8

© Siemens AG 2014

Industrial Security

8/2 Security Integrated

8/2 Introduction
8/8 SCALANCE S
8/19 SCALANCE M
8/20 CP 1243-1 and CP 1543-1
8/21 CP 343-1 Advanced and
CP 443-1 Advanced
8/23 CP 1628
8/24 SOFTNET Security Client
8/27 Industrial Security Services

Siemens IK PI · 2015
 © Siemens AG 2014

Industrial Security
Security Integrated
Introduction

■ Overview
Industrial security
That is why industrial security is so important
As the use of Ethernet connections all the way down to the field industrial plant with comprehensive security protection against
level increases, the associated security issues are becoming attacks, the appropriate measures must be taken.
a more urgent topic for industry. After all, open communication Siemens can support you here in selectively implementing these
and increased networking of production systems involve not measures – within the scope of an integrated range for Industrial
only huge opportunities, but also high risks. To provide an Security.
Threat overview

No. Threat Explanation

1 Unauthorized use of remote Maintenance access provides deliberate openings to the outside in the ICS network 1).
maintenance access However, they are often inadequately protected.
2 Online attacks In general, office IT equipment is connected with the Internet in many ways.
via office/enterprise networks Usually, there are also network connections from the office network to the ICS network,
allowing attackers to use this route.
3 Attacks against standard Standard IT components (commercial off-the-shelf, COTS) such as operating systems,
components used in the application servers, or databases generally contain flaws and weak points which can be
ICS network exploited by attackers. If these standard components are also used in the ICS network,
this increases the risk of a successful attack on the ICS systems.
4 (D)DoS attacks (Distributed) denial of service attacks can be used to disrupt network connections and
required resources and cause systems to crash, e.g. to disrupt the functionality of an ICS.
5 Human error and sabotage Deliberate actions – regardless of whether by internal or external agents – are a massive
threat for all security goals. In addition, negligence and human error are a great danger,
especially when it comes to protecting confidentiality and availability.
6 Introduction of harmful code The use of removable media and mobile IT components of external employees always
via removable media and presents a great risk of malware infections. The importance of this aspect was demonstrated
external hardware by Stuxnet, for example.
7 Reading and writing messages Because most control components presently communicate via plain-text protocols, and are
in the ICS network thus unprotected, it is often possible to read and insert commands without great difficulty.
8 Unauthorized access In particular, insiders or follow-up attacks after intrusion from the outside have an easy time
to resources if authentication and authorization for services and components in the process network are
non-existent or insecure.
9 Attacks on network components Network components can be manipulated by attackers, for example to carry out
man-in-the-middle attacks or to make sniffing easier.
10 Technical faults and acts of God Failures are always possible as a result of extreme environmental influences or technical

8
defects – the risk and the potential for damage can only be minimized here.
1) Industrial Control Systems (ICS)
Source: BSI-A-CS 004 | Version 1.00 dated April 12, 2012; page 2 of 2
Note:
The list of threats came about as a result of close cooperation
between BSI and business representatives.
With its BSI analyses, the Federal Office for Information Security
(BSI) publishes statistics and reports on current topics in
cyber security.
Please send comments and notes to: [email protected]

8/2 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
Introduction

■ Overview (continued)

Physical access protection

Defense in depth
Processes & guidelines

Cell protection and perimeter network

Plant security Firewalls & VPN

Network security System hardening

Authentication/user administration
System integrity
Patch management

Detection of attacks

G_IK10_XX_10336
Security guidelines

Industrial security services

Network security as a central component of the Siemens Industrial Security concept

Siemens Industrial Security – Factors for success: Network security

continuous protection for your plant
Network security means protecting automation networks from
An optimum industrial security solution can only be implemented unauthorized access. This includes the monitoring of all inter-
if new approaches are taken because they must be continuously faces such as the interfaces between office and plant networks
adapted to new threats. There is no such thing as absolute or the remote maintenance access to the Internet, which can be
security. To ensure a comprehensive and permanent solution, accomplished by means of firewalls and, if applicable, by estab-
we provide in-depth advice, partner-like cooperation, and lishing a DMZ (demilitarized zone = secure, protected zone).
constant further development of our security measures and The DMZ is used to provide data for other networks, without
products. granting direct access to the automation network. The secure
segmenting of the plant network into individually protected auto-
All-round, but also in-depth protection
8
mation cells minimizes risks and increases security. Cell division
With Defense in Depth, Siemens provides a multi-level concept and device assignment are based on communication and
that offers your plant both all-round and in-depth protection. protection requirements. Data transmission is encrypted by
The concept is based on the components, plant security, means of a VPN and is thus protected from data espionage and
network security, and system integrity, as recommended by manipulation. The communication stations are securely authen-
ISA 99 / IEC 62443 – the leading standard for security in ticated. The cell protection concept can be implemented and
industrial automation. While conventional plant security defends communication can be secured using "Security Integrated" com-
the plant against physical attacks, network protection and and ponents such as SCALANCE S Security Modules, SCALANCE M
protection of system integrity protect against cyber attacks and wireless routers, or Security CPs for SIMATIC.
unauthorized access by operators or external persons.
Initial risk assessment and information on the Internet
You want to know now how good the security of your industrial
plant is? We can provide you with detailed information about the
special security issues in your industry. Use the opportunity to
contact our consulting team about any open issues. Our experts
will gladly prepare a security concept that is adapted to the
needs of your production plant or process infrastructure. You
can download the additional "Operational Guidelines" with many
recommendations for protecting your production plant from our
Internet site.

Siemens IK PI · 2015 8/3

 © Siemens AG 2014

Industrial Security
Security Integrated
Introduction

■ Overview (continued)
Plant Security

Physical protection
Security management

Office Network DMZ

GPRS/ SCALANCE
Domain PC with Server Server
UMTS M874-3
Controller CP 1628
SIMATIC
S7-1200 with
CP 1243-1
Network Security

Internet
SSC
Router
SCALANCE Central
S623 WEB Archiving
Server SIMATIC Field PG
Server
Internet with SOFTNET
Security Client

SCALANCE
M812-1
SCALANCE SCALANCE
S627-2M S627-2M SCALANCE
p•‹œš›™ˆ“Gl›Œ™•Œ›
S623

Sync connection

Production 1 Production 2 Production 3

Production n
Industrial Ethernet
(Fiber optic) SCALANCE
MRP ring X308-2M
SIMATIC SIMATIC
S7-400 with SIMATIC S7-300 with
CP 443-1 S7-1200 with CP 343-1
SCALANCE Ring redundancy SCALANCE Advanced CP 1243-1 Advanced
X204-2 manager X204-2
8 SCALANCE
X308-2M
System Integrity

PROFINET PROFINET PROFINET

SIMATIC
TP700

SIMATIC S7-400
with CP 443-1 SIMATIC
Advanced SIMATIC S7-1200
ET ET 200 SIMATIC
200SP TP1200
vzGwith lzGwith Comfort
G_IK10_XX_10370

jwGX]Y_ jwGX]Y_

SINAMICS SIMATIC SIMATIC SIMOTION D4x5 with

{Œ™”•ˆ“‰œš {Œ™”•ˆ“‰œš
G120 TP700 TP700 SINAMICS S120 (Booksize)
Factory Automation

Secure communication, network access protection and network segmentation with Security Integrated products

8/4 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
Introduction

■ Overview (continued)
Security Integrated SCALANCE S security modules
Cell protection concept SCALANCE S modules protect industrial networks and automa-
tion systems by means of security-related segmentation (cell
Industrial communication is a key factor for corporate success – protection) with a firewall against authorized access and protect
as long as the network is protected. As your partner, Siemens data transmission with VPN against manipulation and espio-
provides its customers with Security Integrated components, nage.
which not only have communication functions but also include
special security functions such as firewall and VPN functionality, SCALANCE M router
in order to implement the cell protection concept. With the cell
protection concept, a plant network is subdivided into protected Mobile radio router
automation cells within which all devices are able to communi- SCALANCE M industrial router for secure access to plants via
cate with each other securely. The individual cells are connected mobile radio, e.g. GPRS or UMTS, with integral security func-
to the plant network protected by a VPN and firewall. Cell protec- tions – firewall for protection against unauthorized access and
tion reduces the susceptibility to failure of the entire production VPN for protection of the data transmission.
plant and thus increases its availability. Security Integrated prod-
ucts such as SCALANCE S, SCALANCE M and SIMATIC S7/PC DSL routers
communications processors can be used for implementation. The SCALANCE M DSL routers are ADSL routers (M812-1 and
The following Security Integrated products are available: M816-1) for the secure connection of Ethernet-based subnets
and automation devices to hard-wired DSL networks or SHDSL
SIMATIC S7-1200 / S7-1500: routers (M826) for connection via existing wire-pairs or multi-wire
• Protection of the controller by access protection (authenti- cables. They have integral security functions – firewall for pro-
cation) via the S7-1200/S7-1500 CPU: tection against unauthorized access and VPN for protection of
- Know-how protection the data transmission.
- Manipulation protection Industrial PCs
- Copy protection
- Graded security concept for HMI connection • Via the CP 1628 communications processor, the industrial
PCs are protected by firewall and VPN – for secure communi-
• Expandable access protection (firewall and VPN ) cation without special operating system settings. This means
for S7-1200/S7-1500 with Security CP 1243-1/CP 1543-1 that computers equipped with the module can be connected
by means of to protected cells.
- Integrated firewall (monitoring of the data flow)
- Protection against data manipulation and espionage by Software
means of a VPN • The SOFTNET Security Client software enables VPN access
SIMATIC S7-300 and S7-400 via the Internet or a company intranet to automation cells or
PCs protected by SCALANCE S or another security
• Protection of controllers by CP 343-1 Advanced and component with VPN functionality.
CP 443-1 Advanced communications processors, which
contain both firewall and VPN (virtual private network)
functionality.

8
S7-1200 CPU 1)

Security Client
SCALANCE S

CP 343-1 Adv
CP 443-1 Adv

S7-1500 CPU
SCALANCE M

CP 1243-1 1)
CP 1543-1

SOFTNET
CP 1628
family

family

Configurable copy protection ●

Access protection (authentication) ●

Extended access protection (Firewall) ● ● ● ● ●

Virtual Private Network with IPSec ● ● ● ●

Manipulation protection (communication, configuration) ● ● ● ● ● ● ●

● applies 1) from CPU firmware V4.0

from STEP 7 Professional V13 (TIA Portal)

Security Integrated products for industrial use with special security functions to improve the standard of security

Siemens IK PI · 2015 8/5

 © Siemens AG 2014

Industrial Security
Security Integrated
Introduction

■ Ordering data Article No. Article No.

Security Integrated devices SCALANCE M industrial modems and routers

SCALANCE S Industrial Security SCALANCE M874 mobile radio
Modules router
For protecting programmable Mobile radio router for wireless
controllers and automation IP communication from Industrial
networks and for securing industrial Ethernet-based subnets and
communication; programmable controllers via UMTS
Security Modules protect network or GSM mobile radio networks;
segments against unauthorized with integrated firewall and VPN
access by means of Stateful with IPsec;
Inspection Firewall; 2 x RJ45 ports,
connection of more than 1 x antenna connection
10/100/1 000 Mbit/s ports; • SCALANCE M874-31) 6GK5874-3AA00-2AA2
configuring tool and electronic • SCALANCE M874-21) 6GK5874-2AA00-2AA2
manual on CD ROM;
English, German, French, Italian, SCALANCE M875 UMTS Router
Spanish;
UMTS router for wireless
SCALANCE S602 6GK5602-0BA10-2AA3 IP communication from Industrial
Ethernet-based programmable
SCALANCE S612 6GK5612-0BA10-2AA3 controllers via UMTS/GSM mobile
up to 128 VPN tunnels radio networks;
simultaneously EGPRS Multislot Class 12;
SCALANCE S623 6GK5623-0BA10-2AA3 with integrated firewall and VPN
up to 128 VPN tunnels with IPsec;
simultaneously; 2 x RJ45 ports,
additional RJ45 DMZ port 2 x antenna connections
• SCALANCE M8751) 6GK5875-0AA10-1AA2
SCALANCE S627-2M 6GK5627-2BA10-2AA3
up to 128 VPN tunnels • SCALANCE M8751) 6GK5875-0AA10-1CA2
simultaneously; for Japan
additional RJ45 DMZ port; SCALANCE M81x-1 ADSL router
two additional slots for one 2-port
media module each DSL router for wired
IP communication from Industrial
SOFTNET Security Client V4 HF1 6GK1704-1VW04-0AA0 Ethernet-based subnets and
Software for designing secure programmable controllers
IP-based VPN connections from a via telephone or DSL networks;
programming device/PC to network with integrated firewall and
segments which are secured by VPN with IPsec;
SCALANCE S, SCALANCE M, 1 x or 4 x RJ45 ports for Industrial
CP 343-1 Advanced, CP 443-1 Ethernet;
Advanced, or CP 1628; 1 x RJ45 port for DSL
Single License for 1 installation, • SCALANCE M812-1 (Annex A) 6GK5812-1AA00-2AA2
runtime software (German/English), • SCALANCE M812-1 (Annex B) 6GK5812-1BA00-2AA2
configuration tool (German/ • SCALANCE M816-1 (Annex A) 6GK5816-1AA00-2AA2
English), and electronic manual
• SCALANCE M816-1 (Annex B) 6GK5816-1BA00-2AA2
on CD-ROM (German/English/
French/Spanish/Italian) for SCALANCE M826-2 SHDSL router

8
Windows 7 Professional, Ultimate,
Windows XP Professional (32-bit) DSL router for wired
+ SP3 IP communication from Industrial
Ethernet-based subnets and
programmable controllers
via telephone or DSL networks;
with integrated firewall and
VPN with IPsec;
1 x or 4 x RJ45 ports for Industrial
Ethernet;
1 x RJ45 port for DSL
• SCALANCE M826-2 (Annex A) 6GK5826-2AB00-2AB2

8/6 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
Introduction

■ Ordering data Article No. Article No.

Communications processors for SIMATIC S7 Communications processors for PG/PC/IPC
CP 1243-1 6GK7243-1BX30-0XE0 CP 1628 6GK1162-8AA00
communication processor; communications processor;
for connection of SIMATIC S7-1200 PCI Express x1 card for
to Industrial Ethernet via TCP/IP, connection to Industrial Ethernet
ISO and UDP, Telecontrol Server (10/100/1 000 Mbit/s),
Basic and security functions with 2-port switch (RJ45) and
Stateful Inspection Firewall integrated security (firewall, VPN)
and VPN; via HARDNET-IE S7 and
1 x RJ45 interface S7-REDCONNECT.
with 10/100 Mbit/s For operating system support,
see SIMATIC NET Software
CP 1543-1 6GK7543-1AX00-0XE0
communication processor; Accessories
for connection of SIMATIC S7-1500
to Industrial Ethernet via TCP/IP, IE FC TP Standard Cable GP 2 x 2 6XV1840-2AH10
ISO and UDP and security functions (Type A)
Stateful Inspection Firewall 4-core, shielded TP installation
and VPN; cable for connecting to IE FC RJ45
1 x RJ45 interface outlet / IE FC RJ45 plug;
with 10/100/1 000 Mbit/s; PROFINET-compliant;
CP 343-1 Advanced 6GK7343-1GX31-0XE0 with UL approval;
communications processor; sold by the meter;
max. length 1 000 m,
For connection of SIMATIC S7-300 minimum order 20 m
to Industrial Ethernet over ISO
and TCP/IP; IE FC RJ45 Plug 180
PROFINET IO Controller or RJ45 plug-in connector
PROFINET IO Device, MRP, for Industrial Ethernet with a rugged
integrated 2-port switch ERTEC; metal enclosure and integrated
S7 communication, open communi- insulation displacement contacts
cation (SEND/RECEIVE), for connecting Industrial Ethernet
FETCH/WRITE, with and without FC installation cables;
RFC1006, multicast, DHCP, with 180° cable outlet;
CPU clock synchronization via for network components and
SIMATIC procedure and NTP, CPs/CPUs with Industrial Ethernet
diagnostics, SNMP, access interface
protection through IP access list, • 1 pack = 1 unit 6GK1901-1BB10-2AA0
initialization over LAN
10/100 Mbit/s; • 1 pack = 10 units 6GK1901-1BB10-2AB0
as well as IT communication • 1 pack = 50 units 6GK1901-1BB10-2AE0
(web, e-mail, FTP);
IE FC stripping tool 6GK1901-1GA00
PROFINET CBA;
security (firewall/VPN); Preadjusted stripping tool for
PROFIenergy; fast stripping of Industrial Ethernet
with electronic manual on DVD FC cables
CP 443-1 Advanced 6GK7443-1GX30-0XE0 SITOP compact 24 V/ 0.6 A 6EP1331-5BA00
communications processor;
1-phase power supply with
For the connection of
8
wide-range input
SIMATIC S7-400 85 – 264 V AC/110 – 300 V DC,
to Industrial Ethernet; stabilized output voltage 24 V,
PROFINET IO Controller with RT rated output current value 0.6 A,
and IRT, MRP, PROFINET CBA, slim design
TCP/IP, ISO and UDP;
S7 communication, open communi- C-PLUG 6GK1900-0AB00
cation (SEND/RECEIVE) with Swap medium for simple replace-
FETCH/WRITE, with and without ment of devices in the event of a
RFC1006, diagnostics expansions, fault; for storing configuration or
multicast, clock synchronization application data;
with SIMATIC mode or NTP, can be used for SIMATIC NET
access protection by IP access list, products with C-PLUG slot
FTP client/server, HTTP server,
HTML diagnostics, SNMP, DHCP,
e-mail, data storage on C-PLUG;
PROFINET connector:
4xRJ45 (10/100 Mbit/s) via switch;
Gigabit connector:
1xRJ45 (10/100/1 000 Mbit/s);
with integrated stateful inspection
firewall and VPN appliance
1)
Please note national approvals under
http://www.siemens.com/wireless-approvals
Note:
Check the current country list:
http://support.automation.siemens.com/WW/view/en/66627157

Siemens IK PI · 2015 8/7

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Overview
Product versions:
SCALANCE S602;
• Uses the stateful inspection firewall to protect network
segments against unauthorized access.
• "Ghost mode" for protection of individual, even alternating,
devices by dynamically taking over the IP address.
• Connection via 10/100/1 000 Mbit/s ports.
SCALANCE S612;
• Uses the stateful inspection firewall to protect network
segments against unauthorized access.
• Up to 128 VPN tunnels can be operated simultaneously.
• Connection via 10/100/1 000 Mbit/s ports.
SCALANCE S623;
• Uses the stateful inspection firewall to protect network
segments against unauthorized access.
• Up to 128 VPN tunnels can be operated simultaneously.
• Security modules for the protection of automation networks
and security during data exchange between automation • Connection via 10/100/1 000 Mbit/s ports.
systems. • Additional RJ45 DMZ port (DMZ: "demilitarized zone") for
• Checking and filtering of data traffic by integrated firewall and secure connection from, for example, remote maintenance
thus: modems, laptops, or an additional network. This yellow port
- Protection against operator mistakes protected by firewalls from the red and green ports and can
- Prevention of unauthorized access also terminate VPNs.
- Prevention of faults and communications overload • Redundant protection of automation cells by means of router
• Authentication of the communication partners and encryption and firewall redundancy and stand-by linking of the redundant
of the transmitted data with VPN and thus protection of device via the yellow port.
communication against espionage and manipulation. SCALANCE S627-2M;
• Rugged, industry-compatible design of the devices • Uses the stateful inspection firewall to protect network
• Easy and clear configuration: segments against unauthorized access.
Using the Security Configuration Tool (SCT), all SIMATIC NET • Up to 128 VPN tunnels can be operated simultaneously.
security products can be configured and diagnosed from a
central position. • Connection via 10/100/1 000 Mbit/s ports.
• No changes or adaptations necessary in the existing network • Additional RJ45 DMZ port (DMZ: "demilitarized zone") for
topology, applications or network stations since SCALANCE S secure connection from, for example, remote maintenance
can also be used as a bridge and not just as a router. modems, laptops, or an additional network. This yellow port
protected by firewalls from the red and green ports and can
• Securing of communication is independent of the protocol also terminate VPNs.
8 (e.g. PROFINET or other Ethernet-based fieldbus solutions)
• Secure remote access via the Internet possible without restric-
• Redundant protection of automation cells by means of router
and firewall redundancy and stand-by mode of the redundant
tions and with any providers device; status matching of the firewall by means of a synchro-
• Increased availability is possible by means of redundant nization cable between the yellow ports.
protection of automation cells or ring topologies • Two additional slots for one 2-port media module each
(see SCALANCE X-300) for direct integration in ring structures
and FO networks with two additional switched red or green
ports per module.
• Bridging of longer cable runs or use of existing 2-wire cables
(e.g. PROFIBUS) by deploying MM992-2VD media modules
(variable distance).

8/8 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Benefits ■ Application
The security modules of the SCALANCE S range can be used
to protect all devices of an Ethernet network against unauthor-
ized access. In addition, SCALANCE S612 or SCALANCE S623
also protect the data transmission between devices or network
• Protection of industrial automation networks against segments (e.g. automation cells) against data manipulation and
unauthorized access and setup of a DMZ (protected zone) espionage; they can also be used for secure remote access
possible for data exchange with other networks without having over the Internet.
to grant direct access to the production network.
The security modules can be operated not only in bridge mode
• Through implementation of the cell protection concept: but also in router mode, and can thus also be used direct at
- Protection of any Ethernet-based programmable controllers IP subnetwork borders.
and automation systems which do not have their own
security functions Secure remote access over the Internet or GPRS/UMTS is
- Protecting several devices simultaneously possible with the SCALANCE M875 GPRS/UMTS router.
- Reduction in risk by means of network segmenting SCALANCE S is optimized for use in automation and industrial
(by generating secure communication islands) environments, and meets the specific requirements of auto-
- Securing of communication to and from the automation cells mation systems, such as easy upgrades of existing systems,
is possible simple installation and minimal downtimes in the event of a fault.
• User-specific firewall rules can be used to assign specific
access privileges to users and not just to devices.
• System-wide network diagnostics thanks to integration into
IT infrastructures and network management systems by
means of SNMP
• Securing of remote access via the Internet. Using PPPoE and
DynDNS, dynamic IP addresses can also be applied.
• Problem-free integration into existing networks without
reconfiguring terminal nodes or setting up new IP subnet-
works
• Module replacement without the need for a programming
device, using the C-PLUG swap media for backing up the
configuration data
• Direct integration in ring structures and FO networks is
possible (SCALANCE S627-2M)

Company network
Local
service PC Remote
service PC
with SOFTNET
SCALANCE Internet Security Client
S623
8
Industrial Ethernet
Service access

Internet Internet
Router Router
G_IK10_XX_10303

Plant network/
secure automation cell

Connection of a local or remote service PC (by means of Internet access) via the DMZ port of the SCALANCE S623

Siemens IK PI · 2015 8/9

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Design ■ Function
SCALANCE S602 Security functions
• Checking of data traffic and protection against unauthorized VPN (Virtual Private Network)
access by means of stateful inspection firewall. (only for SCALANCE S612, S623 and SCALANCE S627-2M);
• Simple and fast configuration of the firewall through global for reliable authentication (identification) of the network stations,
firewall rules and symbolic names for IP addresses. for encrypting data and checking data integrity.
• Specific access privileges for users in accordance with user- • Authentication;
specific firewall rules. All incoming data traffic is monitored and checked. As IP
• 10/100/1 000 Mbit/s ports for the connection and operation of addresses can be falsified (IP spoofing), checking the IP
SCALANCE S in Gigabit networks as well address (of the client access) is not sufficient. In addition,
Client PCs may have changing IP addresses. For this reason
• In addition to bridge mode, can also be operated in router the authentication is performed by means of tried and tested
mode and can therefore also be used directly at IP subnet VPN mechanisms.
limits
• Data encryption;
• Address translation Secure encryption is necessary in order to protect data
- NAT (Network Address Translation) permits the use of private communication from espionage and unauthorized manipu-
IP addresses in the internal network in that public IP lation. This means that the data traffic remains incomprehen-
addresses are converted to private ones sible to any eavesdropper in the network. The SCALANCE
- NAPT (Network Address and Port Translation) permits the Security Module establishes VPN tunnels to other Security
use of private IP addresses in the internal network in that Modules for this purpose.
frames are converted to private IP addresses depending on
the communications port used The firewall
• Internal network nodes can receive their IP addresses from can be used as an alternative or to supplement VPN with flexible
the integral DHCP server access control.
The firewall filters data packets and disables or enables
• Log files can also be evaluated by the Syslog server communication links in accordance with the filter list and stateful
• Enhanced integration in IT infrastructures and network inspection. Both incoming and outgoing communication can be
management systems by means of SNMP filtered, either according to IP and MAC addresses as well as
• Protection of individual, even alternating, devices by dynami- communication protocols (ports) or user-specific.
cally taking over the IP address (ghost mode) • Logging;
access data are saved by the Security Module in a log file.
SCALANCE S612 Detection of how, when and by whom it has been accessed is
As SCALANCE S602; additionally: as important as detecting access attempts, to ensure that
appropriate preventative measures can be taken.
• Encryption of data transmission with VPN (IPSec)
- Protection against espionage Configuration
- Protection against unauthorized manipulation
Configuration is carried out using the Security Configuration Tool
• Secure remote access over the Internet, e.g. in conjunction (SCT). Therefore all SIMATIC NET security products can be
with the SOFTNET Security Client and the SCALANCE M configured and diagnosed from a central position. All the config-
UMTS router (with IPSec VPN function) uration data can be saved on the optional C-PLUG swap media
SCALANCE S623 (not included in scope of supply) so that the Security Module
can be replaced quickly in the event of a fault and without the
8 As SCALANCE S612; additionally:
• DMZ port with which a protected zone (DMZ = demilitarized)
need of a programming device.

can be set up between two networks. The DMZ is used to

provide data for other networks without granting direct access
to the automation network, thus increasing security. The DMZ
port can also be used to protect remote maintenance access,
where, for example, only access to lower-level automation
cells is possible and no access to the plant network is
required.
• Secure, redundant connection of automation cells through
router and firewall redundancy
SCALANCE S627-2M
As SCALANCE S623; additionally:
• Two media module slots for two additional switched red or
green ports each.
- Direct integration in line or ring topologies is possible
- Integration into redundant rings (MRP, HRP) is possible
- Secure, redundant connection of automation cells or rings
- Direct integration in FO networks is possible through the use
of FO media modules
- Bridging of longer cable runs or use of existing 2-wire cables
(e.g. PROFIBUS) by deploying the MM992-2VD media
modules (variable distance).

8/10 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Function (continued)
Configuration

Automation plant

Automation Applications Remote stations

SCALANCE
M874-3

SIMATIC
Plant network VPN S7-1200
tunnel
Industrial Ethernet

GPRS/UMTS

SCALANCE Internet
M812-1 Router SSC
Security Security
Module Module SCALANCE
SCALANCE S SCALANCE S S623 VPN SIMATIC
tunnel Internet Field PG with
PROFINET PROFINET ... PROFINET
SOFTNET
Security
Client

G_IK10_XX_10339
Automation Cell n Automation Cell n-1 Automation Cell 1

Secure remote access without direct connection to the automation network with SCALANCE S623

Office Network Untrusted Zone

8
Domain
Controller

Server with web DMZ Zone

application

SCALANCE
S623

p•‹œš›™ˆ“Gl›Œ™•Œ› Trusted Zone

G_IK10_XX_10340

Data base
server

permitted access blocked access limited access

Demilitarized zone (DMZ) for remote maintenance or access to data server with SCALANCE S623

Siemens IK PI · 2015 8/11

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Function (continued)

SCALANCE SCALANCE
S612 M812-1
VPN tunnel 2
S7-300 with
CPU 315-2 DP
VPN and CP 343-1
tunnel 1 Lean
Service Center

SCALANCE
M874-2 PROFIBUS
Internet
Industrial Ethernet
Mobile radio Remote Station 2

S7-1500 with
IP camera CP 1543-1 Service PC with
Software SOFTNET
Security Client
SCALANCE

G_IK10_XX_30188
M874-3
Smartphone or
tablet
Industrial Ethernet
Remote Station 1

Secure remote access over Internet with SCALANCE S and SCALANCE M

Ring redundancy
manager

8
MRP ring A

SCALANCE S627-2M SCALANCE S627-2M CU or fiber optic

Sync connection

MRP ring B
G_IK10_XX_10366

Industrial Ethernet
Industrial Ethernet
Ring redundancy
(Fiber optic)
manager

Secure, redundant connection between two MRP rings with SCALANCE S627-2M

8/12 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Function (continued)
Ring redundancy manager

MRP ring

CU or fiber optic
SCALANCE S627-2M SCALANCE S627-2M
Industrial Ethernet
Automation Cell Sync connection Industrial Ethernet
(Fiber optic)

Ring redundancy manager

MRP ring

MRP-Switch
CU

G_IK10_XX_10367
SCALANCE S627-2M SCALANCE S627-2M

Automation Cell Sync connection CU or fiber optic

Secure, redundant connection of an automation cell to a redundant ring with SCALANCE S627-2M

SCALANCE S627-2M SCALANCE S627-2M CU or fiber optic

Sync connection

MRP ring 8

Ring redundancy manager

Industrial Ethernet
MRP-Switch Industrial Ethernet
(Fiber optic)
CU

SCALANCE S627-2M SCALANCE S627-2M

CU or fiber optic

Sync connection

MRP ring
G_IK10_XX_10368

Ring redundancy manager

Secure, redundant connection of a redundant ring to a plant network with SCALANCE S627-2M

Siemens IK PI · 2015 8/13

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Technical specifications
Article No. 6GK5602-0BA10-2AA3 6GK5612-0BA10-2AA3 6GK5623-0BA10-2AA3
Product-type designation SCALANCE S602 SCALANCE S612 SCALANCE S623
Transmission rate
Transfer rate 1 10 Mbit/s 10 Mbit/s 10 Mbit/s
Transfer rate 2 100 Mbit/s 100 Mbit/s 100 Mbit/s
Transfer rate 3 1 000 Mbit/s 1 000 Mbit/s 1 000 Mbit/s
Interfaces
Number of electrical/optical 2 2 3
connections for network components
or terminal equipment maximum
Number of electrical connections
• for internal network 1 1 1
• for external network 1 1 1
• for DMZ 0 0 1
• for signaling contact 1 1 1
• for power supply 1 1 1
• for redundant power supply 1 1 1
Design of the electrical connection
• for internal network RJ45 port RJ45 port RJ45 port
• for external network RJ45 port RJ45 port RJ45 port
• for DMZ - - RJ45 port
• for signaling contact 2-pole terminal block 2-pole terminal block 2-pole terminal block
• for power supply 4-pole terminal block 4-pole terminal block 4-pole terminal block
Design of the removable storage Yes Yes Yes
C-PLUG
Signal-Inputs/outputs
Operating voltage of signaling 24 V 24 V 24 V
contacts at DC rated value
Operating current of signaling 0.1 A 0.1 A 0.1 A
contacts at DC maximum
Supply voltage,
current consumption, power loss
Type of supply voltage DC DC DC
Supply voltage external 24 V 24 V 24 V
• minimum 19.2 V 19.2 V 19.2 V
• maximum 28.8 V 28.8 V 28.8 V
Consumed current maximum 0.5 A 0.5 A 0.6 A

8 Product component fusing at

power supply input
Yes Yes Yes

Type of fusing at input Non-replaceable melting fuse Non-replaceable melting fuse Non-replaceable melting fuse
for supply voltage (F 3 A / 32 V) (F 3 A / 32 V) (F 3 A / 32 V)
Active power loss at 24V 6.72 W 6.72 W 6.96 W
for DC typical
Permitted ambient conditions
Ambient temperature
• during operating -40 … +60 °C -40 … +60 °C -40 … +60 °C
• during storage -40 … +80 °C -40 … +80 °C -40 … +80 °C
• during transport -40 … +80 °C -40 … +80 °C -40 … +80 °C
Relative humidity at 25 °C without 95 % 95 % 95 %
condensation during operating
maximum
Protection class IP IP20 IP20 IP20

8/14 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Technical specifications (continued)

Article No. 6GK5602-0BA10-2AA3 6GK5612-0BA10-2AA3 6GK5623-0BA10-2AA3
Product-type designation SCALANCE S602 SCALANCE S612 SCALANCE S623
Design, dimensions and weight
Design compact compact compact
Width 60 mm 60 mm 60 mm
Height 125 mm 125 mm 125 mm
Depth 124 mm 124 mm 124 mm
Net weight 0.8 kg 0.8 kg 0.81 kg
Mounting type
• 35 mm DIN rail mounting Yes Yes Yes
• S7-300 rail mounting Yes Yes Yes
• wall mounting Yes Yes Yes
Mounting type Screw mounting on horizontal and Screw mounting on horizontal and Screw mounting on horizontal and
vertical surfaces vertical surfaces vertical surfaces
Product properties, functions,
components general
Product function DynDNS client Yes Yes Yes
Protocol is supported PPPoE Yes Yes Yes
Product functions management,
configuration
Product function symbolic names Yes Yes Yes
for IP addresses
Protocol is supported
• SNMP v1 Yes Yes Yes
• SNMP v3 Yes Yes Yes
Type of configuration SCT: Security Configuration Tool SCT: Security Configuration Tool SCT: Security Configuration Tool
(included in scope of delivery) (included in scope of delivery) (included in scope of delivery)
Product functions Diagnosis
Product function
• SysLog Yes Yes Yes
• Packet Filter Log Yes Yes Yes
• Audit Log Yes Yes Yes
• System Log Yes Yes Yes
Product functions DHCP
Product function DHCP server - Yes Yes Yes
internal network

8
Product functions Routing
Product function static IP routing Yes Yes Yes
Product functions Security
Design of the firewall Stateful inspection Stateful inspection Stateful inspection
Product function with VPN connection - IPSec IPSec
Type of encryption algorithms - AES-256, AES-192, AES-128, AES-256, AES-192, AES-128,
with VPN connection 3DES-168, DES-56 3DES-168, DES-56
Type of authentication procedure - Preshared key (PSK), Preshared key (PSK),
with VPN connection X.509v3 certificates X.509v3 certificates
Type of hashing algorithms - MD5, SHA-1 MD5, SHA-1
with VPN connection
Number of possible connections 0 128 128
for VPN connection
Number of network stations
• maximum 0 128 128
• note - Limitation only applies in bridge mode. Limitation only applies in bridge mode.
No limitation in routing mode No limitation in routing mode
Product function
• Password protection Yes Yes Yes
• bandwidth limiting Yes Yes Yes
• NAT/NAPT Yes Yes Yes

Siemens IK PI · 2015 8/15

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Technical specifications (continued)

Article No. 6GK5602-0BA10-2AA3 6GK5612-0BA10-2AA3 6GK5623-0BA10-2AA3
Product-type designation SCALANCE S602 SCALANCE S612 SCALANCE S623
Product functions Time
Product function pass on Yes Yes Yes
time synchronization
Protocol is supported NTP Yes Yes Yes
Product component Yes Yes Yes
Hardware real-time clock
Product property battery-backed Yes Yes Yes
hardware real-time clock
Standards, specifications,
approvals
Standard
• for EMC from FM FM 3611 FM 3611 FM 3611
• for hazardous zone EN 60079-0: 2006, EN60079-15: 2005, EN 60079-0: 2006, EN60079-15: 2005, EN 60079-0: 2006, EN60079-15: 2005,
II 3 G Ex nA IIT.., II 3 G Ex nA IIT.., II 3 G Ex nA IIT..,
KEMA 07 ATEX 0145 X KEMA 07 ATEX 0145 X KEMA 07 ATEX 0145 X
• for security of CSA and UL UL 60950 / CSA C22.2 No. 60950-00, UL 60950 / CSA C22.2 No. 60950-00, UL 60950 / CSA C22.2 No. 60950-00,
UL 508 / CSA C22.2 No. 142 UL 508 / CSA C22.2 No. 142 UL 508 / CSA C22.2 No. 142
• for emitted interference EN 61000-6-4 : 2007 EN 61000-6-4 : 2007 EN 61000-6-4 : 2007
• for interference immunity EN 61000-6-2 : 2005 EN 61000-6-2 : 2005 EN 61000-6-2 : 2005
Verification of suitability AS/NZS 2064 (Class A), EN 61000-6-2, AS/NZS 2064 (Class A), EN 61000-6-2, AS/NZS 2064 (Class A), EN 61000-6-2,
EN 61000-6-4, marine classification EN 61000-6-4, marine classification EN 61000-6-4, marine classification
pending pending pending
• CE mark Yes Yes Yes
• C-Tick Yes Yes Yes
Marine classification association
• American Bureau of Shipping Eu- No No No
rope Ltd. (ABS)
• Bureau Veritas (BV) No No No
• Det Norske Veritas (DNV) No No No
• Germanische Lloyd (GL) No No No
• Lloyds Register of Shipping (LRS) No No No
• Nippon Kaiji Kyokai (NK) No No No
• Polski Rejestr Statkow (PRS) No No No
Accessories
Product expansion optional C-PLUG Yes Yes Yes

Article No. 6GK5627-2BA10-2AA3 Article No. 6GK5627-2BA10-2AA3

8 Product-type designation SCALANCE S627-2M Product-type designation SCALANCE S627-2M
Transmission rate Signal-Inputs/outputs
Transfer rate 1 10 Mbit/s Operating voltage of signaling 24 V
contacts at DC rated value
Transfer rate 2 100 Mbit/s
Operating current of signaling 0.1 A
Transfer rate 3 1 000 Mbit/s contacts at DC maximum
Interfaces Supply voltage,
Number of electrical/optical 7 current consumption, power loss
connections for network components Type of supply voltage DC
or terminal equipment maximum
Supply voltage external 24 V
Number of electrical connections
• minimum 19.2 V
• for internal network 3
• maximum 28.8 V
• for external network 3
• for DMZ 1 Consumed current maximum 0.7 A
• for signaling contact 1 Product component fusing at Yes
• for power supply 1 power supply input
• for redundant power supply 1 Type of fusing at input Non-replaceable melting fuse
Design of the electrical connection for supply voltage (F 3 A / 32 V)
• for internal network Active power loss at 24V 12 W
• for external network for DC typical
• for DMZ RJ45 port
• for signaling contact 2-pole terminal block
• for power supply 4-pole terminal block
Design of the removable storage Yes
C-PLUG

8/16 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Technical specifications (continued)

Article No. 6GK5627-2BA10-2AA3 Article No. 6GK5627-2BA10-2AA3
Product-type designation SCALANCE S627-2M Product-type designation SCALANCE S627-2M
Permitted ambient conditions Product functions Security
Ambient temperature Design of the firewall Stateful inspection
• during operating -40 … +60 °C Product function with VPN connection IPSec
• during storage -40 … +70 °C
• during transport -40 … +70 °C Type of encryption algorithms AES-256, AES-192, AES-128,
with VPN connection 3DES-168, DES-56
Relative humidity at 25 °C without 95 %
condensation during operating maxi- Type of authentication procedure Preshared key (PSK),
mum with VPN connection X.509v3 certificates

Protection class IP IP20 Type of hashing algorithms MD5, SHA-1

with VPN connection
Design, dimensions and weight
Number of possible connections 128
Design Compact for VPN connection
Width 120 mm Number of network stations
Height 125 mm for internal network
with VPN connection
Depth 124 mm
• maximum 128
Net weight 1.3 kg • note Limitation only applies in bridge
Mounting type mode.
No limitation in routing mode
• 35 mm DIN rail mounting Yes
• S7-300 rail mounting Yes Product function
• wall mounting Yes • Password protection Yes
• bandwidth limiting Yes
Mounting type Screw mounting on horizontal and
vertical surfaces • NAT/NAPT Yes

Product properties, functions, Product functions Time

components general Product function pass on time syn- Yes
Product function DynDNS client Yes chronization

Protocol is supported PPPoE Yes Protocol is supported NTP Yes

Product functions management, Product component Hardware real- Yes

configuration time clock

Product function symbolic names Yes Product property battery-backed Yes

for IP addresses hardware real-time clock

Protocol is supported Standards, specifications,

approvals
• SNMP v1 Yes
• SNMP v3 Yes Standard
• for EMC from FM FM 3611
Type of configuration SCT: Security Configuration Tool
(included in scope of delivery) • for hazardous zone EN 60079-0: 2006, EN60079-15:
2005, II 3 G Ex nA IIT.., KEMA 07

8
Product functions Diagnosis ATEX 0145 X
Product function • for security of CSA and UL UL 60950 / CSA C22.2 No. 60950-00,
UL 508 / CSA C22.2 No. 142
• SysLog Yes
• for emitted interference EN 61000-6-4 : 2007
• Packet Filter Log Yes
• for interference immunity EN 61000-6-2 : 2005
• Audit Log Yes
• System Log Yes Verification of suitability AS/NZS 2064 (Class A),
EN 61000-6-2,
Product functions DHCP EN 61000-6-4, marine classification
Product function DHCP server - Yes pending
internal network • CE mark Yes
• C-Tick Yes
Product functions Routing
Marine classification association
Product function static IP routing Yes
• American Bureau No
of Shipping Europe Ltd. (ABS)
• Bureau Veritas (BV) No
• Det Norske Veritas (DNV) No
• Germanische Lloyd (GL) No
• Lloyds Register of Shipping (LRS) No
• Nippon Kaiji Kyokai (NK) No
• Polski Rejestr Statkow (PRS) No
Accessories
Product expansion optional C-PLUG Yes

Siemens IK PI · 2015 8/17

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE S

■ Ordering data Article No. Article No.

SCALANCE S SOFTNET Security Client

industrial security modules
Software for designing secure
For protecting programmable con- IP-based VPN connections from a
trollers and automation networks programming device/PC to network
and for securing industrial commu- segments which are secured by
nication; Security Modules protect SCALANCE S;
network segments against unau- single license for 1 installation,
thorized access by means of state- runtime software (German/English),
ful inspection firewall; connection of configuring tool (German/English)
more than 10/100/1 000 Mbit/s and electronic manual on CD-ROM
ports; configuring tool and elec- (German/English/French/Spanish/
tronic manual on CD ROM; Italian)
English, German, French, Italian,
Spanish; SOFTNET Security Client 6GK1704-1VW02-0AA0
Edition 2008
SCALANCE S602 6GK5602-0BA10-2AA3
For 32-bit Windows,
SCALANCE S612 6GK5612-0BA10-2AA3 XP Professional + SP1, SP2, SP3
up to 128 VPN tunnels
simultaneously SOFTNET Security Client V3 6GK1704-1VW03-0AA0
SCALANCE S623 6GK5623-0BA10-2AA3 For 32-bit Windows 7 Professional,
up to 128 VPN tunnels Ultimate, Windows XP Professional
simultaneously; + SP3
additional RJ45 DMZ port
SOFTNET Security Client V4 6GK1704-1VW04-0AA0
SCALANCE S627-2M 6GK5627-2BA10-2AA3
For 32/64-bit Windows 7
up to 128 VPN tunnels
Professional/Ultimate
simultaneously;
additional RJ45 DMZ port;
two additional slots for one 2-port
media module each
Accessories
IE FC TP Standard Cable GP 2 x 2 6XV1840-2AH10
(Type A)
4-core, shielded TP installation
cable for connecting to IE FC RJ45
outlet / IE FC RJ45 plug;
PROFINET-compliant;
with UL approval;
sold by the meter;
max. length 1 000 m,
minimum order 20 m
IE FC RJ45 Plug 180
RJ45 plug-in connector for
Industrial Ethernet with a rugged
metal enclosure and integrated
insulation displacement contacts
for connecting Industrial Ethernet
8 FC installation cables;
with 180° cable outlet; for network
components and CPs/CPUs with
Industrial Ethernet interface
• 1 pack = 1 unit 6GK1901-1BB10-2AA0
• 1 pack = 10 units 6GK1901-1BB10-2AB0
• 1 pack = 50 units 6GK1901-1BB10-2AE0
IE FC stripping tool 6GK1901-1GA00
Preadjusted stripping tool for
fast stripping of Industrial Ethernet
FC cables
SITOP compact 24 V/ 0.6 A 6EP1331-5BA00
1-phase power supply
with wide-range input
85 – 264 V AC/110 – 300 V DC,
stabilized output voltage 24 V,
rated output current value 0.6 A,
slim design
C-PLUG 6GK1900-0AB00
Swap medium for simple
replacement of devices in the event
of a fault; for storing configuration Note:
or application data; can be used
for SIMATIC NET products Check the current country list:
with C-PLUG slot http://support.automation.siemens.com/WW/view/en/66627157

■ More information
You will find more information on the topic of Industrial Security
on the Internet at:
http://www.siemens.com/industrialsecurity

8/18 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SCALANCE M

■ Overview
The SCALANCE M874-3 is a mobile wireless router for cost-
effectively and securely connecting Ethernet-based subnets
and programmable controllers via the 3rd generation mobile
wireless network (UMTS) and it supports HSPA+ (High Speed
Packet Access). Thus, it allows high transfer rates of up to
14.4 Mbit/s in the downlink and up to 5.76 Mbit/s in the uplink
(depending on the infrastructure of the mobile wireless
provider).
The SCALANCE M874-2 is a mobile wireless router for cost-
effectively and securely connecting Ethernet-based subnets
and programmable controllers via the 2nd generation mobile
wireless network (GSM) and it supports GPRS (General Packet
Radio Service) and EDGE (Enhanced Data Rates for GSM
Evolution).
The security of access and communication is ensured by the
security functions of the integrated firewall and by VPN tunnels
(end-to-end connection encryption through IPsec tunneling).
SCALANCE M875 is a UMTS router for wireless IP communi-
cation between Industrial Ethernet-based programmable
controllers via mobile radio networks of the 3rd generation
(UMTS) and the 2nd generation (GSM)
• High data transfer rate thanks to HSDPA
• Integrated security functions with firewall
• Use as VPN end point (IPsec)
• Approved for railway applications
SCALANCE M812-1 and SCALANCEM816-1 are DSL routers
for the low-cost and secure connection of Ethernet-based
subnets and automation devices to wired telephone or DSL
networks that support ASDL2+ (Asynchronous Digital Sub-
scriber Line). This allows the devices to have high downlink data
rates of up to 25 Mbit/s and uplink data rates of up to 3.5 Mbit/s.
The security of access and communication is ensured by the
security functions of the integrated firewall and by VPN tunnels
(end-to-end connection encryption through IPsec tunneling).
The SCALANCE M826-2 is an SHDSL modem for low-cost, se-
cure connection of Ethernet-based subnets and programmable
controllers via existing two-wire or stranded cables and supports
the ITU-T standard G.991.2 as well as SHDSL.biz (single-pair
high-speed digital subscriber line). This gives the device high
symmetrical data rates of up to 15.3 Mbit/s per wire pair. 8
The security of access and communication is ensured by the se-
curity functions of the integrated firewall and by VPN tunnels
(end-to-end connection encryption through IPsec tunneling).
Note:
Further information on SCALANCE M can be found in Chapter 7,
Industrial Remote Communication, under "Remote networks/
IP-based modems and routers".

Siemens IK PI · 2015 8/19

 © Siemens AG 2014

Industrial Security
Security Integrated
CP 1243-1 and CP 1543-1

■ Overview
CP 1243-1
The CP 1243-1 communication processor securely connects
the SIMATIC S7-1200 controller to Ethernet networks. With its
integrated security functions of firewall (Stateful Inspection) and
VPN protocol (IPSec), the communications processor protects
S7-1200 stations and lower-level networks against unauthorized
access, and protects the data transmission against manipulation
and espionage by means of encryption. Furthermore, the CP
can also be used for integrating the S7-1200 station into the
TeleControl Server Basic control center software via IP-based
remote networks.

CP 1543-1
The SIMATIC CP 1543-1 communications processor securely
connects the new SIMATIC S7-1500 controller to Industrial
Ethernet networks. With its integrated security functions of fire-
wall (Stateful Inspection), VPN protocol (IPSec) and protocols for
data encryption such as FTPS and SNMPv3, the communica-
tions processor protects S7-1500 stations and lower-level net-
works against unauthorized access, as well as protecting data
transmission against manipulation and espionage by means of
encryption.
Note:
Further information on CP 1243-1 and CP 1543-1 can be
found Chapter 2, PROFINET/Industrial Ethernet, under
"System connection for SIMATIC S7/communication for
SIMATIC S7-1500".

TIA Portal Field PG

Industrial Ethernet

Automation Cell Automation Cell

SIMATIC SIMATIC S7-1200
S7-1500 with with CP 1243-1
CP 1543-1
PROFINET PROFINET
Industrial Industrial
Ethernet Ethernet
G_IK10_XX_10377

S7-300 with S7-300 with

CP 343-1 Lean CP 343-1 Lean
ET 200S ET 200S
SINAMICS SINAMICS

Segmentation of networks and protection of the S7-1500 with CP 1543-1 or S7-1200 with CP 1243-1

8/20 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
CP 343-1 Advanced and CP 443-1 Advanced

■ Overview
CP 343-1 Advanced
Communications processor for connecting the SIMATIC S7-300/
SINUMERIK 840D powerline to Industrial Ethernet networks,
also as PROFINET IO controller and IO device.
The CP supports:
• PG/OP communication
• S7 communication
• Open communication (SEND/RECEIVE)
• PROFINET communication
• IT communication
• Security functionality, firewall and VPN

CP 443-1 Advanced
Communications processor for connecting a SIMATIC S7-400 to
Industrial Ethernet networks, also as PROFINET IO controller or
in SIMATIC H systems.
The CP supports:
• PG/OP communication
• S7 communication
• Open communication (SEND/RECEIVE)
• PROFINET communication
• IT communication
• Security functionality, firewall and VPN
Note:
Further information on the CP 343-1 Advanced and CP 443-1
Advanced can be found in Chapter 2, PROFINET/Industrial
Ethernet, under "System connection for SIMATIC S7 communica-
tion for SIMATIC S7-300 or S7-400".
Alongside the familiar communication functions (integrated
switch and Layer 3 routing functionality) the CP 343-1 Advanced
and CP 443-1 Advanced Industrial Ethernet communications 8
processors also contain the "Security Integrated" function
Stateful Inspection Firewall and a VPN gateway to protect the
controller and lower-level networks against security risks.

Siemens IK PI · 2015 8/21

 © Siemens AG 2014

Industrial Security
Security Integrated
CP 343-1 Advanced and CP 443-1 Advanced

■ Overview (continued)

Field PG PC with management system

and database (e.g. Oracle)

p•‹œš›™ˆ“Gl›Œ™•Œ›

SIMATIC SIMATIC
S7-300 with S7-400 with
CP 343-1 CP 443-1
Advanced Advanced

ET ET
200S 200S

G_IK10_XX_10337
PROFINET PROFINET
Industrial Ethernet Industrial Ethernet

Segmentation of networks and protection of the S7-300 or S7-400 controllers with CP 343-1 Advanced or CP 443-1 Advanced

8/22 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
CP 1628

■ Overview
• PCI Express card (PCIe x1) with its own microprocessor
and integrated 2-port switch (2 x RJ45 connection,
10/100/1 000 Mbit/s) for the connection of a PG/PC to
Industrial Ethernet
• Integrated security mechanisms (e.g. Firewall, VPN)
• ISO and TCP/IP transport protocol on board
• Communications services via
- Open IE communication (TCP/IP and UDP)
- ISO transport protocol
- PG/OP communication
- S7 communication
- Open communication (SEND/RECEIVE)
• Integration into network management systems through the
support of SNMP (V1/V3)
Note:
Further information on the CP 1628 can be found in Chapter 2,
PROFINET/Industrial Ethernet, under "System connection for
PG/PC/IPC/communication for PC-based systems".
Industrial PCs are protected by firewall and VPN via the CP 1628
Industrial Ethernet communications processor – for secure
communication without special operating system settings.
This means that computers equipped with the module can be
connected to protected cells. The CP 1628 makes it possible to
connect SIMATIC PG/PC and PCs with PCI Express slots to
Industrial Ethernet (10/100/1 000 Mbit/s).
Additional field devices can be flexibly connected to Industrial
Ethernet via the integrated switch. Along with the automation
functions familiar from CP 1623, the communications processor
also contains "Security Integrated", i.e. a Stateful Inspection
Firewall and a VPN gateway to protect the PG/PC system against
security risks.

Control center
SIMATIC PCS 7 Client

Terminalbus (Ethernet)

8
PC with 4 x CP 1628 and
HARDNET-IE S7-REDCONNECT
(ISO on TCP)

Internet
Industrial Ethernet router Internet router

Industrial Ethernet
VPN tunnel
Internet

S7-400H with S7-400H with S7-400H with S7-400H with

CP 443-1 CP 443-1 CP 443-1 CP 443-1
Advanced Advanced Advanced Advanced
G_IK10_XX_10354

PROFINET PROFIBUS

Secure redundant connection to CP 1628 and CP 443-1 Advanced

Siemens IK PI · 2015 8/23

 © Siemens AG 2014

Industrial Security
Security Integrated
SOFTNET Security Client

■ Overview
• The SOFTNET Security Client is a component of the Industrial • Data transmission is protected against operator error,
Security concept for protecting programmable controllers and eavesdropping/espionage and manipulation; communication
for security during data exchange between automation can only take place between authenticated and authorized
systems. devices
• It is a VPN client for programming devices, PCs and • Use of field-proven IPsec mechanisms for setting up and
notebooks in industrial environments and supports secure operating VPNs.
client access via LAN or even WAN (e.g. for remote mainte-
nance via the Internet) to automation systems protected by
Security Integrated devices with VPN functionality

PC/IPC with IPC SCALANCE PC/PG/Notebook

SOFTNET W788-1RJ45 with SOFTNET
Security Client access point Security Client software
software

PROFINET VPN tunnel

Industrial Ethernet

Security Module
SCALANCE S

SIMATIC S7-400 SIMATIC S7-300

with CP 443-1 Advanced with CP 343-1
Secure access (VPN tunnel)

PROFINET PROFINET

Industrial Ethernet Industrial Ethernet

G_IK10_XX_10254
ET 200S S7-300 with ET 200S ET 200M
CP 343-1 Lean

8 Automation cell 1 Automation cell 2

Secure access to automation cells protected by Security Integrated devices with VPN functionality with the SOFTNET Security Client

■ Benefits ■ Application
The security modules of the SCALANCE S family are provided
specially for use in automation, yet connect seamlessly with
the security structures of the office and IT world. They provide
security and meet the specific requirements of automation
• Avoidance of system disruptions through exclusive access to technology, such as simple upgrades of existing systems,
programmable controllers or complete automation cells using simple installation and minimum downtimes if a fault occurs.
approved programming devices or notebooks
Depending on the particular security needs, various
• High flexibility when used on mobile PCs as no hardware is different security measures can be combined. The SOFTNET
required for securing the communication Security Client allows programming devices, PCs, and note-
• Uniform configuration and integrated security concept for books access to devices with IPSec VPN functionality
automation engineering with SCALANCE S, the security (e.g. SCALANCE S, SCALANCE M, CP 1243-1, CP 1543-1,
S7-CPs (CP 1243-1, CP 1543-1, CP 343-1 Adv., CP 343-1/CP 443-1 Advanced, CP 1628), protected network
CP 443-1 Adv.), the PC-CP 1628, the CP 1543-1, stations or automation systems.
the CP 1243-1 and the SOFTNET Security Client without
special IT know-how
• Protection of data transmission against espionage and
manipulation based on certified standards
• Considerable savings when used as a remote maintenance
solution together with SCALANCE S and SCALANCE M
compared to expensive service callouts

8/24 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
SOFTNET Security Client

■ Function ■ Ordering data

Authentication SOFTNET Security Client V4 HF1 6GK1704-1VW04-0AA0
Since IP addresses can be falsified (IP spoofing), checking the Software for designing secure
IP address (of the client access) is not sufficient for reliable IP-based VPN connections from a
programming device/PC to network
authentication. In addition to this, Client PCs may have changing segments which are secured by
IP addresses. For this reason, the authentication is performed SCALANCE S, SCALANCE M,
using tried and tested VPN mechanisms. CP 1243-1, CP 1543-1,
CP 343-1 Advanced,
Data encryption CP 443-1 Advanced, CP 1628,
CP 1543-1 or CP 1243-1;
Secure encryption is necessary to protect data traffic from single license for 1 installation,
espionage and manipulation. This means that the data traffic runtime software (German/English),
remains incomprehensible to any eavesdropper in the network. configuration tool (German/English),
To achieve this, the SOFTNET Security Client establishes con- and electronic manual on CD-ROM
(German/English/French/Spanish/
nections on IPSec based VPN tunnels to other SCALANCE S, Italian) for Windows 7 Professional,
SCALANCE M, the S7 Security CPs or the PC-CP 1628. Ultimate, Windows XP Professional
(32 bit) + SP3
Performance data
SCALANCE S Industrial Security Modules
System requirements (please note the descriptions under
For protection of programmable
"Ordering data"): controllers and automation networks,
Windows 7 Professional or Ultimate 32/64-bit and for securing of industrial commu-
Windows XP Professional (32-bit) + SP3 nication; configuration tool and elec-
tronic manual on CD-ROM
Configuration German, English, French, Italian,
Spanish
Using the associated configuration tool it is possible to create
and manage security rules even without special security knowl- SCALANCE S612 6GK5612-0BA10-2AA3
edge. In the simplest case, only the SCALANCE S modules or Up to 128 VPN tunnels
SOFTNET Security Clients that will communicate with each other simultaneously
are created and configured. As soon as SOFTNET Security SCALANCE S623 6GK5623-0BA10-2AA3
Client knows the programmable controllers to be accessed,
up to 128 VPN tunnels
communication can be established. simultaneously;
additional RJ45 DMZ port
SCALANCE S627-2M 6GK5627-2BA10-2AA3
up to 128 VPN tunnels
simultaneously;
additional RJ45 DMZ port;
two additional slots for one 2-port
media module each
SCALANCE M industrial modems and routers
SCALANCE M874
mobile radio router
Mobile radio router for wireless IP
communication from Industrial
Ethernet-based subnets and pro- 8
grammable controllers via UMTS or
GSM mobile radio networks;
with integrated firewall and VPN
with IPsec;
2 x RJ45 ports,
1 x antenna connection
• SCALANCE M874-31) 6GK5874-3AA00-2AA2
• SCALANCE M874-21) 6GK5874-2AA00-2AA2
SCALANCE M875 UMTS router
UMTS router for wireless IP
communication from Industrial
Ethernet-based programmable
controllers via UMTS/GSM mobile
radio networks;
EGPRS Multislot Class 12;
with integrated firewall and VPN
with IPsec;
2 x RJ45 ports,
2 x antenna connections
• SCALANCE M8751) 6GK5875-0AA10-1AA2
• SCALANCE M8751) 6GK5875-0AA10-1CA2
for Japan

Siemens IK PI · 2015 8/25

 © Siemens AG 2014

Industrial Security
Security Integrated
SOFTNET Security Client

■ Ordering data Article No. Article No.

SCALANCE M industrial modems and routers (continued) Communications processors for SIMATIC S7 (continued)
SCALANCE M81x-1 ADSL router CP 443-1 Advanced 6GK7443-1GX30-0XE0
communications processor;
DSL router for wired
IP communication from Industrial For the connection of
Ethernet-based subnets and SIMATIC S7-400 to Industrial
programmable controllers via Ethernet;
telephone or DSL networks; PROFINET IO Controller with RT and
with integrated firewall and VPN IRT, MRP, PROFINET CBA, TCP/IP,
with IPsec; ISO and UDP;
1 x or 4 x RJ45 ports S7 communication, open communi-
for Industrial Ethernet; cation (SEND/RECEIVE) with
1 x RJ45 port for DSL FETCH/WRITE, with and without
• SCALANCE M812-1 (Annex A) 6GK5812-1AA00-2AA2 RFC1006, diagnostics expansions,
• SCALANCE M812-1 (Annex B) 6GK5812-1BA00-2AA2 multicast, clock synchronization
with SIMATIC mode or NTP,
• SCALANCE M816-1 (Annex A) 6GK5816-1AA00-2AA2 access protection by IP access list,
• SCALANCE M816-1 (Annex B) 6GK5816-1BA00-2AA2 FTP client/server, HTTP server,
HTML diagnostics, SNMP, DHCP,
SCALANCE M826-2 SHDSL router
e-mail, data storage on C-PLUG;
DSL router for wired PROFINET connector:
IP communication from Industrial 4xRJ45 (10/100 Mbit/s) via switch;
Ethernet-based subnets and Gigabit connector:
programmable controllers 1xRJ45 (10/100/1 000 Mbit/s);
via telephone or DSL networks; with integrated stateful inspection
with integrated firewall and VPN firewall and VPN appliance
with IPsec;
Communications processors for PG/PC/IPC
1 x or 4 x RJ45 ports
for Industrial Ethernet; CP 1628 6GK1162-8AA00
1 x RJ45 port for DSL communications processor;
• SCALANCE M826-2 (Annex A) 6GK5826-2AB00-2AB2 PCI Express x1 card for connection
to Industrial Ethernet
Communications processors for SIMATIC S7 (10/100/1 000 Mbit/s),
CP 1243-1 6GK7243-1BX30-0XE0 with 2-port switch (RJ45) and
communication processor; integrated security (firewall, VPN)
for connection of SIMATIC S7-1200 via HARDNET-IE S7 and
to Industrial Ethernet via TCP/IP, ISO S7-REDCONNECT.
and UDP, Telecontrol Server Basic For operating system support,
and security functions Stateful see SIMATIC NET Software
Inspection Firewall and VPN; Accessories
1 x RJ45 interface
with 10/100 Mbit/s IE FC RJ45 Plug 180
CP 1543-1 6GK7543-1AX00-0XE0 RJ45 plug connector for Industrial
communication processor; Ethernet with a rugged metal
for connection of SIMATIC S7-1500 enclosure and integrated insulation
to Industrial Ethernet via TCP/IP, ISO displacement contacts for connect-
and UDP and security functions ing Industrial Ethernet FC installation
Stateful Inspection Firewall and cables; with 180° cable outlet;
VPN; 1 x RJ45 interface for network components and

8 with 10/100/1 000 Mbit/s;

CP 343-1 Advanced 6GK7343-1GX31-0XE0
CPs/CPUs with Industrial Ethernet
interface
• 1 pack = 1 unit 6GK1901-1BB10-2AA0
communications processor;
• 1 pack = 10 units 6GK1901-1BB10-2AB0
For connection of SIMATIC S7-300 • 1 pack = 50 units 6GK1901-1BB10-2AE0
to Industrial Ethernet over ISO
and TCP/IP; ANT794-4MR antenna 6NH9860-1AA00
PROFINET IO Controller or
PROFINET IO Device, MRP, Omnidirectional antenna for GSM
integrated 2-port switch ERTEC; (2G) and UMTS (3G) networks;
S7 communication, open communi- weather-resistant for indoor and
cation (SEND/RECEIVE), FETCH/ outdoor use;
WRITE, with and without RFC1006, 5 m cable with fixed connection
multicast, DHCP, to antenna;
CPU clock synchronization via SMA connector;
SIMATIC procedure and NTP, including mounting bracket, screws,
diagnostics, SNMP, access protec- wall plugs
tion through IP access list,
initialization over LAN 10/100 Mbit/s;
as well as IT communication
(web, e-mail, FTP); PROFINET CBA;
security (firewall/VPN); Note:
PROFIenergy; Check the current country list:
with electronic manual on DVD
http://support.automation.siemens.com/WW/view/en/66627157

8/26 Siemens IK PI · 2015

 © Siemens AG 2014

Industrial Security
Security Integrated
Industrial Security Services

■ Overview

Step 1: Step 2: Step 3:

Assess Implement Operate &
Manage

Know your security Engineering, design and Provide continuous protection

posture and develop implementation of a holistic through proactive defense
a security roadmap cyber security program

Vulnerability assessment Cyber security training Global threat intelligence

G_IK10_XX_10376
Threat assessment Development of security Incident detection and
Risk analysis policies and procedures remediation
Implementation of security Timely response to the
technology changing threat landscape

The merge of data systems in the production and office environ- In the second "implementation" stage - the measures defined in
ments has made many processes faster and easier, while the the assessment are implemented, i.e.:
use of the same data processing programs creates synergies. • Training:
These developments, however, have also increased the security Personnel are given specific training so that they understand
risk. what IT and infrastructure security means in the industrial
Today it is no longer just the office environment that is under environment.
threat from viruses, trojans and hackers - production plants are • Process improvement:
also at risk of malfunctions and data loss. Many weak spots in Security-relevant regulations and guidelines relating to the
security are not obvious at first glance. For this reason, it is existing plant requirements are drawn up and implemented.
advisable to check existing plants in regard to security and to • Security technologies:
optimize them in order to maintain a higher level of plant avail- Protective measures are implemented for hardware and
ability. To enhance the security of a plant against cyber attacks, software, as well as in the plant network; in addition, long-term
a multi-level service concept for Industrial Security is available protection through monitoring is available.
from Siemens Industry.
The first step involves "assessment" – the initial examination of
The measures defined and implemented in the first two phases
are continuously developed in the third phase of "operation and
8
the existing plant. This identifies weak spots or deviations from management", i.e. monitoring the security status of the plant,
standards. The result of this examination is a detailed report checking the security level, redefining and optimizing actions,
about the actual status of the plant with a description of the weak as well as regular reports and functions such as updates,
points and an assessment of the risks. The report also contains backup and restore. Even if changes are made to the plant net-
suggested actions for improving the level of security. work, the software environment or the administration of access
rights for users and administrators, services increase the secu-
rity level so that the corresponding data remains in the plant and
attackers are given minimal opportunities to compromise the
plant. The phases of implementation, operation and manage-
ment are tailored precisely to meet the existing needs.

Siemens IK PI · 2015 8/27

 © Siemens AG 2014

Industrial Security
Security Integrated
Industrial Security Services

■ Benefits ■ Ordering data Article No.

Customer benefits Security assessment 9AS1411-1AA11-1AA1

• Determination of the security level and, based on this, drawing for complete plants
up a plan of action for reducing the risks Risk and Vulnerability On request
Assessment
• Specific training for building up technical knowledge
Customized analyses, projects On request
• Increasing plant security through tailored processes and and advice
specifications
• Implementation of a comprehensive security solution for
protecting the automation system ■ More information
• Connection to a Managed Service Center for continuous Further information can be found at:
monitoring of the security status of the plant www.siemens.com/industrialsecurity
• Continuous monitoring of the security status of the plant
• Detection of incidents and adaptation of the environment to
the threat
• Keeping the system up to date (pattern, patches, signatures).

8/28 Siemens IK PI · 2015