
PAGE 16
Technologic® PPS Parallel Pump Controller
Bell & Gossett
SecurityRecommendationsforEnd-User
Technologic PPS Pump Controller is developed considering the security best practices. The following guidance
provides recommendation for secure operations, hardening and account management. In the table below:
Safeguards describe the security guidance, Security Context & Rationale provide overview of security features
and value of the security safeguard, and References provide additional resources for further investigation for
implementing the recommended safeguards.
Safeguard SecurityContext&Rationale References
Restrictphysicalaccess
•Ensurephysicalaccesstoassetsis
limited.Includephysicalisolationto
protecttheenvironmentandequipment
therein.
•Ensurestrictcontroloverphysicalaccess
inandoutofthefacility.
The communication ports have been hard-
ened to restrict access and ensure integrity
of device operations. This safeguard sup-
ports the ability to further limit exposure as-
sociated with physical threats to the device
such as rogue/malicious device joining the
Modbus RTU network over RS485 interface.
ATT&CK for ICS: M0801
NIST SP 800-53 Rev5: AC-3, PE-3
ISA/IEC 62443-3-3: SR 2.1
Ensurethatthedeviceisnotexposedto
internet,usingbelowrecommendations:
•Securethenetworkaccesstothedevice
usingVPNconnections.
•Implementrewall&denerulesto
protectdevicefromDenial-of-service
attempts.
•Protectthenetworkaddressinformation
ofdeviceusingNetworkAddress
Translation(NAT)technique.
This safeguard ensures that data and SCADA
controls are not exposed to internet. This
also helps in preventing Man-in-the-middle
attacks when the device is accessed via
Modbus over TCP/IP or BACnet IP.
We recommend using network segmen-
tation and segregation so that we can
minimize access to sensitive information for
those systems and people who don’t need
it, while ensuring that the organization can
continue to operate effectively.
ATT&CK for ICS: M0930
NIST SP 800-95
NIST SP 800-44 v2
ISA/IEC 62443-3-3: SR 5.1, SR 7.1
Ensurecybersecuritypolicies,awareness,
andtrainingtotheoperators,administra-
torsandotherpersonnel.
This safeguard prevents Social Engineering
attacks and promotes awareness related to
cybersecurity.
ATT&CK for ICS: M0917
NIST SP 800-53 Rev5: AT-2
ISA/IEC 62443-2-4: SP.01
Ensurepatchmanagementisdoneregu-
larlyandupdatedappropriately.
This safeguard prevents attacks related us-
ing components with known vulnerabilities.
Sometime vulnerabilities are discovered,
and we work with our partners to deploy
updates to security and resilience. This
safeguard mitigates exploitation risks and
ensures security patching
ATT&CK for ICS: M0951
NIST SP 800-53 Rev5: MA-2
ISA/IEC 62443-2-3
Ensurehardeningguidelinesare
implemented,onlydesiredportsand
servicesshouldbeopen,andRBAC
shouldbefollowed.
This safeguard helps in prevention of attacks
due to miscongurations or default congu-
rations.
ATT&CK for ICS: M0937, M0918, M0801
NIST SP 800-53 Rev5: AC-3(7), SC-7(5)
ISA/IEC 62443-3-3: SR 2.1, SR 5.1
Ensurestrongpasswordpolicyis
implementedanddefaultcredentials
shouldnotbeused,passwordsmustbe
changedperiodically.
This safeguard will help in prevention of
passwords and account takeover attacks.
ATT&CK for ICS: M0927
NIST SP 800-53 Rev5: IA-5
ISA/IEC 62443-3-3: SR 1.7
Conductback-upsofdevice-leveland
system-levelinformation.ForIPC102
drives,useDanfossMCT10SWtosave
theproject.ForTechnologicPPS,usethe
saveoptioninUsersetup(Service->File-
system)whichissavedandloadedwith
coldstartsorafterpowerfails.
The ability of up-to-date backups provides
for recovery from control system failures or
miscongurations. This provides systems
resilience, including against ransomware.
ATT&CK for ICS: M0953
NIST SP 800-53 Rev5: CP-9
ISA/IEC 62443-3-3: SR 7.3
Implementspecicinventory,logging
andmonitoringofhardwareandreport
security-relatedincidentstoXylemat
mightincludeunexpectedoperations,
conrmedtampering,ortheftofthe
device.
Devices are hardened and Xylem pro-
vides PSIRT to help customers investigate
potential security incidents. This safeguard
supports the ability to track assets and rec-
ognize potential security events.
ATT&CK for ICS: M0947
NIST SP 800-53 Rev5: SM-8
ISA/IEC 62443-3-3: SR 1.11, SR 2.8, SR 3.4
For additional information see references:
1. ATT&CK for ICS available online: https://collaborate.mitre.org/attackics/index.php/Mitigations
2. NIST SP 800-53 Rev 5 available online:
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
3. ISA/IEC 62443 standards available for purchase from ISA, IEC, or ANSI.