Introduction
Our platform caters to mission-critical systems in the Energy sector. It meets NERC standards to provide a stable, secure infrastructure from HMI to IoT. This section delves into key features.
On this page:
Security Highlights
Security and Reliability
We prioritize stability and security throughout our platform's design, from technology selection to module architecture.
Easy Configuration and Maintenance
Our platform offers secure, straightforward configuration and maintenance for various scenarios, ensuring scalability and consistency.
Operational Stability
Our platform's 100% managed code implementation guarantees operational stability, featuring robust exception handling and seamless failure recovery.
Redundancy and Availability
For high availability, our platform offers redundancy with a proven hot standby system for real-time databases, alarms, and historians, catering to diverse network setups.
NERC
The platform was designed according to the applicable recommendations from NERC CIP, such as CIP-007-1—Cyber Security-System Management.
Listed below and described are some security-related features available in the product:
· Access Control: Security technique that regulates who or what can view or use resources in a computing environment.
· Password Encryption: The system administrator does not possess access to the user's password, which is encrypted before being stored.
· Maximum and Minimum Age for Password: A feature that imposes a minimum password age before allowing its change and a maximum age before expiring.
· Required Password changing: The user must alter his password after the first login.
· Username and Password Minimum Length: Establishes minimum requirements for passwords.
· Block on Invalid Login Attempt: Blocks User after reaching maximum invalid logins attempted.
· Store Password History: A range of the last 0-5 passwords can be stored to ensure the User does not repeat an already used one.
· Auto Log Off: The user is logged off the system for inactivity or expiration date.
· Audit Trail Data: Security-relevant chronological record, a set of records that provide documentary evidence of the sequence of activities that have affected a specific operation at any time.
For additional information on NERC CIP-007-1 - Cyber Security-System Management, go to NERC CIP Overview.
Built-in .NET Security
Action.NET development is built on the .NET framework, following strict security protocols. Each module adheres to specific guidelines aligned with its function, such as adherence to standards like IEC61850 for modules handling electrical device communications.
Below are the main security topics, along with essential details about each.
Security at the Core Level
Security implementation is ingrained at the core level rather than being applied externally. The platform's modules incorporate built-in security components designed from their very core.
For more detailed insights into .NET security, refer to Microsoft's documentation, available at Microsoft .NET Security Information.
Communication Security
Communication between modules
Cryptography plays a crucial role in securing communication between external modules and TServer, encompassing processes such as ScriptTaskServer, DataAccess, Devices, TRichClient, SmartClient, ModuleInfo, TraceWindow, and PropertyWatch. Two primary classes are employed for this purpose:
a) System.Security.Cryptography.RSACryptoServiceProvider (Asymmetric, KeySize: 1024): Facilitates asymmetric encryption and decryption utilizing the RSA algorithm implementation provided by the cryptographic service provider (CSP).
b) System.Security.Cryptography.Rijndael (KeySize: 256): Utilized for encryption and decryption, Rijndael operates with a key size of 256 bits.
It's essential to note:
External programs can only access TServer after undergoing validation/authentication. TServer responds to external requests only following validation/authentication, accomplished through user/password authentication or Windows Authentication.
"RSACryptoServiceProvider" generates private/public keys, while "Rijndael" handles the encryption/decryption process, leveraging those above private/public keys.
Data compression is employed only if the block size exceeds 16000 bytes, utilizing the GZIP compression method. The ModuleInformation feature offers estimated values for each connection, considering that WCF may introduce additional bytes during data transmission.
".NET Framework applications should utilize the TLS version supported by the operating system (OS)." FactoryStudio does not manually configure the TLS version but relies on the OS's configuration.
Remote access via WebAccess services (third-party programs or modules) consumes available web services via HTTP or HTTPS.
Communication with web clients
HTML5 provides flexibility in choosing between "http" or "https/ssl" protocols. You can configure compression settings like GZIP on the IIS server. Moreover, you can implement custom authorization methods, such as IP filtering or location-based authentication, along with mandatory session settings.
Secure WebGateway
The TWebGateway is crucial to our platform, enabling smooth data transfer across different security network zones. It bridges data from lower levels, like the factory floor (Level 2), to higher levels, such as the enterprise (Level 4).
The TWebGateway acts as a protective barrier, shielding internal networks from insecure traffic. Enterprises rely on it to guard employees and users against potential threats from malicious web traffic, websites, viruses, and malware.
Files and Execution Protection
License/Softkey
The "License/Softkey" feature employs the .NET class System.Security.Cryptography.Rijndael, utilizing symmetric encryption with a key size of 256 bits.
Digital signature
All assemblies created by Spin Eng are signed digitally.
Project format (Configuration protection)
All project settings, including security measures like cryptography, power recovery, and user/password protections, are stored in a relational database (.dbsln file). This file also contains the source code and compiled binaries for Scripts and Displays. This centralized storage method streamlines project management and deployment, making access and maintenance easier.
User Authentication and Permissions
User Authentication
Our platform offers integration with various systems for user authentication:
Microsoft Active Directory and Windows Authentication
LDAP server connection
Built-in Users Database
External databases or user authentication servers
Active-Directory / Windows Authentication
Enabling Windows Authentication bypasses the project's configured user list, relying on Windows policies instead. Windows manages user authentication directly, utilizing the currently logged-in Windows user for system access.
LDAP
When LDAP is used, the project ignores its configured user list and relies on policies managed by Windows and the LDAP Server. Authentication is handled by both Windows and the LDAP Server, with the external user logged into the LDAP Server being utilized within the system.
Runtime Users
The system dynamically generates users and stores their credentials in SQL databases. It integrates with Active Directory or third-party systems to retrieve users, enabling integrated security and unified login capabilities.
Roles, Permission and Policies
Group and User Permissions
Our users can define privileges based on groups or specific individuals. Permissions can be set globally or linked to particular displays, objects, or input actions, offering granular control over access levels.
User Policies
Our platform offers a comprehensive array of user management features, including identification policies, session duration control, automated logoff mechanisms, electronic signature capabilities, and robust audit trail functionality.
Database Injection Protection
There is a significant concern about SQL injection in database operations involving stored procedures. SQL injection can occur if parameters are passed as plain text within SQL statements, which could allow malicious code to be executed. To prevent this, we use the .NET API, where parameters are added to a command object’s parameter list. This approach makes SQL injection impossible by safely handling user input.
Security External Validation
Veracode or third-party companies regularly access the platform for penetration testing reports, gap analysis, and various other topics.
Any issues that would prevent a 100% approval are corrected.