Firmware signatureEvery CPU firmwareis signed by Siemens. The CPU checks this signature at everyfirmwareupdate. If the firmware signature verification fails, thefirmware is not uploaded to the CPU. Thisensures protection againstmanipulated firmware updates.2.5 Additional CPU protectionmeasuresThe following measures additionally increase the protectionagainst unauthorized access tofunctions and data on the S7 CPU,both externally as well as over the network:• Disable or restrictthe web server• Disable PUT/GET communication(S7-1200(V4)/S7-1500)• Disable time synchronization via NTPserverNote These functions are disabled by default in the modules'default configurations.Security functions for the web serverThe webserver allows you to remotely control and monitor the CPU via acompany's internalintranet. This allows evaluation and diagnosticsto be carried out remotely.However, enabling the web server canincrease the risk of unauthorized access to the CPU.If you wish toenable the web server, the following measures are recommended forprotectingthe CPU:• Access via the secure transmission "https"transmission protocol• Configurable user and function privilegesvia user list– Create users– Define execution rights– AssignpasswordsUser management grants users exclusively the options thatare assigned to executionrights. If a user is configured, theuser's password grants access to the web pages inaccordance withthe user's access rights.A user with the name "Jeder" [German:Everyone] has been preconfigured. This user hasminimal accesspermissions (write-protected access to Intro and Start page). The"Jeder"user has been set without a password and cannot bemodified.Disable PUT/GET communication (S7-1200(V4)/S7-1500)The CPUcan act as a server for a number of communication services. Othercommunicationparticipants can access CPU data even if you do notconfigure or program any CPUconnections. This renders the localCPU, in its role as a server, incapable of controllingcommunicationwith the clients.You can use the "Connection mechanisms" parameterin the "Protection" area of the CPUparameters to set whether thistype of communication is permissible for the local CPU whileinoperation.By default, the option "Allow access via PUT/GETcommunication from remote partners" isdisabled. Read and writeaccess to CPU data is only possible with communicationconnectionsthat require configuration/programming not only for thelocal CPU but also for thecommunication partner. Access operations,such as those via BSEND/BRCV instructions, arepossible.Connectionsfor which the local CPU is only a server (i.e. for the local CPU,noconfiguration/programming has been carried out for thecommunication to the communicationpartner) are this not possiblewhen the CPU is in operation. Examples of such connectionsinclude:2Security mechanisms on the S7 CPUSecurityArticle ID: 90885010,V3.0, 11/2022 26© Siemens AG 2022 All rights reserved• PUT/GET,FETCH/WRITE or FTP access operations via communication modules.•PUT/GET access from other S7 CPUs• HMI access operationsimplemented via PUT/GET communicationIf you wish to allowclient-side access to CPU data, i.e. if you do not wish to restrictthe CPU'scommunication services, then enable the option "Allowaccess via PUT/GET communicationfrom remote partners".3 Securitymechanisms on the S7 CPsSecurityArticle ID: 90885010, V3.0, 11/202227© Siemens AG 2022 All rights reserved3 Security mechanisms on theS7 CPsThe chapters below show which security mechanisms are offeredby the SIMATIC S7 CPs (CPx43-1 Advanced V3 and CP 1x43-1).NoteThefunctions in the CP 1543-1 are configurable as of STEP 7Professional V12 incl. Update1.The CP 1243-1 requires at least STEP7 Professional V13 Update 3.Figure 3-1 Types of CPsCP 1543-1 CP1243-1 CP 343-1AdvancedCP 443-1Advanced3.1 Stateful inspectionfirewallDescriptionThe filtering performance of a packet filter canbe greatly improved by checking the IP packetsin their respectivecontext. For example, it is desirable to let in a UDP packetinbound from anexternal computer only if another UDP packet wasrecently sent out to the same computer (e.g.in the event of a DNSquery sent from a client in the internal network to an externalDNSserver). To enable this feature, the packet filter on allcurrent connections must be able tomanage a status. Packet filterswith this capability are thus referred to as"stateful".PropertiesStateful inspection firewalls have thefollowing properties:• With TCP connections: Emulation of statusinspection of a full TCP/IP protocol stack.• With UDP connections:Simulation of virtual connections.• Generation and deletion ofdynamic filter rules.3 Security mechanisms on the S7CPsSecurityArticle ID: 90885010, V3.0, 11/2022 28© Siemens AG 2022All rights reserved3.2 Data encryption via VPNDescriptionA VPN(virtual private network) refers to a private network that uses apublic network (e.g.the internet) as a transit network to transmitprivate data to a private destination network.The networks do notneed to be compatible with one another for this.While VPNs use theaddressing mechanisms of the transit network to work, they usetheirown network packets to separate the transport of private datapackets from the others. Thisfact allows the private networks toappear as a contiguous logical (virtual) network.IPSecAn importantaspect of data communication across network boundaries is IPSec(IPsecurity). It is a standardized protocol suite that allows forvendor-agnostic, secure andprotected data exchange over IPnetworks. The essential aim of IPSec is to secure andsafeguard dataduring transmission into an unsecure network. All knownvulnerabilities,such as eavesdropping and modification of datapackets, can be prevented using thissecurity standard. This is madepossible through encrypted data packets and authenticationofparticipants.3.3 NAT/NAPT (address translation)DescriptionNetworkAddress Translation (NAT) and Network Address Port Translation(NAPT) areprotocols for translating private IP addresses intopublic IP addresses.Address translation with NATNAT is a protocolfor translating between two address spaces. Its primary function isto translatepublic addresses, that is, IP addresses used and routedin the public internet, into private IPaddresses and viceversa.This technique allows for addresses in the internal networkto be hidden from the outside in theexternal network. The internalnodes are only visible in the external network via the externalIPaddresses defined in the address translation list (NATtable).Traditional NAT is a 1:1 translation, i.e. one private IPaddress is translated to one public one.The address by which aninternal node is reached is thus an external IP address.The NATtable contains a mapping between private and public IP addresses,and is configuredand managed in a gateway or router.Addresstranslation with NAPTNAPT is a variant of NAT and the two are oftenequated with one another. The difference toNAT is that with thisprotocol, ports can also be translated.There is no longer a 1:1translation of IP addresses. Rather, there is only one public IPaddresswhich is translated into a series of private IP addressesthrough the addition of port numbers.The address by which aninternal node is reached is an external IP address with a portnumber.The NAPT table contains a mapping from external ports to theprivate IP addresses, includingport number; it is configured andmanaged in a gateway or router.3 Security mechanisms on the S7CPsSecurityArticle ID: 90885010, V3.0, 11/2022 29© Siemens AG 2022All rights reserved3.4 Secure IT functions3.4.1 File TransferProtocol (FTP)DescriptionThe File Transfer Protocol is a specificnetwork protocol used for data transmission between anFTP serverand FTP client or, when client-driven, between two FTP servers.FTPallows data to be exchanged and folders created, renamed ordeleted. Communicationbetween an FTP client and FTP server takesplace in the form of an exchange of text-basedcommands. Eachcommand sent by the FTP client induces a response from the FTPserver inthe form of a status code and a message in cleartext.FTPcreates two logical connections for this purpose: one controlchannel via port 21 fortransmitting FTP commands (and the responsesthereto), and one data channel via port 20 fortransmittingdata.With passive FTP, both channels are initiated by the FTPclient, while with active FTP one of thechannels is initiated bythe FTP server.Solution for secure FTPTo protect data duringtransmission, FTP also has the capability of data encryptionandauthentication.The simplest method of implementing a secure FTPconnection is Transport Layer Security, orTLS (formerly SecureSockets Layer, or SSL). TLS is located on the Presentation Layer oftheOSI layer model. Here, the data stream is encrypted with a keyat the lowest bit level at the startof a connection.The TLShandshake protocol is used for identification and authentication ofthe participants.Negotiation of an encryption key takes placethrough the public key method. To this end, theFTP server sends theFTP client a certificate with its public key. The public key to thecertificatemust be certified before the fact by a certificateauthority and provided with a digital signature.FTPSThe explicitFTP for secure data transmission is a combination of FTP and theTLS protocols. Ituses the same ports as in normal FTP mode (port20/21).The key for TLS is a certificate that is generated andshipped with the configuration of thesecurity CPs.Secure FTP datatransfer with the CP x43-1 Advanced V3 and CP 1x43-1 is onlypossible withsecurity function enabled, and is explicitly requiredin the CP configuration.3 Security mechanisms on the S7CPsSecurityArticle ID: 90885010, V3.0, 11/2022 30© Siemens AG 2022All rights reserved3.4.2 Network Time Protocol (NTP)DescriptionTheNetwork Time Protocol (NTP) is a standardized protocol for timesynchronization onmultiple computers/modules via the network. Itsaccuracy is in the millisecond range.The clock time is provided toNTP clients by an NTP server.NTP (secure)Secure NTP allows forsecure and authenticated time synchronization utilizingauthenticationmethods and a shared encryption code. The NTP serverand the NTP clients must support thisfunction.Secure timesynchronization is supported by the CP x43-1 Advanced V3 and CP1x43-1 as longas the security function and the advanced NTPconfiguration are explicitly enabled in the CP'sconfiguration inSTEP 7.3.4.3 Hypertext Transfer Protocol (HTTP)DescriptionTheHypertext Transfer Protocol (HTTP) belongs to the family ofinternet protocols and is astandardized method of transmitting dataon a network. HTTP is preferred for loading webpages from a webserver on a web browser.HTTPSData transmitted over HTTP arereadable as cleartext and can be eavesdropped by thirdparties.Todaymore than ever – in the age of online banking, online shopping andsocial networks – it isimportant that confidential and private databe transmitted safely and away from the eyes ofunauthorizedparties.The easiest method of tap-proof transmission is HypertextTransfer Protocol Secure (HTTPS).HTTPS is structured like HTTP, butit always uses the TLS protocol for encryption.3 Securitymechanisms on the S7 CPsSecurityArticle ID: 90885010, V3.0, 11/202231© Siemens AG 2022 All rights reserved3.4.4 Simple NetworkManagement Protocol (SNMP)DescriptionSNMP (Simple NetworkManagement Protocol) is a UDP-based protocol that wasdefinedspecifically for the administration of data network. It hasbecome established as the de factostandard in TCP/IP devices. Theindividual nodes in the network (network components or enddevices)are equipped with a so-called SNMP agent that provides informationin structured form.This structure is called MIB, or ManagementInformation Base. The agent in the network node istypicallyimplemented as a firmware functionality.Management Information Base– MIBAn MIB (Management Information Base) is a standardized datastructure made up of differentSNMP variables and written in alanguage that is independent of the target system. Thanks tothecross-vendor standardization of MIBs and the access mechanisms,even a heterogeneousnetwork with components from differentmanufacturers can be monitored and controlled. Ifcomponent-specificdata and non-standardized data are needed for the networkmonitoring,these can be described by manufacturers in so-called"Private MIBs".Secure SNMP (SNMPv3)SNMP is available in differentversions: SNMPv1, SNMPv2 and SNMPv3. SNMPv1 areSNMPv2 still in useto some extent. However, SNMPv1 and SNMPv2 should not beusedbecause these versions implement limited or no securitymechanisms unless other securitymechanisms have been implemented(e.g. the cell security concept). From version 3 onward,SNMPadditionally offers user management with authentication as well asoptional encryption ofdata packets. This aspect greatly increasedthe security of SNMP. Secure SNMP is supportedby the CP x43-1Advanced V3 and CP 1x43-1 if the security function and SNMPv3 havebeenexplicitly enabled in the configuration of the CP in STEP 7.4AppendixSecurityArticle ID: 90885010, V3.0, 11/2022 32© Siemens AG2022 All rights reserved4 Appendix4.1 Service and supportIndustryOnline SupportDo you have any questions or need assistance?SiemensIndustry Online Support offers round the clock access to our entireservice and supportknow-how and portfolio.The Industry OnlineSupport is the central address for information about our products,solutionsand services.Product information, manuals, downloads,FAQs, application examples and videos – allinformation isaccessible with just a few mouseclicks:support.industry.siemens.comTechnical SupportThe TechnicalSupport of Siemens Industry provides you fast and competent supportregardingall technical queries with numerous tailor-made offers–ranging from basic support to individual support contracts. Pleasesend queries to TechnicalSupport via Webform:siemens.com/SupportRequestSITRAIN – Digital Industry AcademyWesupport you with our globally available training courses forindustry with practicalexperience, innovative learning methods anda concept that’s tailored to the customer’s specificneeds.For moreinformation on our offered trainings and courses, as well as theirlocations and dates,refer to our webpage:siemens.com/sitrainService offerOur range of services includesthe following:• Plant data services• Spare parts services• Repairservices• On-site and maintenance services• Retrofitting andmodernization services• Service programs and contractsYou can finddetailed information on our range of services in the servicecatalog web page:support.industry.siemens.com/cs/scIndustry OnlineSupport appYou will receive optimum support wherever you are withthe "Siemens Industry Online Support"app. The app is available foriOS and Android: