Industrial Automation Knowledge Base

Issue Teams with multiple engineers involved in authentication wants to use the Security Editor to administer access to EcoStruxure Control Expert (Classic & Topology Manager) software. The software tool simplifies the configuration of EcoStruxure Control Expert user access control and supports a secure centralized architecture. Resolution A centralized user management system reduces operational complexities in controlling user accounts and server requests. It enhances security by efficiently managing user requests for applications and online servers. Centralized user management improves security, simplifies administration, ensures compliance, and supports efficient operations in industrial settings. EcoStruxure Control expert Client-Server Architecture This document aims to provide you with recommendations for configuring an EcoStruxure Control Expert (Classic & Topology Manager) in a secure client-server architecture. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue Teams with several engineers want to be able to gain access to the EcoStruxure Control Expert Classic software through authentication. In addition, the tool facilitates user access control configuration for EcoStruxure Control Expert Classic software and allows a secure centralized network design. Centralized Security Database Resolution The Security Editor tool simplifies the configuration of EcoStruxure Control Expert Classic user access control and supports a secure, centralized architecture with the following features: Client-server architecture supporting a secure proprietary protocol for users without IT authentication infrastructure. Client-server architecture using the Microsoft Active Directory as the Lightweight Directory Access Protocol (LDAP) server. Manage the certificate whitelist. Generate a certificate. Centralized security database. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue A Programmable Logic Controller (PLC) is an industrial computer that is adapted for the control of manufacturing processes. Given the central role that it plays, it has been a preferred target of industrial control system attackers. ICS (or Industrial Control System) security is growing in importance as cyber-attacks increasingly focus on physical processes for either ransom or to cause harm to critical production systems. The main objective of cybersecurity is to protect information and physical assets from cyberattacks, data breaches, and identity theft, as well as to manage risks. This document aims to guide you on how to set up and configure a secure connection between EcoStruxure Control Expert and the Modicon M580 controller. Resolution The Modicon M580 controller uses HTTPS as its secure connection. HTTPS today uses Transport Layer Security or TLS. TLS is a network protocol that establishes an encrypted connection to an authenticated peer over an untrusted network. TLS is a direct replacement for SSL (Secure Sockets Layer), and both protocols serve the same purpose. With this technology, HTTPS or HTTPS via USB communication on the M580 CPU can be implemented to create a secure and encrypted connection via the engineering/programming link. Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.  

Issue A security database was created with the Security Editor tool on a PC where an old version of EcoStruxure Control Expert is installed (i.e. version 15.0). Then, a newer version of EcoStruxure Control Expert is installed (i. e. version 16.0) on the same PC. How to avoid creating the entire security database from scratch after installing a newer version of EcoStruxure Control Expert. Resolution Use the Security Database Migration Tool to migrate the previous security database to the one that is automatically created as part of the installation process of EcoStruxure Control Expert V16.0.

Issue There are often customer requirements to send safety related data over communications links. At the same time, the requirement automatically arises for the transference of safe and non-safe data via a collective standard network. A safe network will allow the Safety controller to communicate with each other and provides a robust and safe means of sending safety related data using the communications medium that best suits the applications and budget.   Resolution With M580 Safety CPU firmware 3.20 or later, the safe time synchronization is based on an internal "monotonic" time clock. The safe communication DOES NOT need NTP time synchronization as the CPU is sharing its safe time with all its local and remote I/Os. The remote I/O drop uses BM•CRA31210 module and must have a firmware 2.60 or later to work. A monotonic clock is a time source that always moves forward and will not be impacted by variations leading to jumps in time (due to NTP or Daylight Savings Time updates). Monotonic uses Thomas Habets's cross platform "monotonic_clock" library under the hood.   Attached herewith are two documents file that guide you on how to implement Safe Peer-to-Peer communication between two M580 Safety ePAC (MASTER PAC and SLAVE PAC).   Disclaimer The views and opinions expressed in this article are those of the author(s) and do not necessarily reflect the official policy or position of Schneider Electric.