Issue Customer requires guidance to secure a Modicon M580 system against unauthorized access, insecure communications, and cybersecurity threats. The controller or engineering environment may not be configured according to Schneider Electric cybersecurity recommendations. Resolution Apply the Modicon M580 cybersecurity baseline by: Enabling user authentication, role-based access control, and password policies. Using HTTPS and certificate-based authentication for secure engineering communications. Configuring Access Control List (ACL) and network segmentation to restrict access. Enabling Syslog and SNMPv3 for monitoring and auditing. Verifying firmware integrity and disabling unused Ethernet services. M580 Cybersecurity Solution                           For detailed information on Modicon M580 cybersecurity features, configuration settings, implementation guidance, and recommended best practices, please refer to the attached document. It provides comprehensive guidance for securing M580 systems and implementing Schneider Electric's recommended cybersecurity baseline. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue Cyber security defence is increasingly difficult in any Ethernet network-based architecture. Putting more layers of protection is a good strategy but knowing what has happened to a system is essential to any investigation of an incident. Analysing system logs is often the key to discovering what has happened during a forensic  examination. EcoStruxure Control Expert, M580 and other communication modules support posting logs to a centralized system known as a Syslog Server. Resolution Using the Syslog servers in Ubuntu for event logging on M580 is detailed in the attached article. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Objective The objective of this knowledge base article it to demonstrate how to disable the User Rights Only for the Web-visualization on M2xx controllers. Resolution This is done by creating an empty ".cfg" file on the controller files system and rebooting the controller. This helps accessing the visualization via the Web server without being asking for a password and username. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue Teams with several engineers want to be able to gain access to the EcoStruxure Control Expert Classic software through authentication. In addition, the tool facilitates user access control configuration for EcoStruxure Control Expert Classic software and allows a secure centralized network design. Resolution The Security Editor tool simplifies the configuration of EcoStruxure Control Expert Classic user access control and supports a secure, centralized architecture with the following features: Client-server architecture supporting a secure proprietary protocol for users without IT authentication infrastructure. Client-server architecture using the Microsoft Active Directory as the Lightweight Directory Access Protocol (LDAP) server. Manage the certificate whitelist. Generate a certificate. Centralized security database. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue With the shift towards a data-centered world and highly networked industrial environments, modern Programmable Logic Controllers (PLCs) have become a potential target for cyber-attacks. The attack vectors have evolved due to the adoption of a connected operational model, providing hackers with new methods for manipulating, interrupting, or disrupting PLC operations in all industries and on all platforms. The purpose of this article is to guide you in setting up a protected connection between EcoStruxure Control Expert and the Modicon M340 controller. Understand the impact on Modicon M340's performance when the Protected Engineering Link is activated. Resolution A secure authentication method is implemented to secure and encrypt the connection for Modicon M340 reservations, ensuring a protected engineering/programming connection to the Modicon M340 CPU. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue A Programmable Logic Controller (PLC) is an industrial computer that is adapted for the control of manufacturing processes. Given the central role that it plays, it has been a preferred target of industrial control system attackers. ICS (or Industrial Control System) security is growing in importance as cyber-attacks increasingly focus on physical processes for either ransom or to cause harm to critical production systems. The main objective of cybersecurity is to protect information and physical assets from cyberattacks, data breaches, and identity theft, as well as to manage risks. This document aims to guide you on how to set up and configure a secure connection between EcoStruxure Control Expert and the Modicon M580 controller. Resolution The Modicon M580 controller uses HTTPS as its secure connection. HTTPS today uses Transport Layer Security or TLS. TLS is a network protocol that establishes an encrypted connection to an authenticated peer over an untrusted network. TLS is a direct replacement for SSL (Secure Sockets Layer), and both protocols serve the same purpose. With this technology, HTTPS or HTTPS via USB communication on the M580 CPU can be implemented to create a secure and encrypted connection via the engineering/programming link. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue The Modicon M580 Safety controller can execute single task and multi-task applications. Unlike a single task application which only executes the MAST task, a multi-task application defines the priority of each task. When a task is running, it can be interrupted by another task with a higher relative priority. For example, when a periodic task is scheduled to execute its code, it would interrupt a lower priority task, but would wait until the completion of a higher priority task. Resolution For optimal CPU performance, Schneider Electric recommends that the total percentage of CPU bandwidth consumed by an application not exceed 80%. Users will need to determine the CPU bandwidth and fine tune to adjust the tasks period for an optimal CPU performance. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue How to work with a TÜV Rheinland certified controller, Modicon M580 Safety ePAC, within the EcoStruxure Process Expert? Resolution The EcoStruxure™ Process Expert supports users to create, configure, program, and deploy process and safety applications to the Modicon M580 Safety controller.     The Modicon M580 Safety controller is added as part of the EcoStruxure™ Process Expert system architecture, providing seamless transparency connections into the system network.   The EcoStruxure™ Process Expert handles the process logic part for M580 Safety controllers, while the safety related part will be handled by the control participant, ensuring safety functions and process control are separated and independent within a common engineering environment.   Attached document will show how this is possible. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue Cannot access the EcoStruxure Control Expert Security Editor tool because of SystemAdmin's password being lost or forgotten. Resolution   Using the attached article its possible to clear the Security Editor database properly to enable login again. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.

Issue How to leverage Microsoft Active Directory Domain Services to secure and manage access to EcoStruxure Control Expert. Resolution The aim of this article is to provide a step-by-step guide to connect Security Editor Tool to Microsoft Active Directory through LDAP in order to secure and manage access to EcoStruxure Control Expert.   Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Objective How do I harden M580 Architectures within EcoStruxure Control Expert? Resolution The aim of this article is to provide a step-by-step guide to configure Security Editor tool for RBAC (Role-Based Access Control) to EcoStruxure Control Expert in a Client/Server architecture.    

Objective How do I harden M580 Architectures within EcoStruxure Control Expert? Resolution The aim of this article is to provide a step-by-step guide to configure the Security Editor Tool for RBAC (Role-Based Access Control) to EcoStruxure Control Expert.