earth_america
user_standard Log on
action_search_stroke
earth_america
Log on to rate and give feedback 1 2 3 4 5 Log on to rate
0
Concept

Concept


Products: AS-B, Device Administrator, Enterprise Central, Enterprise Server, ​License Administrator, ​License Server, AS-P, Software Administrator
Functionalities: Security
Product version: 2024, 7.0
12/3/2024

EcoStruxure Building Operation Software and EcoStruxure BMS Servers

arrow1_rotationIdentification and Authentication arrow1_rotationAuthorization arrow1_rotationConfidentiality arrow1_rotationIntegrity arrow1_rotationRestricted Data Flow arrow1_rotationTimely Response to Events arrow1_rotationResource Availability arrow1_rotationSemantic Database Password Update

These hardening guidelines applies to the EcoStruxure Building Operation software products and the EcoStruxure BMS server products.

Identification and Authentication

Admin logon password management

  • Ensure default admin account use is absolutely minimized. All users should have a unique user account.

For more information, see Administration Accounts in EcoStruxure BMS Server Local Domain .

Certificate functionality

  • Ensure trusted self-signed or Certification Authority certificates are used.

  • Ensure there is a process in place for maintenance and renewal of certificates.

For more information, see Certificates .

Password policies can be enforced

  • Ensure password policies are configured according to customer needs.

For more information, see Password Policy .

The following settings are recommended:

  • The minimum number of hours between password changes is 0.

  • A password expires after 90 days.

  • The password history is set to 6.

  • At least 3 characters need to be different in the new password.

  • A password contains at least 8 characters.

  • A password contains at least 1 lowercase character.

  • Uppercase characters are not required in a password.

  • A password contains at least 1 numeric character.

  • The numeric character can be the first or last character, such as "123password".

  • A password contains at least 1 special character: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~´.

  • The special character can be the first or last character, such as "password!".

Disabled after failed logon attempts

  • Ensure the setting for temporarily disabling users after failed logon attempts is configured as required by the customer. This limits the risk for Denial of Service situations and brute-force attacks.

For more information, see Domain – Policies Tab .

Password blocklist

  • You can block the use of certain easy-to-guess passwords. A default list is loaded from the factory. For adding more passwords to the blocklist, contact Schneider Electric.

Enterprise Server Run-As-Service selectable user account

Ensure the EcoStruxure Building Operation service runs under a custom account with permissions designed to be as limited as possible.

For more information, see Installing the Enterprise Server .

Use of strong authentication hash algorithms

  • Ensure MD5 hashing is disabled.

For more information, see Encrypted Communication .

Authorization

Custom logon banner

  • Ensure the security banner is enabled and convey any custom terms applicable for the users to access the system.

For more information, see Security Banner  .

Role-based access control (permissions)

  • Ensure the access control scheme is carefully planned and implemented.

For more information, see Software Permissions Management .

  • Ensure processes are in place to regularly inspect the account management configuration.

For more information, see Software Permissions Management .

Object and point level security

  • Ensure the object, point and command level permissions are implemented to provide the least possible rights for the respective roles.

For more information, see Software Permissions .

  • Ensure processes are in place to regularly inspect the account management configuration.

For more information, see Software Permissions Management .

Confidentiality

Encrypted transmission of data

  • Ensure HTTP is disabled, and that TLS 1.3 is used.

For more information, see Encrypted Communication .

SMTPS secure email notification support

  • Ensure email transmission uses secure options.

For more information, see Selecting and Specifying an Email Server for Email Notifications .

Clickjacking protection options

  • Ensure that the embedding of third-party web sites is disabled and that the hosting of EcoStruxure Building Operation web pages within other pages is disabled.

For more information, see Security Configuration in WebStation .

  • Ensure unsafe Javascript constructions are disabled.

For more information, see Enabling WebStation to Use Unsafe JavaScript Methods .

Protection of data storage

  • Ensure the EcoStruxure Building Operation installation folders and data storage folders on the hosting Microsoft Windows operating system are protected from Windows user accounts that interactively log on to Windows.

For more information, see operating system documentation.

External Log Storage

  • Ensure the TimescaleDB/PostgreSQL installation folders and data storage folders are adequately protected and that the deployment is hardened appropriately.

www.enterprisedb.com/blog/how-to-secure-postgresql-security-hardening-best-practices-checklist-tips-encryption-authentication-vulnerabilities

  • Ensure separate accounts are used for third-party access of the External Log Storage, In particular, you want to separate the account that EcoStruxure Building Operation is using to access the database.

  • Ensure encrypted communication is used between EcoStruxure Building Operation servers and TimescaleDB/PostgreSQL.

For more information, see External Log Storage Encrypted Communication Workflow .

OPC UA

  • Ensure that OPC UA servers are configured to only communicate with appropriate encryption methods.

For more information, see the documentation for the respective OPC UA servers.

Integrity

Auto logoff

  • Ensure inactivity logoff is activated with a sufficiently low timeout.

For more information, see Automatic Logoff .

Audit log with system-wide synchronized timestamps

  • Ensure all servers have accurate configuration of NTP time synchronization.

    Configuration of NTP is done in the EcoStruxure Building Operation software, except for the FDP server where the configuration is done in EcoStruxure Fire Expert.

For more information, see Network Time .

For more information, see O1891 EcoStruxure Fire Expert - Configuration Manual .

For more information, see Audit Trailing of User Activity .

Clickjacking protection options

  • Ensure that the embedding of third-party web sites is disabled and that the hosting of EcoStruxure Building Operation web pages within other pages is disabled.

For more information, see Security Configuration in WebStation .

  • Ensure unsafe Javascript constructions are disabled.

For more information, see Enabling WebStation to Use Unsafe JavaScript Methods .

Protection of data storage

  • Ensure the EcoStruxure Building Operation installation folders and data storage folders on the host Microsoft Windows operating system are protected from Windows user accounts that interactively log on to Windows.

For more information, see operating system documentation.

Secure boot

  • Ensure that you use Secure Boot versions of server hardware and edge servers.

Basic protection against program and data at rest modification

  • Ensure Compliance Pack is activated, change control is enabled and the appropriate settings are deployed in accordance with customer requirements.

For more information, see Change Control .

Document Policy

  • Ensure that only appropriate document types are enabled. Disable document types that are not needed.

For more information, see Document Policy .

Restricted Data Flow

Basic capabilities for network segmentation

  • Ensure network design is planned and implemented according to current guidelines and best practices.

For more information, see Guidance on Implementing a Cybersecure BMS Architecture with EcoStruxure Building Operation . on the Schneider Electric website .

Basic options for enabling/disabling ports

  • Ensure HTTP is disabled.

For more information, see Encrypted Communication .

  • Ensure USB ports are disabled.

    The USB ports on the FDP server cannot be disabled.

For more information, see Disabling the USB Port on an Automation Server  .

  • Ensure the SSH access is configured according to minimum needs.

    The FDP server SSH access cannot be configured and is only used during the firmware upgrade.

For more information, see Disabling Port 22 on an Automation Server .

  • For EcoStruxure BMS servers with no need for secondary Ethernet access, ensure Ethernet 2 Port is disabled.

For more information, see Disabling the Ethernet 2 Port .

  • Ensure the EcoStruxure Web Services server interface is disabled.

For more information, see EcoStruxure Web Service Server .

Firewall

  • Ensure the firewall in EcoStruxure BMS servers and Enterprise servers are configured appropriately.

For more information, see Firewall .

For more information, see Microsoft Windows documentation.

Timely Response to Events

Audit log access

  • Ensure a SIEM system is in place and that remote logging is enabled.

For more information, see Field Server Remote System Logging .

  • Ensure web server access logging is enabled and that there is an inspection process in place.

For more information, see Web Server Access Logging .

Resource Availability

System backup, recovery and reconstitution

  • Ensure backup functionality is properly configured and tested.

For more information, see Backup and Restore Overview .

  • Ensure processes are in place for continuous testing of recovery processes.

Access to network and security configuration settings

  • Ensure that networking guidelines are followed.

For more information, see Guidance on Implementing a Cybersecure BMS Architecture with EcoStruxure Building Operation . on the Schneider Electric website .

For more information, see Software Permissions .

Semantic Database Password Update

For security reasons, change the password for the admin user on the semantic database. Changing the password of the admin user on the semantic database helps to protect the database. If the password is not changed the Ecostruxure Building Operation generates a system alarm.

For more information, see Configure EcoStruxure Building Automation System to use Semantic Workflow .

See Also

  • Administration Accounts in EcoStruxure BMS Server Local Domain
  • Certificates
  • Domain – Policies Tab
  • Installing the Enterprise Server
  • Encrypted Communication
  • Security Banner 
  • Software Permissions Management
  • Software Permissions
  • Selecting and Specifying an Email Server for Email Notifications
  • Security Configuration in WebStation
  • Enabling WebStation to Use Unsafe JavaScript Methods
  • External Log Storage Encrypted Communication Workflow
  • Automatic Logoff
  • Audit Trailing of User Activity
  • Network Time
  • Change Control
  • Document Policy
  • Disabling the USB Port on an Automation Server 
  • Disabling Port 22 on an Automation Server
  • Disabling the Ethernet 2 Port
  • EcoStruxure Web Service Server
  • Firewall
  • Web Server Access Logging
  • Field Server Remote System Logging
  • Backup and Restore Overview
  • Configure EcoStruxure Building Automation System to use Semantic Workflow