
|11
2 Security Control Measures
Security control recommendations are provided hereby to avoid unauthorized external access that may
result in the following:
• Loss of system availability.
• Incorrect execution of controls causing damage to the plant, or theft or contamination of the
product.
• The capture, modification, or deletion and loss of data.
Caution: The caution warns you of possible damage to property and provides instructions to avoid
damage to MIWI350.
Recommendations:
• Use a state full firewall at the business network to restrict access from the business network to
process control network.
• Logically segment process control system networks into multiple segments (such as control
network, supervisory network, non-control system network, business network). Take steps to
implement and enforce physical security of devices in network.
• Logically and physically isolate control system networks from non-control system networks. The
network devices (e.g. switches, routers, firewalls) along with necessary access control and
routing policy can be used to logically isolate, prioritize the different network segment and/or
application traffic.
• Prohibit or restrict unnecessary network traffic into control system networks from non-control
system network and vice versa.
• Secure the communication through private VPN IPsec tunnel from the device/cellular network to
the remote MDM host.
• Use physical security for process control network systems. Take steps to implement and enforce
physical security of devices in network.
• Do not allow the use of unauthorized removable media near to the device installation.
• Use strong passwords on network equipment.
• Prevent the use of unauthorized laptops on the process control network.
• Ensure safe storage of installation media, license keys, and configuration information.
• The device must be physically protected in locked cabinets, and logically protected with
passwords to prevent tampering
• Secure the local LAN link from VPN gateway to host application within the premises
• The host machine and software should be protected by anti virus and Operating system patches.
• Restrict physical access to the device. Avoid access to local interfaces (RS232, Ethernet and USB
interfaces) of MODEM.
• Avoid using default credentials for cellular MODEM access. The user is strongly advised to
change the default password for device access. Also, the user is strongly advised to periodically
change the password of the device as per respective organization policies.
• Activate only required ports.
Apply ZoneProtection profiles to provide protection against entire zones from flood attacks and
DoS protection. This provides granular defense for specific systems, especially critical systems
2 Security Control Measures