These hardening guidelines applies to the EcoStruxure Building Operation software products and the SpaceLogic SpaceLogic servers products.
Ensure default admin account use is absolutely minimized. All users should have a unique user account.
For more information, see Administration Accounts in EcoStruxure BMS Server Local Domain .
Ensure trusted self-signed or Certification Authority certificates are used.
Ensure there is a process in place for maintenance and renewal of certificates.
For more information, see Certificates .
Ensure password policies are configured according to customer needs.
For more information, see Password Policy .
The following settings are recommended:
The minimum number of hours between password changes is 0.
A password expires after 90 days.
The password history is set to 6.
At least 3 characters need to be different in the new password.
A password contains at least 8 characters.
A password contains at least 1 lowercase character.
Uppercase characters are not required in a password.
A password contains at least 1 numeric character.
The numeric character can be the first or last character, such as "123password".
A password contains at least 1 special character: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~´.
The special character can be the first or last character, such as "password!".
Ensure the setting for temporarily disabling users after failed logon attempts is configured as required by the customer. This limits the risk for Denial of Service situations and brute-force attacks.
For more information, see Domain – Policies Tab .
You can block the use of certain easy-to-guess passwords. A default list is loaded from the factory. For adding more passwords to the blocklist, contact Schneider Electric.
Ensure the EcoStruxure Building Operation service runs under a custom account with permissions designed to be as limited as possible.
For more information, see Installing the Enterprise Server .
Ensure MD5 hashing is disabled.
For more information, see Encrypted Communication .
Ensure the security banner is enabled and convey any custom terms applicable for the users to access the system.
For more information, see Security Banner .
Ensure the access control scheme is carefully planned and implemented.
For more information, see Software Permissions Management .
Ensure processes are in place to regularly inspect the account management configuration.
For more information, see Software Permissions Management .
Ensure the object, point and command level permissions are implemented to provide the least possible rights for the respective roles.
For more information, see Software Permissions .
Ensure processes are in place to regularly inspect the account management configuration.
For more information, see Software Permissions Management .
Ensure HTTP is disabled, and that TLS 1.3 is used.
For more information, see Encrypted Communication .
Ensure email transmission uses secure options.
For more information, see Selecting and Specifying an Email Server for Email Notifications .
Ensure that the embedding of third-party web sites is disabled and that the hosting of EcoStruxure Building Operation web pages within other pages is disabled.
For more information, see Security Configuration in WebStation .
Ensure unsafe Javascript constructions are disabled.
For more information, see Enabling WebStation to Use Unsafe JavaScript Methods .
Ensure the EcoStruxure Building Operation installation folders and data storage folders on the hosting Microsoft Windows operating system are protected from Windows user accounts that interactively log on to Windows.
For more information, see operating system documentation.
Ensure the TimescaleDB/PostgreSQL installation folders and data storage folders are adequately protected and that the deployment is hardened appropriately.
Ensure separate accounts are used for third-party access of the External Log Storage, In particular, you want to separate the account that EcoStruxure Building Operation is using to access the database.
Ensure encrypted communication is used between EcoStruxure Building Operation servers and TimescaleDB/PostgreSQL.
For more information, see External Log Storage Encrypted Communication Workflow .
Ensure inactivity logoff is activated with a sufficiently low timeout.
For more information, see Automatic Logoff .
Ensure all servers have accurate configuration of NTP time synchronization.
For more information, see Audit Trailing of User Activity .
For more information, see Network Time .
Ensure that the embedding of third-party web sites is disabled and that the hosting of EcoStruxure Building Operation web pages within other pages is disabled.
For more information, see Security Configuration in WebStation .
Ensure unsafe Javascript constructions are disabled.
For more information, see Enabling WebStation to Use Unsafe JavaScript Methods .
Ensure the EcoStruxure Building Operation installation folders and data storage folders on the host Microsoft Windows operating system are protected from Windows user accounts that interactively log on to Windows.
For more information, see operating system documentation.
Ensure that you use Secure Boot versions of server hardware and edge servers.
Ensure Compliance Pack is activated, change control is enabled and the appropriate settings are deployed in accordance with customer requirements.
For more information, see Change Control .
Ensure that only appropriate document types are enabled. Disable document types that are not needed.
For more information, see Document Policy .
Ensure network design is planned and implemented according to current guidelines and best practices.
For more information, see Guidance on Implementing a Cybersecure BMS Architecture with EcoStruxure Building Operation . on the Schneider Electric website .
Ensure HTTP is disabled.
For more information, see Encrypted Communication .
Ensure USB ports are disabled.
For more information, see Disabling the USB Port on an Automation Server .
Ensure the SSH access is configured according to minimum needs.
For more information, see Disabling Port 22 on an Automation Server .
For SpaceLogic servers with no need for secondary Ethernet access, ensure Ethernet 2 Port is disabled.
For more information, see Disabling the Ethernet 2 Port .
Ensure the EcoStruxure Web Services server interface is disabled.
For more information, see EcoStruxure Web Service Server .
Ensure the firewall in SpaceLogic servers and Enterprise servers is configured appropriately.
For more information, see Firewall .
For more information, see Microsoft Windows documentation.
Ensure a SIEM system is in place and that remote logging is enabled.
For more information, see Automation Server Remote System Logging .
Ensure web server access logging is enabled and that there is an inspection process in place.
For more information, see Web Server Access Logging .
Ensure backup functionality is properly configured and tested.
For more information, see Backup and Restore Overview .
Ensure processes are in place for continuous testing of recovery processes.
Ensure that networking guidelines are followed.
For more information, see Guidance on Implementing a Cybersecure BMS Architecture with EcoStruxure Building Operation . on the Schneider Electric website .
For more information, see Software Permissions .