT network
criteria. https://www.paloaltonetworks.com/.

IDS

Corporate
Resources

2

Like the perimeter firewall, the OT firewall can also be configured to respond to IDS alerts(as shown in the previous image). Note that careful consideration must be taken when
configuring firewall rules (and actions in response to an IDS event). Misconfigured firewall
rules and actions on an OT firewall can result in the loss of control and monitoring of
critical systems.

Firewall configuration recommendations and requirements are covered in a later section.
EcoStruxurePower Advisor

1

Equipment (local)
Medium Voltage
Switchgear

O
OT
FirewallIDS

Equipment (local)
Low Voltage Switchgear
and Emergency Backup

OTO
FirewallEquipment (local)
Office Panelboards

4

IDS

OT
O
Firewall
EcoStruxure
Panel Server

Easergy T300

5

5
IDS

Edge Firewall

Easergy
P3 Relay

ION9000

PM8000MasterPact
PowerPact
MTZ

PM5000 PowerPact EM3550

Local Power Control Network

6

6

22

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

23

SECTION 2 I D esigning the Network for Security

www.se.com

Designing the Network for Security

Wireless Networks
Additional care must be taken when using wireless networking in critical infrastructure.

Device Communications (Low-Level Protocols)
In some situations, it may be necessary to communicate with devices with wirelessprotocols such as WiFi (802.11), ZigBee, or Bluetooth. It is imperative that these devices
are secured (running in a secure mode such as WPA-2 for 802.11). Further, it is acommon misconception that low-power devices are not susceptible to attack because
their transmissions will not "get out" of the facility. This is not the case as there are
high-gain receivers that specialize in observing this traffic from in some cases miles away.

There are three different categories of wireless networking to be considered:• Application-level usage• Device communications• Network binding
Application-level usage
The most common type of wireless usage in critical infrastructure is for human interaction
with the control system. This may include using a notebook computer to interact with an
HMI display or for wireless phone or tablet access to a monitoring system.

2

3

4

						SECTION 2 I D esigning the Network for Security

Designing the Network for Security

Configuration, naming conventions and segmentation of wireless access points are somecountermeasures defined, configured and verified following the IEC 62443-2-4 standard.

1

www.se.com

Wireless Networks are a balance of security and convenience. By allowing wirelessconnections to access the control system, a multitude of defenses are "jumped over".
For example, if the wireless network is on the internal "secure" network, then theupper-level firewalls are completely bypassed.
For this reason, it is a common approach to have multiple levels of protection on thewireless network. This may include a directory server for wireless connections (including
two-factor authentication) and a secondary VPN (or Vericlave) connection (with anotherlayer of two-factor authentication). At a minimum, wireless networks should have WPA2Enterprise level security with a RADIUS server.
Wireless network configuration is a very complex topic and is beyond the scope of thisdocument, but make sure to consider interest in this attack vector as it is a common
method of penetration.

Read-Only Displays Clients
EcoStruxure
EcoStruxure
Building Operation
Power Operation

5

Wireless device connections must be secured.

1

ZigBee-Specific Security Measures
Security of ZigBee-based connections is almost entirely dependent on the secure storage
and transmission of the keys that are used to encrypt the communications.
The following concepts should be understood and practiced when deploying, maintaining
and administering systems with ZigBee based devices:• Key isolation and Anti-tampering – devices must protect symmetric keys fromexposure or modification. This may include the use of a Trusted Platform Module(TPM) or Physical Unclonable Function (PUF).
• Key Transport – devices must not use a default key from the manufacturer.
• Key Establishment – out-of-band channels must be used to initially distribute the key(for example: serial port, NFC). This key distribution should only work if the target
device is in pairing mode.
• Key Rotation – keys should be rotated (changed) after a pre-defined period or numberof messages.

2

3

For more information on ZigBee security, review the document titled Wireless Personal
Area Network Security Recommendations.

4

Network Binding
The final usage of wireless networks discussed here involves the interconnection of two
networks. This typically involves the use of a rotating key service (or the less-secure
pre-shared key). In addition to normal wireless security recommendations mentioned
previously, a network binding connection should be dedicated (for example: not sharedwith application level usage or client computers).

5

Wireless connections for networking binding should never be used for other uses.
WIFI(HMI Access)

It is strongly recommended to use a VPN or Vericlave implementation on all wirelessnetworks used for binding.
HP

6

6

24

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

25

SECTION 2 I D esigning the Network for Security

1

2

www.se.com						SECTION 2 I D esigning the Network for Security

www.se.com

Designing the Network for Security

Designing the Network for Security

IPv4 and IPv6 Considerations
Most OT networks rely on IPv4 and many include Network Address Translation (NAT).
By using NAT and IPv4, the OT network uses non-public IP addresses (usually of the192.168.x.x or 10.x.x.x variety) to communicate. This offers and advantage of isolatinginternal addresses from the outside world (a router "converts" requests and responses
from external addresses to these internal, private addresses). NAT is not generally
considered a security mechanism but isolating (masking) the IP addresses of internal
networking devices makes attack surface discovery substantially more difficult.

Unidirectional Gateways (Option)
Unidirectional Gateways, also referred to as Data Diodes, provide a secure means
to egress (push) data out of a secure network to a less-secure network. A common
example involves a campus where kiosks show energy saving as a result of an energy
management plan.

A description of NAT can be found at: https://en.wikipedia.org/wiki/Network_address_
translation.
Unlike IPv4 with NAT, IPv6 allows each address to be publicly routable (if allowed by theperimeter firewall). As a result, extra precaution must be taken with IPv6 addressing to
make sure that devices are not accessible on less secure networks. If IPv6 is chosen for
deployment it is necessary to make sure that all software (including drivers) and hardware
support the IPv6 standard (as many do not).

Unidirectional gateways guarantee that data can only flow in one direction (from a secure
network to the less secure network) by using hardware components and not relying solely
on software configurations that could be vulnerable to attack.

1

Public Kiosk

Data DiodeHP

2

When configuring IPv4 addresses for devices on the OT network, ensure that all internal
addresses are part of the official internal address ranges of 10.0.0.0-10.255.255.255,
172.16.0.0-172.31.255.255 or 192.168.0.0-192.168.255.255. Using and IP address outsideof this range may cause routing problems and false positives with IDS and other scanningsystems.

3

4

3

OT Network Protocols
Many devices on the OT network operate with unsecured protocols. These protocols
include, but are not limited to, Modbus, DNP3, BACNET, FTP, SNMP and IEC 61850.
If a device requires connectivity on an unsecured protocol, countermeasures should betaken to protect the device and the communication path. These countermeasures may
include physical security, firewalls, VPN tunnels and intrusion detection mechanisms.

4

The usage of insecure protocols, even with countermeasures, carries and amount ofresidual risk that must be disclosed to and accepted. More information on this is available
at: https://www.se.com/ww/en/work/services/cybersecurity-services/

5

6

5

Intrusion Detection System
An Intrusion Detection System (IDS), also referred to as Anomaly Detection, is a criticalpart of the defense network. This system actively monitors traffic on the network and canprovide alerts when unusual traffic patterns are observed. These alerts can be pushed
to HMI displays and other devices that are used to notify personnel. It is also possible toreact to these alerts by actively re-configuring firewalls on demand (to reduce allowable
traffic during a possible attack).

6

Like most cybersecurity solutions, IDS originated in the IT network space and has
gained traction in the OT network. Recently, IDS implementations have been designed
to specifically support ICS networks, making it much easier to detect and respond toanomalies on the OT network.

26

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide27

www.schneider-electric.com

SECTION 3
Configuration of Devices
Introduction........................................................................... p. 29
Configure Hardware Devices................................................ p. 30

SECTION 3 I Configuration of Devices

www.se.com

Introduction
Why Read this Section?
This section focuses on power monitoring and control devices such as breakers, relays,
power meters and bay controllers.

Contents of this Section
First, we explain the importance of updating all devices.
Then, to facilitate understanding, we define the configuration of all devices and network.
Finally, we explain the configuration of all devices and how to configurate a wirelessnetworking.

1

2

3

4

5

6

28

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

29

SECTION 3 I Configuration of Devices

www.se.com

Configure Hardware Devices
Update to Latest Firmware
All devices should be updated to the latest firmware prior to configuration. It is possiblethat device configuration will be lost during a firmware update. The firmware updates
should be retrieved directly from the manufacturer's website. If available, verify signaturesof the firmware to verify authenticity.

SECTION 3 I Configuration of Devices

www.se.com

Configure Hardware Devices
Network Configuration
The network configuration should be set in accordance with the deployment plan. While
not a security issue, it is recommended to use static IP addresses for power monitoring
and control devices. A record should be kept of all device IP addresses, MAC addresses,
TCP/UDP ports, device names and locations. This information is useful when configuring
firewalls and intrusion detection systems.

Always obtain firmware from official sources.

1

2

3

4

It is necessary to make sure that the security posture of the system is preserved
after the update. This can be accomplished by having a documented process duringcommissioning or maintenance to restore security configurations.
If using compatible devices, it may be useful to use the EcoStruxure™ Power Commission
tool to setup and maintain hardware devices. In order to setup and maintain hardware
devices use the appropriate setup software such as EcoStruxureTM Power Commission.
More information on this software is available at: https://www.se.com/ww/en/productrange/62980-ecostruxure-power-commission/#overview.
User Accounts / Set Passwords
All devices should be configured with a new administrative password. Administrative
passwords should meet complexity rules as defined by the organization (per regulatory
requirements).
Passwords should never be left in their default state.
Passwords must be securely delivered and exchanged with the customer (never written
down or stored in plain text). One recommendation is a text file inside of an encrypted ZIP
file. For instance, send the encrypted ZIP file via email to the customer and then send thepassword to the zip file via text message. Another option is to use password management
software such as KeePass to manage credentials. More information about KeePass isavailable at https://keepass.info.
Passwords must be exchanged and delivered in a secure manner.

56Make sure that any unused user account is disabled. This includes guest accounts.
A process must also be in place to notify the customer of changes in service provider(including any personnel or entity with access to system credentials).
Note that systems targeting protections against unintentional or coincidental Cybersecurity
events (referred to Security Level 1 in IEC 62443), however for systems targeting
protections against intentional, but low sophistication security events (referred to as
Security Level 2 in IEC 62443) and above requires unique passwords (each device or user
has their own password).

30

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

Note that the IEC 62443-2-4 standard requires accurate records and drawings of thelogical and physical infrastructure. The documentation must be kept current and must
include all network devices, internal interfaces and external interfaces.

1

Disabling Unused Functions
All devices should be configured to turn off all unused services and "ports". This includes
disabling unused Ethernet, wireless, field bus, NFC, USB and infrared ports. In somecases, it may be necessary to use a physical barrier, especially with USB ports. USB portsthat cannot be disabled in the device should be disabled using super glue or similar.
If there is reason to use the port in the future, tamper-proof USB locking covers areavailable for this purpose. While not as effective as permanent disablement, these locking
covers can indicate tampering.

2

It is also necessary to disable certain unused features. Many devices include a web
server, FTP server, NTP server, SMTP server and/or DHCP server. Disable any servers thatwill not be actively used in this deployment. Not only will this reduce the sustaining of thesystem, but it will also greatly reduce the attack surface of these devices.

3

If the device requires the use of insecure protocols (as detailed earlier in this document),
perform a gap assessment and identify the appropriate countermeasures necessary toaccommodate the customer's risk tolerance. For assistance, contact your local Schneider
Electric representative.

4

This process should be done in accordance with a threat map (an activity required by
IEC 62443-4-1) and the acceptable risk tolerance of the customer.
Wireless Networking
Wireless networking (ZigBee) should be configured to operate as securely as the device
supports. If no security is offered on the wireless interface, the wireless transceivershould be disabled entirely when operating in critical infrastructure. Contact the device
manufacturer for possible alternative connection methods.

5

Never enable an unsecured wireless connection.

6

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide31

www.schneider-electric.com

SECTION 4
Configuration of Servers
Introduction........................................................................... p. 33
Configure Servers................................................................. p. 34

SECTION 4 I Configuration of Servers

www.se.com

Introduction
Why Read this Section?
This section focuses on the preparation and maintenance procedures of PC hardware(server) prior to installation of application software. Continued configuration of the server
will be discussed in "Section 6" Integration and Hardening.

Contents of this Section
For each procedure of PC hardware (server) prior to installation, the related parameters
are presented as follows:• Update BIOS
• Update Operating System• Uninstall Unnecessary Applications

1

2

3

4

5

6

32

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

33

SECTION 4 I Configuration of Servers

www.se.com

SECTION 5

Configure Servers
Hardware and Operating System
Update BIOS
Due to the recent hardware related vulnerabilities (for example: Spectre, Meltdown), it is
crucial that all servers and workstations have the most recent BIOS installed. These BIOS
updates should be downloaded directly from the PC manufacturer's website (do not apply
BIOS updates form and unknown origin).
Never apply BIOS updates from and unknown origin(such as a Google search result).

1

2

Update Operating System
All servers and workstations should be updated using the Windows Update function of theoperating system. Application software should not be deployed until all Windows updates
have been applied. It is also recommended to make sure all drivers are updated to themost recent versions available. Driver updates should be downloaded directly from the
manufacturer's website.
It is highly recommended to have a "testbed environment" to update and validate before
applying updates to a live production system. This applies to operating system andapplication updates.

3

4

Never apply Windows or driver updates from an unknown origin(such as Google search result).
Uninstall Unnecessary Applications
Most servers and workstations come pre-loaded from the manufacturer with "bundled"applications. Some of the applications are used for supporting the system and others
are simply productivity applications. It is strong recommended to uninstall any unused
applications. Be especially cautious with preloaded applications that provide remotesupport assistance (these should be uninstalled.
Uninstall any preloaded applications that provide remote assistance.

5

It may be desirable to format or wipe the hard drive and install a fresh copy of theoperating system (only). This provides a clean slate without the preloaded applications.
Unused services should also be disabled on servers and workstations. This includes
unused DHCP, TELNET, DNS, FTP and web servers.
Always disable any unused services on servers and workstations.

634

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System- Technical Guide

Configuration of Software Products
Introduction........................................................................... p. 36
Configure Software Products................................................ p. 37
Cybersecurity Adming Expert (CAE).................................... p. 41

SECTION 5 I Configuration of Software Products

www.se.com

www.se.com

		Introduction

Configure Software Products

Why Read this Section?

EcoStruxureTM Power Operation

This section focuses on software application deployment on servers and workstations.

Contents of this Section
We explain how to configure Power Operation and Power Monitoring Expert (PME).
We also mention the Cybersecurity Admin Expert (CAE) application.

1

SECTION 5 I Configuration of Software Products

Install Application and Product Updates
Following the Power Operation System Guide, ensure that the product is installed and allavailable updates have been applied. Pay attention to the Cybersecurity related directionsin the guide (located under Configuration → Cybersecurity).
Active Directory Integration
Power Operation supports Windows integrated users (which provides connection toWindows Active Directory). Follow the directions in the Power Operation System Guide toenable integrated user support.

1

Roles, permissions, and privileges should also be configured at this time.
Two Factor Authentication
Power Operation supports two-factor authentication via YubiKey. This solution does not
require Internet connectivity and is required for upper levels of IEC 62443 compliance.
Follow the directions in the Power Operation System Guide to enable two-factor
authentication.

22

Visit https://www.yubico.com for more information on YubiKey devices.

3

3
Notification (SSL) / Prefer GSM
Power Operation supports notification of alarms and events via email and text message(SMS via GSM modem). If using email (SMTP), make sure that the configuration specifies
SSL for the SMTP connection. For additional security (with no need for a connection to
the Internet / SMTP server), it is recommended to use a GSM modem with SMS. Thissolution uses a local GSM modem that is configured to send outbound SMS only (no data
connection).

4

4

HTTPS
Power Operation supports HTTPS (TLS v1.2) via the use of an optional module called
Power Operation Anywhere with Secure Gateway. This is required if there will beworkstations of clients that are accessible outside of the OT (secure) network. Deploymentof this module relies on the use of Active Directory with a domain controller (it will not workwith local windows user accounts).

55

Domain integration across OT and IT networks must be analyzed and trust relationships
must be clearly defined to prevent unauthorized access.

6

6Operating System Firewall
The Windows Defender Firewall should be adjusted to allow appropriate traffic toand from the server and workstation. For servers and workstations, refer to the PowerOperation System Guide for ports that should be allowed (Configuring → Cybersecurity →Configuring Power Operation for Network Segmentation).

36

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

37

SECTION 5 I Configuration of Software Products

www.se.com

2

3

		

SECTION 5 I Configuration of Software Products

Configure Software Products

Cybersecurity Admin Expert (CAE)EcoStruxureTM Power Monitoring Expert (PME)

Cybersecurity Admin Expert (CAE) is an application that is used to configure various
security parameters on software and hardware devices in a system. This application is
also used for certificate management. This application is usually used on an engineering
laptop connected to the ICS network or it may be installed on a server on premise.

Install Application and Product Updates
Following the PME System Guide, make sure that the product is installed and all available
updates are applied. Pay attention to the Cybersecurity related directions in the guide(located under Configuration → Cybersecurity).

1

www.se.com

Active Directory Integration
PME supports Windows Active Directory. Follow the directions in the PME System Guide toenable Active Directory support (Configuring → User Manager).

CAE operates on a concept known as a Role Based Access Control (RBAC) and security
policy. For more information on CAE, review the CAE User Guide.
More information on CAE is available here: https://www.se.com/ww/en/productrange/63515-ecostruxure%E2%84%A2-cybersecurity-admin-expert.

1

Operating System Firewall
The Windows firewall should be adjusted to allow appropriate traffic to and from the server
and workstation. For servers and workstations, refer to the PME System Guide for portsthat should be allowed (Planning → IT Requirement → Network Connectivity).

2

HTTPS
PME Supports HTTPS and is installed with a self-signed certificate. It is recommended that
this is replaced with a certificate from a server acting as a Certificate Authority (CA).
Refer to the PME System Guide for more information (Planning → System Installation andUpgrades → Install Planning).

3

If self-signed certificates are used, public key certificates should be deployed to all peersthat require access.

4

4

5

5

6

6

38

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide39

www.schneider-electric.com

SECTION 6
Integration and Hardening
Introduction........................................................................... p. 42
Integration and Hardening.................................................... p. 43
Server and Workstation Hardening....................................... p. 44
Configure Network Devices.................................................. p. 45

			www.se.com

SECTION 6 I Integration and Hardening

Introduction
Why Read this Section?
The objective of this section is to concentrate on integration topics and server/workstation
hardening the servers and workstations.

Contents of this Section
This section will follow the security architecture methodology as follows:• Software Integration (Power Operation and PME)
• Time Synchronization• Patch Management• Backup Solution• UPS Software• McAfee Application Control• Antivirus• Cloud Connectivity• Password Configuration• Logging Configuration• Disable Unused Ports• OT Firewall Configuration• Deep Packet Inspection• IDS Integration

1

2

3

4

5

6

40

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

41

SECTION 6 I Integration and Hardening

www.se.com

Integration and Hardening
Software Integration (Power Operation and PME)
Many large and critical facilities employ a combination of software products that must
be integrated together, specifically Power Operation and PME. Following the appropriate
system guides, perform the integration steps listed. Make sure that a server backplane
network is used for these communications (and firewalled appropriately). Further, enableencryption where available on the interfaces used in the integration.

1

2

3

4

Time Synchronization
Time synchronization is a typical feature of power systems in critical infrastructure. Thissynchronization is achieved by several methods, including Precision Time Protocol (PTP),
Network Time Protocol (NTP) and other legacy interfaces such as IRIG and DCF77.
In addition to providing accurate time stamps for power related events, this accurate
timestamping is crucial for correlating security events across multiple network devices
and other infrastructure. Selection of a time synchronization service depends on theunique requirements of the deployment, but PTP is the recommended solution for most
deployments. Note that PTP support is generally focused on hardware devices (such as
power meters and PLCs).
Patch Management
Operating system and product patches and updates must be carefully managed ina critical installation. This can be made easier by using services that offer automatedpatching and device reboot control. Additionally, some services providers make available
reports that are necessary for IEC 62443-2-4 compliance.
Backup Solution
Disaster Recovery is a necessary component of any critical installation. In addition to
help protect against hardware failure, this is an absolute necessity to protect against
ransomware and similar attacks. The customer may have an adopted approach fordisaster recovery and it is possible to integrate both Power Operation and PME with mostIT-centric disaster recovery mechanisms. Refer to the appropriate system guide for details.
UPS Software
Uninterruptable Power Supplies (UPS) are used to provide power conditioning and ridethrough capabilities. If supported, ensure that proper integration is achieved with the UPS
infrastructure.

5

www.se.com

			

SECTION 6 I Integration and Hardening

Server and Workstation Hardening
This is not fully inclusive and additional measures may need to be taken for a specificenvironment. For instance, a workstation may need a specific configuration to disable
the Start Menu, task manager or screensavers. Refer to documentation for the specificoperating systems for guidance.
McAfee Application Control
McAfee Application Control is a allow-listing application that should be deployed onservers and workstations in critical installations. This is highly recommended as a software
allow-list will prevent execution and file access to anything that is not trusted. This isavailable as an option for both Power Operation and PME (only one license is needed
per physical server) and is deployed similar to an installation of antivirus. Application
allow-listing does not require Internet access as it does not require definition updates.
Application allow-listing is considered a higher level of security when compared toantivirus.

1

Always use application allow-listing on servers in critical infrastructure.

2

Application allow-listing is not recommended for workstations where applications may beinstalled and/or uninstalled frequently or where files are exchanged. An antivirus solution ismore appropriate in this situation.
Antivirus
Antivirus should be deployed on workstations that are not running application allow-listing.
It is imperative that antivirus receive frequent definition updates. If Internet connectivity is
not available preventing definition updates, application allow-listing must be used.

3

A malware protection strategy should be defined for components that cannot support
application allow-listing or antivirus.

4

Cloud Connectivity
If cloud connectivity is desired, it is recommended that the cloud connected device
resides in the Demilitarized Zone and is configured for encrypted communication with thecloud service. Application security may be required depending on the acceptable risk
tolerance for the vertical or the specific costumer.

5

In critical infrastructure, suggested UPS implementations include the Galaxy and Gutor
ranges of devices. More information on these products available here: https://www.se.com/
us/en/product-subcategory/55615-data-center-and-facility-3-phase-ups.

6

6

42

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System- Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

43

SECTION 6 I Integration and Hardening

www.se.com

www.se.com

			

SECTION 6 I Integration and Hardening

Configure Network Devices
Password Configuration
Most network devices have a web portal that can be accessed by commonly known
default passwords. All network devices should have the default passwords changed. Make
sure that passwords (and other sensitive information) is encrypted (this includes enabling
HTTPS, for instance).
Always change the default passwords for networking equipment.

1

Logging Configuration
Many network devices support forwarding logs to a SYSLOG or SIEM server. If available
configure network devices to forward logs.

1

Note that this is a requirement for IEC 62443-2-4 and must be configured, validated andtested during FAT/SAT and maintenance sessions.

2

Disable Unused Ports
Network devices should be configured to disable any unused ports. A port is consideredunused if a device is not actively connected. For instance, a port that is connected to awall outlet with no device connected is considered unused (connectivity to a wall outlet
does not justify the port being in use).

2

3

OT Firewall Configuration
Analyze each layer of the network to determine the protocols and ports that should beallowed. For instance, a firewall embedded in switchgear may only need to pass Modbus
traffic on TCP port 502. In addition to port rules, consider adding source IP addresses tothe rules (for instance allow port 502 to be accessed only from the source IP that belongs
to the Power Operation server). This helps prevent simple packet injection (but does notcompletely mitigate it due to the ability to spoof IP addresses). Full mitigation will requiretransport encryption such as VPN connection.

3

4

5

6

4

Deep Packet Inspection
Many OT firewalls support Deep Packet Inspection (DPI) for popular ICS protocols (suchas Modbus, DNP3 and IEC 61850). For heightened security, consider adding rules tothe switchgear firewall that filter bases on Modbus address range and function code (inaddition to source IP and port). A rule, for instance, could allow traffic from a specific IP
address on port 502 with a Modbus Read command on registers 4001-4002. Refer to thefirewall documentation for information on specific DPI features and configuration.

5

IDS Integration
Some OT firewalls support the ability to react to alerts from an intrusion detection system.
If available, follow the firewall and IDS documentation to configure the firewall to react toan event by appropriately tightening the rules.

44

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System- Technical Guide

6

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide45

www.schneider-electric.com

Bibliographywww.se.com

Useful Documentation
Design Guide
Digital Applications for Large Buildings and Critical Facilities
The Digital Applications Design Guide provides comprehensive
details on the building blocks of EcoStruxureTM Power: the IoT
applications are driven by a software layer to control the traditional
electrical distribution infrastructure. Developed to help engineering
consultants and designers, this guide is an invaluable resource for
specifying, designing and prescribing EcoStruxureTM Powerarchitectures capable of performing one or more of the businessdriven applications described within.

Useful Documentation .......................................................... p. 47

EcoStruxure™ Power Design Guide for North America
Ref: 0100DB1802R11/20
11/2020https://download.schneider-electric.com/files?p_Doc_
Ref=0100DB1802

System Guides
EcoStruxure™ Power Monitoring Expert 2021
Power Monitoring Expert system design, deployment and usage.
System Guide
Ref: 7EN02-0445
PowerMonitoringExpertSysGuide
05/2021https://www.se.com/ww/en/download/document/7EN02-0445//

EcoStruxure™ Power Operation 2021 with Advanced Reporting and
Dashboards
Power Operation system design, deployment and usage.
System Guide
Ref: 7EN02-0462-00
PowerOperationSystemGuide
07/2021https://www.se.com/ww/en/download/document/7EN02-0440/

46

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide47

www.se.com

Useful Documentation
Certificates
EcoStruxure™ Power Monitoring Expert
PME Cybersecurity IEC 62443 Certificate
Certificate
01/2019https://www.se.com/us/en/download/document/cybersecurity/

EcoStruxure™ Power System for Large & Critical Facilities
ESXP Certificate - IEC 62443-3-3 Large & Critical Architecture
Certificate
07/2021https://www.se.com/us/en/download/document/EcoStruxure/

Green PremiumTM

An industry leading portfolio of offers delivering sustainable value
The Green Premium program stands for our commitment to delivercustomer valued sustainable performance. It has been upgradedwith recognized environmental claims and extended to cover all
offers including Products, Services and Solutions.
CO2 and P&L impact through… Resource Performance

EcoStruxure™ Power Operation
Power Operation 2021 IEC 62443 SL2 Certificate
Certificate
08/2021https://www.se.com/us/en/download/document/IEC62443/

More than 75% of our
product sales offer superiortransparency on the material
content, regulatory informationand environmental impact ofour products:••••

RoHS compliance
REACh substance information
Industry leading # of PEP’s*
Circularity instructions

Green Premium brings improved resource efficiency throughout an asset’s
lifecycle. This includes efficient use of energy and natural resources, alongwith the minimization of CO2 emissions.

Cost of ownership optimization through… Circular Performance
We’re helping our customers optimize the total cost of ownership of theirassets. To do this, we provide IoT-enabled solutions, as well as upgrade,
repair, retrofit, and remanufacture services.

Peace of mind through… Well-being Performance
Green Premium products are RoHS and REACh compliant. We’re going
beyond regulatory compliance with step-by-step substitution of certain
materials and substances from our products.

Improved sales through… Differentiation
Discover what wemean by green
Check your products!

48

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

Green Premium delivers strong value propositions through third-party
labels and services. By collaborating with third-party organizations we can
support our customers in meeting their sustainability goals such as green
building certifications.

*PEP: Product Environmental Profile (i.e. Environmental Product Declaration)

www.se.com

Legal informationwww.se.com

Notes

The Schneider Electric brand and any registered trademarks of Schneider Electric Industries SAS referred
to in this guide are the sole property of Schneider Electric SA and its subsidiaries. They may not be used for any
purpose without the owner's permission, given in writing. This guide and its content are protected, within themeaning of the French intellectual property code (Code de la propriété intellectuelle français, referred to hereafteras "the Code"), under the laws of copyright covering texts, drawings and models, as well as by trademark law.
You agree not to reproduce, other than for your own personal, non-commercial use as defined in the Code,all or part of this guide on any medium whatsoever without Schneider Electric's permission, given in writing.
You also agree not to establish any hypertext links to this guide or its content. Schneider Electric does not grant
any right or license for the personal and non-commercial use of the guide or its content, except for a nonexclusive license to consult it on an "as is" basis, at your own risk. All other rights are reserved.
Electrical equipment should only be installed, operated, serviced and maintained by qualified personnel.
No responsibility is assumed by Schneider Electric for any consequences arising out of the use of this material.
As standards, specifications and designs change from time to time, please ask for confirmation of the information
given in this publication.

50

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide51

www.se.com

Notes

Schneider Electric USA, Inc.
800 Federal Street
Andover, MA 01810 USA
888-778-2733
www.se.com

As standards, specifications, and designs change from time to time,please ask for confirmation of the information given in this publication.
10/2021
ESXP2TG003EN©2021 Schneider Electric. All Rights Reserved. Life Is On Schneider Electric is
a trademark and the property of Schneider Electric SE, its subsidiaries and affiliatedcompanies. All other trademarks are the property of their respective owners.

52

EcoStruxureTM Power Guide for Designing and Implementing a Cyber Secure Digital System - Technical Guide