Recommended Security Guidelines from Rockwell Automation

Question

What are the recommended security guidelines from Rockwell Automation?

Answer

This article is a summary of recommended security best practices to be implemented, when possible, when using Rockwell Automation products. This article will be updated as needed.

Network-based Vulnerability Mitigations for Embedded Products

Utilize proper network infrastructure controls to help ensure that unused or unnecessary protocols from unauthorized sources are blocked. For more information on TCP/UDP ports and protocols used by Rockwell Automation Products, see Knowledgebase Article ID 898270 - TCPUDP Ports Used by Rockwell Automation Products.
Locate control system networks and devices behind firewalls, and isolate them from the business network.
Consult the product documentation for specific features, (e.g. hardware keyswitch settings) which may be used to block unauthorized changes, etc.
Block all traffic to EtherNet/IP or other CIP protocol-based devices from outside the Manufacturing Zone by blocking or restricting access to TCP and UDP Port# 2222 and Port# 44818 using proper network infrastructure controls, such as firewalls, UTM devices, or other security appliances.

Software/PC-based Mitigation Strategies

The following Software/PC Mitigations may be appropriate to include when the vulnerability is within a software product running on a PC:

Run all software as User, not as an Administrator, to minimize the impact of malicious code on the infected system.
Use of Microsoft AppLocker or other similar Whitelisting application can help mitigate risk. Information on using AppLocker with Rockwell Automation products is available at Knowledgebase Article ID 546989 - Using Rockwell Automation Software Products with AppLocker
Ensure that the least-privilege user principle is followed, and user/service account access to shared resources (such as a database) is granted with a minimum amount of rights as needed.

Social Engineering Mitigation Strategies

The following social engineering mitigations may be appropriate to include when the vulnerability has "User Interaction" as required:

Do not open untrusted .XXX files (such as .exe, .l5k, etc) with the software product of concern.
Do not click on or open URL links from untrusted sources.
Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.

Additional Mitigations

Use trusted software, software patches, antivirus/antimalware programs and interact only with trusted web sites and attachments.
Ensure that all control system devices and/or systems are not accessible from the Internet. For further information about the risks of unprotected Internet accessible control systems, please see Knowledgebase Article ID 494865 - Advisory on web search tools that identify ICS devices and systems connected to the Internet
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.
Visit Knowledgebase Article ID 35330 - Rockwell Software Products and Antivirus Software for information about Rockwell Software Products and Antivirus Software
Refer to our Industrial Network Architectures Page for comprehensive information about implementing validated architectures designed to complement security solutions.

Refer to the Network Services Overview Page for information on network and security services for Rockwell Automation to enable assessment, design, implementation and management of validated, secure network architectures.

Refer to Industrial Network Design Guides for full list of Converged Plantwide Ethernet (CPwE) Guides, including number on security-focused architecture:

Deploying Network Security within a Converged Plantwide Ethernet Architecture
Deploying Industrial Firewalls within a CPwE Architecture Design and Implementation Guide
Securely Traversing IACS Data Across the Industrial Demilitarized Zone (IDMZ)