EcoStruxure Control Expert

Security Editor
Operation Guide
Original instructions

EIO0000004105.03
12/2023

www.se.com
Legal Information
The information provided in this document contains general descriptions, technical
characteristics and/or recommendations related to products/solutions.
This document is not intended as a substitute for a detailed study or operational and
site-specific development or schematic plan. It is not to be used for determining
suitability or reliability of the products/solutions for specific user applications. It is the
duty of any such user to perform or have any professional expert of its choice
(integrator, specifier or the like) perform the appropriate and comprehensive risk
analysis, evaluation and testing of the products/solutions with respect to the relevant
specific application or use thereof.
The Schneider Electric brand and any trademarks of Schneider Electric SE and its
subsidiaries referred to in this document are the property of Schneider Electric SE or
its subsidiaries. All other brands may be trademarks of their respective owner.
This document and its content are protected under applicable copyright laws and
provided for informative use only. No part of this document may be reproduced or
transmitted in any form or by any means (electronic, mechanical, photocopying,
recording, or otherwise), for any purpose, without the prior written permission of
Schneider Electric.
Schneider Electric does not grant any right or license for commercial use of the
document or its content, except for a non-exclusive and personal license to consult it
on an "as is" basis.
Schneider Electric reserves the right to make changes or updates with respect to or in
the content of this document or the format thereof, at any time without notice.
To the extent permitted by applicable law, no responsibility or liability is
assumed by Schneider Electric and its subsidiaries for any errors or omissions
in the informational content of this document, as well as any non-intended use
or misuse of the content thereof.
 Security Editor

Table of Contents
Safety Information.......................................................................................4
Before You Begin........................................................................................4
Start-up and Test ........................................................................................5
Operation and Adjustments .........................................................................6
About the Book ............................................................................................7
Security Editor Tool Implementation ...................................................... 11
Access Security Management ...................................................................12
Security Editor..........................................................................................16
Server .....................................................................................................17
User Information.......................................................................................19
User Functions .........................................................................................20
User Profiles ............................................................................................24
Policies....................................................................................................27
Login Policies...........................................................................................29
Certificate Actions.....................................................................................34
Certificate Whitelist ...................................................................................36
Client-Server Architecture for Security Editor ..............................................38
Configure a Controller for Use with EcoStruxure Control Expert Classic
Through the Enforced Engineering Link......................................................40
Syslog Events ..........................................................................................42
Recovery Procedure with a Detected Error .................................................43
EcoStruxure Control Expert Predefined Profiles .........................................44
EcoStruxure Control Expert and EcoStruxure Control Expert Classic
Access Rights ..........................................................................................46
EcoStruxure Control Expert and EcoStruxure Control Expert Classic
Access Rights Assigned to Predefined Profiles ...........................................52
OS Loader Access Rights .........................................................................59
Assigned OS Loader Access Rights to Predefined Profiles ..........................60
Security Database Migration Tool...............................................................61
Index ...........................................................................................................62

EIO0000004105.03 3
Security Editor Safety Information

Safety Information
Important Information
Read these instructions carefully, and look at the equipment to become familiar
with the device before trying to install, operate, service, or maintain it. The
following special messages may appear throughout this documentation or on the
equipment to warn of potential hazards or to call attention to information that
clarifies or simplifies a procedure.

The addition of this symbol to a “Danger” or “Warning” safety label indicates that an
electrical hazard exists which will result in personal injury if the instructions are not
followed.

This is the safety alert symbol. It is used to alert you to potential personal injury
hazards. Obey all safety messages that follow this symbol to avoid possible injury or
death.

! DANGER
DANGER indicates a hazardous situation which, if not avoided, will result in death or serious
injury.

! WARNING
WARNING indicates a hazardous situation which, if not avoided, could result in death or
serious injury.

! CAUTION
CAUTION indicates a hazardous situation which, if not avoided, could result in minor or
moderate injury.

NOTICE
NOTICE is used to address practices not related to physical injury.

Please Note
Electrical equipment should be installed, operated, serviced, and maintained only
by qualified personnel. No responsibility is assumed by Schneider Electric for any
consequences arising out of the use of this material.
A qualified person is one who has skills and knowledge related to the construction
and operation of electrical equipment and its installation, and has received safety
training to recognize and avoid the hazards involved.

Before You Begin

Do not use this product on machinery lacking effective point-of-operation
guarding. Lack of effective point-of-operation guarding on a machine can result in
serious injury to the operator of that machine.

4 EIO0000004105.03
Safety Information Security Editor

WARNING
UNGUARDED EQUIPMENT
• Do not use this software and related automation equipment on equipment
which does not have point-of-operation protection.
• Do not reach into machinery during operation.
Failure to follow these instructions can result in death, serious injury, or
equipment damage.

This automation equipment and related software is used to control a variety of

industrial processes. The type or model of automation equipment suitable for each
application will vary depending on factors such as the control function required,
degree of protection required, production methods, unusual conditions,
government regulations, etc. In some applications, more than one processor may
be required, as when backup redundancy is needed.
Only you, the user, machine builder or system integrator can be aware of all the
conditions and factors present during setup, operation, and maintenance of the
machine and, therefore, can determine the automation equipment and the related
safeties and interlocks which can be properly used. When selecting automation
and control equipment and related software for a particular application, you should
refer to the applicable local and national standards and regulations. The National
Safety Council's Accident Prevention Manual (nationally recognized in the United
States of America) also provides much useful information.
In some applications, such as packaging machinery, additional operator protection
such as point-of-operation guarding must be provided. This is necessary if the
operator's hands and other parts of the body are free to enter the pinch points or
other hazardous areas and serious injury can occur. Software products alone
cannot protect an operator from injury. For this reason the software cannot be
substituted for or take the place of point-of-operation protection.
Ensure that appropriate safeties and mechanical/electrical interlocks related to
point-of-operation protection have been installed and are operational before
placing the equipment into service. All interlocks and safeties related to point-of-
operation protection must be coordinated with the related automation equipment
and software programming.
NOTE: Coordination of safeties and mechanical/electrical interlocks for point-
of-operation protection is outside the scope of the Function Block Library,
System User Guide, or other implementation referenced in this
documentation.

Start-up and Test

Before using electrical control and automation equipment for regular operation
after installation, the system should be given a start-up test by qualified personnel
to verify correct operation of the equipment. It is important that arrangements for
such a check are made and that enough time is allowed to perform complete and
satisfactory testing.

WARNING
EQUIPMENT OPERATION HAZARD
• Verify that all installation and set up procedures have been completed.
• Before operational tests are performed, remove all blocks or other temporary
holding means used for shipment from all component devices.
• Remove tools, meters, and debris from equipment.
Failure to follow these instructions can result in death, serious injury, or
equipment damage.

EIO0000004105.03 5
Security Editor Safety Information

Follow all start-up tests recommended in the equipment documentation. Store all
equipment documentation for future references.
Software testing must be done in both simulated and real environments.
Verify that the completed system is free from all short circuits and temporary
grounds that are not installed according to local regulations (according to the
National Electrical Code in the U.S.A, for instance). If high-potential voltage
testing is necessary, follow recommendations in equipment documentation to
prevent accidental equipment damage.
Before energizing equipment:
• Remove tools, meters, and debris from equipment.
• Close the equipment enclosure door.
• Remove all temporary grounds from incoming power lines.
• Perform all start-up tests recommended by the manufacturer.

Operation and Adjustments

The following precautions are from the NEMA Standards Publication ICS 7.1-
1995:
(In case of divergence or contradiction between any translation and the English
original, the original text in the English language will prevail.)
• Regardless of the care exercised in the design and manufacture of equipment
or in the selection and ratings of components, there are hazards that can be
encountered if such equipment is improperly operated.
• It is sometimes possible to misadjust the equipment and thus produce
unsatisfactory or unsafe operation. Always use the manufacturer’s
instructions as a guide for functional adjustments. Personnel who have
access to these adjustments should be familiar with the equipment
manufacturer’s instructions and the machinery used with the electrical
equipment.
• Only those operational adjustments required by the operator should be
accessible to the operator. Access to other controls should be restricted to
prevent unauthorized changes in operating characteristics.

6 EIO0000004105.03
About the Book Security Editor

About the Book

Document Scope
This operation guide describes the implementation of the Security Editor tool.

Validity Note
This documentation is valid for EcoStruxure™ Control Expert 16.0.
For product compliance and environmental information (RoHS, REACH, PEP,
EOLI, etc.), go to www.se.com/ww/en/work/support/green-premium/.

Available Languages of this Document

This document is available in these languages:
• English (EIO0000004105 (ENG))
• French (EIO0000004106 (FRE))
• German (EIO0000004107 (GER))
• Spanish (EIO0000004109 (SPA))
• Italian (EIO0000004108 (ITA))
• Chinese (EIO0000004110 (CHS))

Related Documents
Title of documentation Reference number
EcoStruxure™ Control Expert, Installation 35014792 (FRE)
Manual 35014793 (ENG)
35014794 (GER)
35014795 (SPA)
35014796 (ITA)
35012191 (CHS)

Modicon M580, Hardware, Reference Manual EIO0000001578 (ENG)

EIO0000001579 (FRE)
EIO0000001580 (GER)
EIO0000001582 (ITA)
EIO0000001581 (SPA)
EIO0000001583 (CHS)

To find documents online, visit the Schneider Electric download center

(www.se.com/ww/en/download/).

EIO0000004105.03 7
Security Editor About the Book

Product Related Information

WARNING
LOSS OF CONTROL
• Perform a Failure Mode and Effects Analysis (FMEA), or equivalent risk
analysis, of your application, and apply preventive and detective controls
before implementation.
• Provide a fallback state for undesired control events or sequences.
• Provide separate or redundant control paths wherever required.
• Supply appropriate parameters, particularly for limits.
• Review the implications of transmission delays and take actions to mitigate
them.
• Review the implications of communication link interruptions and take actions
to mitigate them.
• Provide independent paths for control functions (for example, emergency
stop, over-limit conditions, and error conditions) according to your risk
assessment, and applicable codes and regulations.
• Apply local accident prevention and safety regulations and guidelines.1
• Test each implementation of a system for proper operation before placing it
into service.
Failure to follow these instructions can result in death, serious injury, or
equipment damage.

1For additional information, refer to NEMA ICS 1.1 (latest edition), Safety
Guidelines for the Application, Installation, and Maintenance of Solid State Control
and to NEMA ICS 7.1 (latest edition), Safety Standards for Construction and
Guide for Selection, Installation and Operation of Adjustable-Speed Drive
Systems or their equivalent governing your particular location.

WARNING
UNINTENDED EQUIPMENT OPERATION
• Only use software approved by Schneider Electric for use with this
equipment.
• Update your application program every time you change the physical
hardware configuration.
Failure to follow these instructions can result in death, serious injury, or
equipment damage.

The examples in this manual are given for information only.

WARNING
UNINTENDED EQUIPMENT OPERATION
Adapt examples given herein to the specific functions and requirements of your
industrial application before you implement them.
Failure to follow these instructions can result in death, serious injury, or
equipment damage.

Trademarks
Microsoft, Windows, Windows Server, and Windows Defender are either
registered trademarks or trademarks of Microsoft Corporation in the United States
and/or other countries.

8 EIO0000004105.03
About the Book Security Editor

Information on Non-Inclusive or Insensitive Terminology

As a responsible, inclusive company, Schneider Electric is constantly updating its
communications and products that contain non-inclusive or insensitive
terminology. However, despite these efforts, our content may still contain terms
that are deemed inappropriate by some customers.

EIO0000004105.03 9
Security Editor About the Book

Terminology Derived from Standards

The technical terms, terminology, symbols and the corresponding descriptions in
the information contained herein, or that appear in or on the products themselves,
are generally derived from the terms or definitions of international standards.
In the area of functional safety systems, drives, and general automation, this may
include, but is not limited to, terms such as safety, safety function, safe state, fault,
fault reset, malfunction, failure, error, error message, dangerous, etc.
Among others, these standards include:

Standard Description

IEC 61131-2:2007 Programmable controllers, part 2: Equipment requirements and tests.

ISO 13849-1:2023 Safety of machinery: Safety related parts of control systems.

General principles for design.

EN 61496-1:2013 Safety of machinery: Electro-sensitive protective equipment.

Part 1: General requirements and tests.

ISO 12100:2010 Safety of machinery - General principles for design - Risk assessment and
risk reduction
EN 60204-1:2006 Safety of machinery - Electrical equipment of machines - Part 1: General
requirements

ISO 14119:2013 Safety of machinery - Interlocking devices associated with guards - Principles
for design and selection

ISO 13850:2015 Safety of machinery - Emergency stop - Principles for design

IEC 62061:2021 Safety of machinery - Functional safety of safety-related electrical, electronic,

and electronic programmable control systems

IEC 61508-1:2010 Functional safety of electrical/electronic/programmable electronic safety-

related systems: General requirements.

IEC 61508-2:2010 Functional safety of electrical/electronic/programmable electronic safety-

related systems: Requirements for electrical/electronic/programmable
electronic safety-related systems.

IEC 61508-3:2010 Functional safety of electrical/electronic/programmable electronic safety-

related systems: Software requirements.

IEC 61784-3:2021 Industrial communication networks - Profiles - Part 3: Functional safety

fieldbuses - General rules and profile definitions.

2006/42/EC Machinery Directive

2014/30/EU Electromagnetic Compatibility Directive

2014/35/EU Low Voltage Directive

In addition, terms used in the information contained herein may tangentially be

used as they are derived from other standards such as:

Standard Description

IEC 60034 series Rotating electrical machines

IEC 61800 series Adjustable speed electrical power drive systems

IEC 61158 series Digital data communications for measurement and control – Fieldbus for use
in industrial control systems

Finally, the term zone of operation may be used in conjunction with the description
of specific hazards, and is defined as it is for a hazard zone or danger zone in the
Machinery Directive (2006/42/EC) and ISO 12100:2010.
NOTE: The aforementioned standards may or may not apply to the specific
products cited in the present documentation. For more information concerning
the individual standards applicable to the products described herein, see the
characteristics tables for those product references.

10 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Security Editor Tool Implementation

About the Tool
This document describes the implementation of the Security Editor tool.
The tool is installed automatically as part of EcoStruxure Control Expert.
EcoStruxure Control Expert Classic operates without additional configuration of
the Security Editor. You must configure at least one Topology Manager user in the
Security Editor before you can access its functions and features.
The level of security is determined by your risk analysis and your requirements for
the security, environmental, and application needs.

EIO0000004105.03 11
Security Editor Security Editor Tool Implementation

Access Security Management

Conceptual Diagram
Launch and use the Security Editor tool to control access to the different
functionalities of EcoStruxure Control Expert and the associated loader
management software.
When you install and set up the Security Editor tool, a security database is
automatically created with one administrative user (SecurityAdmin). The database
contains definitions for users, user profiles, and user-access rights:

NOTE: Protected access to the EcoStruxure Control Expert and loader

management software is optional. In EcoStruxure Control Expert, the
Security option of the protected access is set to OFF by default.
Access to EcoStruxure Control Expert is applicable to the terminal on which the
software (not the project) is installed. The project has its own protection system.
A log file can contain a chronological record of the various operations carried out
by users with access to the software.

SecurityAdmin User
The SecurityAdmin username is reserved for the administrator of the Security
Editor tool.
NOTE: The SecurityAdmin user performs the administrative role that was
handled by the Supervisor (super user) in legacy versions of EcoStruxure
Control Expert (those that predate version 15.3).
After the EcoStruxure Control Expert software is installed on a workstation, only
the predefined SecurityAdmin user can launch the Security Editor and edit the
security configurations after the authentication.
The first time you launch the Security Editor tool, you are prompted to create a
password for the SecurityAdmin user:

Step Action

1 Launch the Security Editor application.

2 In the Username field on the sign-in screen, enter the SecurityAdmin username.

3 Change the SecurityAdmin password in the User Information tab, page 19.

12 EIO0000004105.03
Security Editor Tool Implementation Security Editor

The SecurityAdmin has a unique profile within the Security Editor. Only this user
has the administrative rights to manage the security database and define a list of
user names and their respective access rights to the software.
The SecurityAdmin can perform these tasks:
• Create or modify the user list.
• Create or modify user profiles.
• Disable one or more users.
• Modify the rules for software access security.
• Modify the SecurityAdmin password.
• Reset user passwords.
• Configure the authentication mechanism for a local or centralized database of
users and their associated access rights.
• Generate, use, and manage certificates and create a list of certificates for the
authentication of trusted computers.

Security Database Migration

During the migration of the security database, the database is automatically re-
created with only one administrative user.
At that time, it is possible to recover security databases that were created with
earlier versions of EcoStruxure Control Expert if you follow the prompts during the
migration.
The responsibilities associated with the former administrator role (Supervisor) are
automatically transferred to the new SecurityAdmin role. Therefore, during the
migration of the security database, the existing password is replaced by the
password that was defined by the SecurityAdmin user.

User Profile
A user profile includes the defined access rights for a user. It is defined by a name,
an optional comment (maximum of 256 characters), and a list of access rights.
Security Editor provides 10 preconfigured profiles that cannot be modified. To
complete this list, the SecurityAdmin can create personalized profiles.

EIO0000004105.03 13
Security Editor Security Editor Tool Implementation

Predefined Users and User Profiles

The Security Editor provides 10 predefined users and 10 predefined profiles that
cannot be modified. The predefined users can be enabled or disabled by the
SecurityAdmin.
These are the predefined users and the corresponding predefined profiles
(according to the selected product):

Predefined User Predefined Product Profile

Security Editor EcoStruxure Control Loader management
Expert software

safety_user_Adjust ReadOnly Safety_Adjust —

safety_user_Debug ReadOnly Safety_Debug —

safety_user_Operate ReadOnly Safety_Operate —

safety_user_Program ReadOnly Safety_Program —

SecurityAdmin SecurityAdmin — —

user_Adjust ReadOnly Adjust —

user_Debug ReadOnly Debug —

user_Operate ReadOnly Operate —

user_Program ReadOnly Program Program

user_ReadOnly ReadOnly ReadOnly ReadOnly

NOTE: By default, the predefined users are disabled.

Default User Profile

When the software access security is active, the SecurityAdmin can authorize
these types of access for specific users while retaining control of the environment.
• Security on, no login: Open a software instance without entering a user
name and password.
• Security on, avoidable login: Enter a user name without a password.
NOTE: In these cases, the user has a default profile by way of your selection
for the Fixed profile under the Policies tab. (Refer to the description of login
parameters on the Policies tab, page 27).

Log Information Generated by the Security Editor

Security Editor log information can be displayed by the Microsoft Windows Event
Viewer. Here you can sort and filter according to the server sequential events.

Multiple Instancing
When EcoStruxure Control Expert executes multiple instances concurrently on the
same terminal, each instance grants access to the functions that were defined by
the rights of the user who created this instance.

14 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Centralized Security Database

EcoStruxure Control Expert (Topology Manager) is based on a client-server
architecture. For more information on this architecture, refer to the EcoStruxure™
Control Expert, Installation Manual.
The SecurityAdmin performs the following tasks to administer a centralized
security database:
• Define users, user profiles, and user access rights on the remote Topology
Manager server.
• Deploy the centralized security database to client workstations.
The Security Editor tool, which is automatically installed with EcoStruxure Control
Expert, administers its own local security database.

EIO0000004105.03 15
Security Editor Security Editor Tool Implementation

Security Editor
Introduction
The Security Editor is used to define software users and their access rights. It also
allows you to define which actions are protected (by user name and password)
and stored in the log file.

Launching the Security Editor

Start the Security Editor:

Step Action

1 Open with Start > Programs > EcoStruxure Control Expert > Security Editor to see
the Enter user name and password dialog box.
NOTE: The dialog box has two text fields:
• Name
• Password
2 Enter your name and password in the appropriate fields and select OK.

3 If you are a SecurityAdmin user, page 12, you can access the User information screen,
page 19, where you can consult your user profile or modify your password.

16 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Server
Introduction
Use the configuration settings in the Server group box at the top of each Security
Editor tab to configure the local security service to run as a server that receives
authentication requests from other computers on the network. Those other
computers, therefore, function as clients in a client-server architecture.
NOTE: This guide includes a use-case example that shows the functionality of
Security Editor in a client-server relationship, page 38.
A user in the SecurityAdmin role can perform a Customized installation of
EcoStruxure Control Expert to install the Security Editor as a server in the
absence of a complete installation of EcoStruxure Control Expert (Classic or with
Topology Manager). For more information, refer to the EcoStruxure™ Control
Expert, Installation Manual.

Server Parameters
These are the configuration settings in the Server group box:

Parameter Description

SecurityService Select this checkbox to configure a computer to run Security Editor as a

as server server that allows access to its configuration data and user profiles by
authorized clients.

In this case, Security Editor that runs on a client computer can target the
server computer using the Network protocol from the Centralized Protocol
menu on the Login Policies tab.
NOTE: The server requires a valid security service certificate to start. It
is therefore possible that a server does not run even when the
SecurityService as server parameter is selected. In this case, the
SecurityAdmin uses the instructions to generate a certificate on the
Certificate Actions tab, page 34.

Port nb Enter the port number that Security Editor uses to connect to a client
computer.

Server State This field reports the availability of the server:

• Available after Security Editor restart: The parameters
SecurityService as server and Port nb are not dynamically
processed. The SecurityService server restarts with the new settings
only after Security Editor closes.
• Running: The SecurityService server is running.
• Stopped: The SecurityService server is not running.

EIO0000004105.03 17
Security Editor Security Editor Tool Implementation

Restart Security Editor to implement the modified Port nb and Server State
parameters:

Step Action

1 Select OK to close the Security Editor tool.

2 Reopen the Security Editor tool to confirm that the server runs with the modified
parameters.

18 EIO0000004105.03
Security Editor Tool Implementation Security Editor

User Information
Introduction
This topic describes the parameters and functions that are available when you
select the User Information tab in the Security Editor tool.
All users can access this tab in order to consult their profiles and the associated
user rights. Only the SecurityAdmin user can modify the passwords.

Parameter Descriptions
The User Information tab indicates the name of the user and some
corresponding parameters.

Field Description

Name Select the name of the applicable user from this pull-down menu.

Status This read-only field displays one of these status for the active user:
• Expired: The password is expired.
• Valid until the <Expiration Date>: The password is active until the
displayed expiration date.
• Valid: The password is active without a time limit.

Configure these parameters for the selected user:

Group Component Description

Box
Password New password Enter the new password in this field. See important Safety and
Security Information found at the end of this table.

Confirm the new Reenter the new password in this field.

password

Apply Select Apply to save and apply the new password.

NOTE: SelectOK to save the new password for future use.

Profile(s) Product From this pull-down menu, select the product for which you want
to display the user profile.

Profile When you make a selection in the Name pull-down menu on this
tab, the name of the corresponding profile appears in this field.

View profile Select View profile to open the View profile dialog box, which
displays the access rights in the user profile.
NOTE: The Access rights list in this dialog box changes
to show the final access rights for users with multiple
profiles. These access rights are present when at least one
of the profiles in the multiple profiles contains that right.

If you are choosing to implement security, it is essential that you establish secure,
robust passwords for all users, whether you are enabling predefined users or
custom users.

WARNING
UNAUTHENTICATED ACCESS
Immediately define secure passwords upon adding or enabling new users.
Failure to follow these instructions can result in death, serious injury, or
equipment damage.

EIO0000004105.03 19
Security Editor Security Editor Tool Implementation

User Functions
Introduction
This topic describes the parameters and functions that are available when you
select the Users tab in the Security Editor tool.
Enable access to EcoStruxure Control Expert tools:
• EcoStruxure Control Expert with Topology Manager: Enable a user on the
Users tab to access EcoStruxure Control Expert with Topology Manager
regardless of the security level you selected on the Policies tab.
• EcoStruxure Control Expert Classic: Enable a user on the Users tab and
activate one of the security levels in the Policies tab to access EcoStruxure
Control Expert Classic.
NOTE: Refer to the selection of the security level in the Login group box
on the Policies tab, page 27.
Only the SecurityAdmin user can access the Users tab and enable the execution
of these functions:
• Modify the user list.
• Assign a profile to each user.
• Import and export information for one or more users.
• Disable one or more users.
• Delete passwords for one or more users.

20 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Parameter Descriptions
These parameters appear in the User(s) group box on the Users tab:

Element Description

(list) The list displays the users that are declared in the security database (including
Predefined users, page 14).

Add Select Add to add a new user to the User(s) list, page 22.

Delete Select Delete to delete the selected user(s) from the list.
NOTE: You cannot delete a predefined user.

Export(1) Select Export to save the database (name and profiles) for the selected user(s) to
a file.
• An exported file includes passwords.
• Refer to the description of database recovery, page 22.

Import Select Import to recover the database (name and profiles) of the selected user(s)
from a file.
NOTE: Refer to the description of database recovery, page 22.

Enable/ Toggle this button to switch between enabling and disabling access for a selected
Disable user:
• Enable: Press Enable to enable access for the user that is selected in the
User(s) list.
• Disable: Press Disable to disable access for the user or users that are
selected in the User(s) list.
NOTE:
◦ A disabled user is blocked at user authentication when security is
on, page 27. A disabled user that tries to start the software sees this
message: User disabled
◦ The name of a disabled user ends with the –disabled– suffix in the
list.
◦ You cannot disable a SecurityAdmin user.

Clear Select Clear Passwordto set the password value to an empty string.
Password
(1)The Security Editor runs under the SecurityAdmin user. It is not possible to access personal
folders for the user, such as the folders under C:\users\current_user_name. Attempts to
export a file to that location are therefore not successful.

EIO0000004105.03 21
Security Editor Security Editor Tool Implementation

These parameters appear in the Profile(s) group box on the Users tab:

Element Description

Product In this pull-down menu, select the product for which you want to define a user
profile.

Profile(s) A SecurityAdmin user can select the boxes of available options in this list to select
the profile or profiles to be associated with each selected user and mapped
product.
NOTE: Refer to the details below to associate profiles with Multiple Profiles,
page 22.

Apply Click Applyto apply each profile assignment.

NOTE: This button is active when a change is made to the selections in the
Profile(s) list.

OK Select OK to acknowledge and validate each set of changes.

Add a User
Select Add to access these parameters:

Parameter Description

User name Enter the name of the new user in this field.
Password Enter a password for the new user in this field.

Confirm the password Reenter the password for the new user in this field.

With the following Select the attributes that correspond to the new user.
attributes
OK Select OK to save and implement the parameters of the new user.

NOTE: When you add a user on the Users tab, a corresponding profile
appears in the list of profiles on the Profiles tab, page 24. To view the
corresponding merged access controls, select the profile in the Profiles list on
the Profiles tab and select Edit.

Multiple Profiles
Only a SecurityAdmin user can associate multiple profiles with a single user for
each mapped product by selecting multiple items in the Profile(s) list.
This allows a user to log in with multiple profiles and products in the same or
different software contexts. The resulting profile is a fusion of the selected profiles.
You cannot modify the predefined users, products, and profiles that appear in the
Profile(s) list.

Database Recovery
You can export the security database (Users and Profiles) to create a backup file.
The SecurityAdmin can reset a lost or forgotten password if the database is saved
to a known location with the Export function before a file recovery is attempted
with the Import function.
NOTE: The Security Editor runs under the SecurityAdmin user. It is not
possible to access personal folders for the user, such as the folders under C:
\users\current_user_name. Attempts to export a file to that location are
therefore not successful.

22 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Save and Apply Changes

Apply and save the changes for each new user assignment.

EIO0000004105.03 23
Security Editor Security Editor Tool Implementation

User Profiles
Introduction
This topic describes the parameters and functions that are available when you
select the Profiles tab in the Security Editor tool.
Perform these functions on the Profiles tab:
• Add or delete a profile in the list.
• Read or modify the access rights associated with a profile.
• Import or export information for one or more user profiles.
Only the SecurityAdmin can access the Profiles tab.

Parameter Descriptions
These are the configurable parameters on the Profiles tab:

Component Description

Product — Select the product that corresponds to the user profile you want to
(pull-down access.
menu)
NOTE: This document applies to EcoStruxure Control Expert
(with Topology Manager) and EcoStruxure Control Expert
Classic. Therefore, only the Control Expert selection from this
menu is applicable to this guide.

Profiles (list) The user profiles in this list are associated with the selected product.
(group box)
Add Select Add to add a new user profile to the list.
NOTE: New user profiles appear in this list when you add a user
profile on the Users tab, page 24.

Delete Select Delete to delete one or more selected user profiles from the
list. If you delete a profile from the list, users with this profile have the
default profile.
NOTE: You cannot delete predefined user profiles from the list.

Edit Select Edit to modify the access rights associated with the selected
user profile and modify the user profile, page 22.
NOTE: You cannot modify predefined user profiles.

Export Export the information (name and profiles) of the selected user
(1)
profile(s) to a file by selecting Export.

Import Import the information (name and profiles) of the selected user
profile(s) from a file by selecting Import.
(1)The Security Editor runs under the SecurityAdmin user. It is not possible to access personal
folders for the user, such as the folders under C:\users\current_user_name. Attempts to
export a file to that location are therefore not successful.

Add a User Profile

Select Add to open the Add a profile dialog box and access these configuration
parameters:

Parameter Description

Add the profile Enter the name of the new user profile.

With the From this pull-down menu, select the user profile that has the access rights
following you want to attribute to the user profile.

OK Select OK to create the new profile and add it to the Profiles list.

24 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Modify a User Profile

Select Edit to open the Edit profile dialog box.
Access these text fields:

Parameter Description

Tool This field contains the name of the selected product.

Profile This file contains the name of the selected user profile.

Description Add comments are associated with the user profile (optional).

The Access rights list table includes these columns:

Column Description

Access right This column is a list of product access rights that are associated with the user
profile.
NOTE: Select or clear Display Safety rights to show or hide the access
rights for safety-related controllers in the list of access rights displayed for
EcoStruxure Control Expert. There are no access rights for safety-related
controllers for the loader management software or Security Editor.

Audit The storage of access rights to Windows Event Viewer log file is enabled (Yes)
or disabled (No) depending on the choice you make with the Audit Yes/No button
(below).

Confirm The requirement to confirm an operation is enabled (Yes) or disabled (No)

depending on the choice you make with the Confirm Yes/No button (below).

Select a role from the DTM access rights pull-down menu:

Parameter Description

DTM access Select a user:

rights • Administrator
• MaintenanceEngineer
• PlanningEngineer
• SystemObserver
• SystemOperator
NOTE: You can view the access rights and the DTM access rights
associated with a preconfigured profile, but you cannot modify them.
DTM access rights for EcoStruxure Control Expert. Select the
PlanningEngineer or Administrator role if one of these user access right is
enabled:
• create a new project
• build off-line
• build on-line stop
• build on-line run
• Modify Project settings
• Variable Add Remove
• DDT Add Remove

EIO0000004105.03 25
Security Editor Security Editor Tool Implementation

Select these buttons to effect the corresponding action:

Parameter Description

State On/Off Enable or disable a selected access right for the selected profile:
1. Select an item in the Access right column.
2. Select State On/Off to toggle the selection mark for the selected item.

Audit Yes/No Change the value in the Audit column from No to Yes to enable the selected
Access right for storage in the log file:
1. Select an item in the Access right column.
2. Select Audit Yes/No to change the value from No to Yes or vice-versa.

Confirm Yes/No Change the value in the Confirm column from No to Yes to require
confirmation for an operation:
1. Select an item in the Access right column.
2. Select Confirm Yes/No to change the value from No to Yes or vice-
versa.
OK Apply the changes you made.

26 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Policies
Introduction
This topic describes the parameters and functions that are available when you
select the Policies tab in the Security Editor tool.
Only the SecurityAdmin can configure the parameters on the Policies tab to
execute these functions:
• Determine the guidelines that are associated with a product.
• Define the default profile.
• Enable or disable the Audit option.
• Enable or disable the Confirm option.
• Configure the duration (in days) of the password validity.
The following tables describe the parameters on the Policies tab.

Product Selection
Product Select Control Expert from this pull-down menu.
NOTE: This document describes the Security Editor with respect to
EcoStruxure Control Expert (with Topology Manager) and EcoStruxure Control
Expert Classic. Therefore, only the Control Expert selection from this menu is
applicable to the information in this guide.

Login Parameters
Use these selections in the Login group box to define security access rules for
users:

Security off Select this radial button to disable security and retain complete access to the
product.

Security on, Select this radial button to enable security and require both the user name
mandatory login and password. The defined profile for that user name is enforced.

Security on, Select this radial button to enable security. If you do not enter your user name
avoidable login and password, you can access the product, but confined to the default user
profile defined by the Fixed profile selection. If you also enter your user
name and password, you can access the product with the profile associated
with your user name.

Security on, no Select this radial button to allow access directly to the product without a
login prompt for user name and password. However, security is enabled in the
sense that you are confined to the default profile defined by the Fixed profile
selection.
Fixed profile Use this pull-down menu to select a default user profile.

EIO0000004105.03 27
Security Editor Security Editor Tool Implementation

Checkboxes: Select or clear these checkboxes:

Audit Select this checkbox to create a log file that stores user events for EcoStruxure Control
Expert and loader management software.
NOTE: View the log file with standard Windows commands (Start > Programs >
Windows Administrative Tools > Event Viewer.)

Confirm When you select this checkbox, enter your name and password each time you define
secure access for a user action, page 24.
NOTE: If you select Confirm, carefully select access rights when you create a new
profile. Otherwise, actions will require multiple confirmations.

NOTE:
• The Audit and Confirm options are not assigned to a single user. They apply globally to
users that have authorized access to the product.
• When you disable security with the Security off option, the functionalities of the Audit
and Confirm checkboxes are unavailable.

User Account Password Validity

Define a validity period for the password for EcoStruxure Control Expert with
Topology Manager and EcoStruxure Control Expert Classic in the User Accounts
group box on the Policies tab:

Password Select this checkbox to reject login attempts that use an expired password (as
validity period defined by the Period in days value and the age in days of the latest
password).
NOTE:
• You can implement the Password validity period only when you
select Security on, mandatory login from the Login group box.
• When the Password validity period checbox is not selected, the
password does not expire. The value in the Period in days field is
therefore ignored.

Period in days Enter the number of days for which the password is valid when you select
Password validity.

Apply Select Apply to save and implement the value in the Period in days field.

NOTE: After you define a validity period for at least one user, you can verify
the validity period. Select the user in the Name field on the User information
tab and read the information associated with the Status field.

28 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Login Policies
Introduction
This topic describes the parameters and functions that are available on the Login
Policies tab in the Security Editor.
Use this tab to configure the authentication mechanism for a local or centralized
database of users and their associated access rights.
These database types are available in the Authentication Mode pull-down menu:
• local: For a local database, the computer accesses a local database. In this
case, select the Local database.
• centralized: For centralized databases, a client computer accesses a remote
computer to use its database by selecting one of several centralized
database types.
NOTE: This guide includes a use-case example that shows the use of
Security Editor in a client-server relationship, page 38.

Local Database
On the Login Policies tab, choose Local from the Authentication Mode pull-
down menu to configure an authentication database in the local computer.
Use the Local mode to define users and their corresponding Role Based Access
Control (RBAC) settings in the Security Editor database on the same local
computer that is used for authentication.
When you select (and apply) a local database, you can change and update the
login behavior on the Policies tab, page 27.
NOTE: The functionality with a local database matches the functionality of the
authentication mode in legacy releases of the tool that predate EcoStruxure
Control Expert version 15.3.

EIO0000004105.03 29
Security Editor Security Editor Tool Implementation

Centralized Database
On the Login Policies tab, choose one of these Centralized options from the
Authentication Mode pull-down menu to configure a database on a remote
server to authenticate one or more EcoStruxure Control Expert clients:

Authentication Description
Mode
Centralized,Local An attempt is made to authenticate users against a remote centralized
database. If that attempt is not successful, a subsequent attempt is made
to authenticate users against a local database.

Local,Centralized An attempt is made to authenticate users against a local database. If that

attempt is not successful, a subsequent attempt is made to authenticate
users against a remote centralized database.

Centralized Attempts are made to authenticate users at a remote centralized database.

(There is no attempt to authenticate locally.)

NOTE: The Authentication Mode options that include a comma indicate the sequence of
attempts to access a server. For example, the Centralized,Local option attempts to access a
centralized server first and a local server second.

NOTE: When you select one of the Centralized options, enable

SecurityService as a server in the Server group box at the top of the
Security Editor window.
The remote server can potentially be behind the firewalls that surround different
security zones. Configure the server to enable access for the authentication
policies. You can also configure the policies to redirect requests among the zones
of security.
Consider these points when you select and apply a Centralized option from the
Authentication Mode menu:
• Confirm that the firewall on the server authorizes access for the port.
• You cannot configure a Login type on the Policies tab, page 27. The
implementation of a Centralized option requires the Login option: Security
on, mandatory login. The other Login options are disabled.
• You can configure the Windows Active Directory, page 33.

30 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Parameter Descriptions
This table describes the remaining parameters for the Network Security Service
group box on the Login Policies tab:

Parameter Description

Centralized Network Register the authentication for a server that is not on the same local computer that
Protocol(1) makes the authentication request. This authentication allows local computers to use the
(pull-down menu) centralized configuration of a remote server on which Security Editor is installed.

LDAP Implement the Lightweight Directory Access Protocol (LDAP) for user authentication
through an LDAP server.
NOTE:
• The LDAP protocol is available in the Centralized Protocol menu only when
you select a Centralized option from the Authentication Mode menu.
• When EcoStruxure Control Expert connects to a remote server, the
implemented security database is always that of the server. The selections in
the Authentication Mode and Centralized Protocol pull-down menus on the
Login Policies tab are therefore ignored except when LDAP is selected from
the Centralized Protocol menu.
Server Address(1) Host IP Enter the IP address of the remote server to be used for authentication.
Host Name/DNS Enter a name for remote server to be used for authentication.
Port Enter the port number of the remote server to be configured for security authentication.
By default, these port numbers are associated with the selected protocol:
• 50051: Network is selected in the Centralized Protocol menu.
• 389: LDAP is selected in the Centralized Protocol menu.
LDAP Protocol LDAP Group(s)(3) Configure LDAP groups manually to authenticate the users in these LDAP groups.
Details(2)

Profile(s)(3,4) — Select the profiles in this list to associate them with the selected group(s).

Base DN(2) — When active, this field contains the distinguished name that is created from the path to
the user.
NOTE: Refer to the description of Base DN below.

Export(5) — Export the information (Login Policies) to a file by selecting Export.

Import — Import the information (Login Policies) from a file by selecting Import.

Apply — Select Apply to confirm and apply the changes.

(1) These parameters are available when you select one of the Centralized options from the Authentication Mode menu.
(2) These parameters are available when you select LDAP from the Centralized Protocol menu.
(3)When a user is successfully authenticated using an LDAP server, groups in the LDAP group(s) pull-down menu are queried and
matched with this authenticated username. In this case, the corresponding profiles (roles) are assigned to the user profile. If multiple LDAP
groups are configured, or if more than one profile is mapped to the LDAP group, multiple profiles are associated with the user. The
following actions are available for LDAP groups:
• To create a new LDAP group, type the new group name in the box and press Enter
• To delete an LDAP group, select the group and select the trash icon on the left. The group is deleted as soon as you validate this
action
• To select an existing LDAP group, use the pull-down menu.
(4)
When you select and apply a centralized LDAP protocol, the LDAP Group(s) pull-down menu is active. Make a selection in this menu to
activate the Profile(s) checkboxes, in which you can select profiles for single or multiple LDAP Group(s) before you select Apply to
implement your changes.
(5)
The Security Editor runs under the SecurityAdmin user and cannot access the user’s personal folders (in the C:\users\current_
user_name directory, for example). Attempts to export files to the C:\users\current_user_name directory are therefore not
successful.

Base DN
The Base DN field is active when LDAP is selected in the Centralized Protocol
menu.
In a non-Windows LDAP server, the Base DN field is mandatory and it can be
provided by the server administrator. The Base DN contains the location at which
you can find the user to be authenticated.

EIO0000004105.03 31
Security Editor Security Editor Tool Implementation

You can enter the CN (common name) or UID (user identifier) to log in to the
software. In this case, the path to the user in the Base DN field is used to create a
DN (distinguished name) for the logged-in user.

32 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Active Directory Configuration

When a valid certificate appears on the Certificate Actions tab, you can
configure the Windows Active Directory on the Login Policies tab:

Step Action

1 Select the Login Policies tab:

2 Make these selections:

• Authentication Mode: Choose one of the Centralized options.
• Centralized Protocol: LDAP
3 Enter the appropriate information for these parameters:
• Host Name/DNS: Enter a name for remote server to be used for authentication.
• Port: Enter the port number of the remote server to be configured for security
authentication.
• LDAP group(s): Enter the name of an LDAP group of users to authenticate and
press the Enter key.
NOTE:
• If necessary, request this information from the SecurityAdmin.
• Repeat this step to create additional LDAP groups.

4 Select a group from the LDAP group(s) pull-down menu and select names of profiles in
the Profile(s) list to be associated with that group.
NOTE: Repeat this step to associate profiles with all items in the LDAP group(s)
pull-down menu.

5 SelectApply at any time to apply and save the configuration.

NOTE: To confirm the configuration of the Active Directory, open EcoStruxure

Control Expert (with Topology Manager) or EcoStruxure Control Expert
Classic to confirm that the user name and associated profile for the Active
Directory configuration appear in the title bar.

EIO0000004105.03 33
Security Editor Security Editor Tool Implementation

Certificate Actions
About EcoStruxure Control Expert Certificates
This topic describes the parameters and functions that are available in the
Certificate Actions tab in the Security Editor tool. Access this tab to generate and
share EcoStruxure Control Expert certificates. In a client/server relationship, these
certificates are added to the Certificate whitelist, page 36 to enforce security
among the exchanges.
Create certificates:
• automatically: The security-service and EcoStruxure Control Expert
certificates are generated automatically when you launch Security Editor for
the first time.
• manually: Create a self-signed certificate in the Certificate Actions tab. The
parameters for this tab are described below.
NOTE: This guide includes a use-case example that shows the functionality of
Security Editor in a client-server relationship, page 38.

Parameter Descriptions
The parameters and GUI features on the Certificate Actions tab are applied to
the manual creation of certificates:

Parameter Description

Product This document describes the Security Editor with respect to EcoStruxure
(pull-down menu) Control Expert (with Topology Manager) and EcoStruxure Control Expert
Classic.
General Self Signed Select General Self Signed Certificateto generate a self-signed
Certificate certificate for products that require secure communications.
(button)

Export Certificate Select Export Certificateto export an existing certificate that is saved
(button) locally.
NOTE: You can export a certificate only after you generate a
certificate for a selection in the Product pull-down menu and select
General Self Signed Certificate.

Certificate Select Certificate Properties to open the Certificate dialog box. It

Properties contains detailed information about the certificate.
(button)

Generate a Self Signed Certificate

Generate certificates for EcoStruxure Control Expert or the Security Service:

Step Action

1 On the designated server computer, select the Certificate Actions tab, page 34.

2 Make a selection in the from the Product pull-down menu:

• Control Expert: Generate a certificate for EcoStruxure Control Expert.
• SecurityService: Generate a certificate for the Security Service when you run the
service as a server.
NOTE: A server requires a valid security service certificate to start. It is
therefore possible that a server does not run even when the SecurityService
as server parameter is selected. In this case, the SecurityAdmin generates
the certificate for the security service.

3 Select Generate Self Signed Certificate to generate and install the EcoStruxure
Control Expert or security service certificates in the local Windows certificate store.

34 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Step Action

4 Select OK to apply the modifications and close the Security Editor.

5 Optional: Hover the cursor over the icon to verify that the self-signed certificate was
generated and saved to the certificate store.

Export a Certificate
From within the Security Editor, you can use one of these tools to export the
certificate that you generated above:
• Export Certificate (in Security Editor)
• Certificate Export Wizard: (Windows tool)
Both procedures are described below.
Export Certificate:
Use Export Certificate to export a generated certificate from the local Windows
certificate store:

Step Action

1 Select Export Certificate to open a Windows Save As ... dialog box.

2 Use standard Windows commands to drive to a location and save the certificate.

Certificate Export Wizard:

Export a generated certificate with the Windows Certificate Export Wizard:

Step Action

1 Select Certificate Properties to open the Windows Certificate properties dialog box.

2 Select the Details tab.

3 Select Copy to File…to open the home page for the Windows Certificate Export
Wizard.
4 Select Next to go to the Export Private Key page.

5 Select the No .... radial button, and select Next to go to the Export File Format page.
NOTE: The Security Editor uses a TPM (Trusted Platform Module) to generate and
store private keys and therefore cannot export the private key with the certificate. If
you try to export the key (Yes, export the private key), the export procedure errors
on the last wizard page.

6 Select a file format radio button, and select Next to go to the File to Export page.

7 Name the file and save it to an appropriate local location.

8 Select Next to go to the completion page and select Finish to complete the export.

NOTE: The Certificate Properties in the Security Editor tool opens the same
Certificate (properties) dialog box for Windows that you open when you
double-click a certificate in the Microsoft Management Console. Similarly, the
Copy to File in the Security Editor tool opens the same Certificate Export
Wizard for Windows that you open when you right-click a certificate in the
Microsoft Management Console and scroll to All Tasks > Export.

EIO0000004105.03 35
Security Editor Security Editor Tool Implementation

Certificate Whitelist
Introduction
The Certificate whitelist tab in Security Editor displays a list of connections to
remote servers that are trusted by personnel in the SecurityAdmin role.
Use the parameters on this tab to add trusted servers to the table.
NOTE:
• The use of bypass firewalls may be required to create a successful
connection to the remote IP port of the server.
• This guide includes a use-case example that shows the functionality of
Security Editor in a client-server relationship, page 38.

EcoStruxure Control Expert Tasks

The Certificate whitelist requires a known IP address for a controller to connect
to a remote server:

Step Action

1 Open the Set Address dialog box in EcoStruxure Control Expert (PLC > Set Address)
and make these selections in the PLC group box:
• Address: SYS
• Communication Protocol: HTTPS via USB
Select OK to close the dialog box.

2 Connect to the controller (PLC > Connect).

3 Select Upload Project to open the Transfer Project from PLC dialog box.

4 Select Transfer Project from PLC and monitor the progress bar in the Project transfer
pop-up window.

5 Open the PLCScreen window (Tools > PLC Screen) and select the Information tab to
that the NETWORK ADDRESS is a USB connection.
6 SelectDisconnect.
7 Launch the Security Editor and select the Certificate whitelist tab.

To open the Certificate dialog box and view the properties and status of the
certificate on the Details tab, select ellipses (...) from any row in the whitelist.

Add a Trusted Device

Before you retrieve the controller certificate, confirm that the endpoint security tool
on your local computer is enabled to allow groups to access the server for a set
period of time.
Create a security service certificate and add it to the Certificates whitelist for a
connection to a controller:

Step Action

1 On the Certificate whitelist tab, select Add to open the Add Server Address dialog box.

2 Make a selection in the Communication Protocol pull-down menu:

• HTTPS or HTTPS via USB: Use these protocols to add a controller to the
Certificate whitelist table (through default port 443).
• TCPIP: Use this protocol to add these devices to the Certificate whitelist table:
◦ another computer that runs Security Editor (default port: 50051)
◦ LDAP server (default port: 389)

36 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Step Action

3 Enter a port number (Port) that supports traffic from the server.

4 Select the plus sign (+) to view the connection in the table and reset the IP address to
0.0.0.0.
NOTE: Select the plus sign (+) to add multiple connections to the Add Server
Address table.
5 Select OK to confirm that the new connection appears in the list of trusted remote servers
and close the Add Server Address dialog box.
NOTE:
• Repeat the above steps to create additional connections
• When EcoStruxure Control Expert connects to a remote server, the
implemented security database is always that of the server. The selections in
the Authentication Mode and Centralized Protocol pull-down menus on the
Login Policies tab are therefore ignored, except when LDAP is selected from
the Centralized Protocol menu.
6 Select the appropriate checkboxes for the new connections and slect Trust Certificates
to add the certificates to the security database and complete the whitelisting operation.

Management Buttons
Select these buttons in the Connections group box to manage items in the
whitelist:
• Add: Open the Add Server Address dialog box.
• Select All: Select all items before you remove them from the table or to
confirm their trusted status with Trust Certificate.
• Unselect All: Deselect all items in the table.
• Remove: Remove the selected item or items from the whitelist table.
Once the certificate is obtained, the status of each connection is automatically
updated.

EIO0000004105.03 37
Security Editor Security Editor Tool Implementation

Client-Server Architecture for Security Editor

Introduction
You can use Security Editor to establish a client-server architecture:
• client: The client computer runs Security Editor and requires access to
configuration information on a server computer.
• server: The server computer runs the SecurityService of the Security Editor.
This architecture allows the client to take advantage of the configuration on the
server. For example, you can start CEClassic on a client with credentials
(username and password) that exist only on the server. The client will also import
the certificate whitelist from the server.
Use the directions below to create an example of a simple client-server
relationship with Security Editor.
NOTE: For a robust client-server architecture, follow the instructions to
enforce security for the EcoStruxure Control Expert project., page 40.

Configure the Server

Set up a remote computer that runs Security Editor as a server:

Step Action

1 Launch Security Editor to view the Server group box (at the top of every Security Editor
tab).

2 Confirm that the certificate for the selected product is valid by hovering the mouse over
the certificate icon on the Certificate Actions tab, page 34.

3 Select the SecurityService as server checkbox to run as a server.

4 Select OK to apply your modifications and close Security Editor.

38 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Configure a Client to Connect to a Server

Configure a client for the Security Editor SecurityService to connect to the Security
Editor SecurityService that runs on a remote server:

Step Action

1 Select the Login Policies tab in the Security Editor.

2 Select a Centralized option from the Authentication Mode menu.

3 Select Network from the Centralized Protocol pull-down menu:

NOTE: The selection of a Centralized server automatically sets the Login option
on the Policies tab to Security on, mandatory login. The other Login options on
the Policies tab are disabled.
4 In the Server Address group box, select the radial button that corresponds to your
desired addressing method:
• Host IP: Enter the IP address of the server.
• Host Name/DNS: Enter the host name of the server.
NOTE: You can configure only one of these addressing methods.

5 In the Port field, enter the port number of the server computer.

6 Select Apply.

NOTE: On the SecurityService client side, whitelist the SecurityService

certificate to support the connection to the server. (Refer to the description of
the Certificates whitelist tab, page 36.)

EIO0000004105.03 39
Security Editor Security Editor Tool Implementation

Configure a Controller for Use with EcoStruxure Control

Expert Classic Through the Enforced Engineering Link
Introduction
When the SecurityService of the Security Editor runs on a server, it can establish
secure connections to authorized clients only when the EcoStruxure Control
Expert Classic project is configured for an application password. Therefore, follow
the instructions below to create an application that is conducive to the client-server
functionality of the Security Editor.
NOTE: These instructions assume that the reader has a working familiarity
with EcoStruxure Control Expert Classic. For more detailed information for the
specific steps, refer to the Modicon M580, Hardware, Reference Manual or
EcoStruxure™ Control Expert, Installation Manual.

Configure a Controller Project

Use the instructions below when you have local computer that runs an
EcoStruxure Control Expert Classic project that includes a single controller
module:

Step Action

1 In EcoStruxure Control Expert Classic, create a new project (File > New) to open the
New Project dialog box.

2 Select a controller for the application and click OK to open the Security enforcement
dialog box.

3 When prompted, create a new Application password for the project and click OK to
close the Security enforcement dialog box.

4 In the PLC bus, double-click the ports on the controller to open the submodule
parameters.

5 Select the Security tab and click the Unlock Security button to enable all services.

6 Select Enforced from the Engineering Link Mode pull-down menu.

7 Configure an IP address for the project controller:

a. Open the Set Address dialog box (PLC > Set Address).
b. Select MODBUS TCP from the Communication Protocol pull-down menu.

c. Click OK to close the Set Address dialog box.

8 Rebuild the project (Build > Rebuild All Project) and save the application (File >
Save).

9 Download the project to the controller (PLC > Transfer Project to PLC).

When you open the EcoStruxure Control Expert Classic project in the future, you
are prompted for the application password.
Change the Password: Change the password for a project or add a password to
an existing (password-less) project:

Step Action

1 Open an EcoStruxure Control Expert Classic project.

2 In the Project Browser, right-click Project and select Properties to open the
Properties of Project dialog box.

3 Select the Projects & Controller Protection tab and click the Change password...
button to open the Modify Password dialog box for the applicable password
(Application, Firmware, Web Diagnostic/Data Storage).

4 Enter the password in the New password group box.

40 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Step Action

NOTE: To change the password for a password-protected application, first enter the
existing password in the Old password field.

5 Rebuild the project (Build > Rebuild All Project) and save the application (File >
Save).

6 Click OK to apply the new passwords and close the Modify Password dialog box.

Whitelist the Controller in Security Editor

With a configured Ethernet address, the controller automatically generates a
certificate.
To configure EcoStruxure Control Expert Classic to communicate with the
controller through an HTTPS connection, add the controller's certificate to the list
of trusted devices on the Certificates whitelist tab, page 36.

Generate a Certificate for the Local Computer

The Security Editor can add another software program or device (for example, the
SecurityService running on a remote computer, controller, LDAP server, etc.) to a
whitelist only when it is identified by its unique certificate.
Generate the unique certificate for EcoStruxure Control Expert and the
SecurityService with the Security Editor:

Step Action

1 Using the Security Editor that runs on a local computer, select the Certificate Actions
tab, page 34..

2 Select SecurityService (or Control Expert) from the Product pull-down menu.

3 Click the Generate Self Signed Certificate button, page 34.

NOTE: The certificates are generated at the first launch of the Security Editor.
If necessary, you can manually generate a certificate. (Refer to the instruction
to generate a certificate on the Certificate Actions tab, page 34.

EIO0000004105.03 41
Security Editor Security Editor Tool Implementation

Syslog Events
Enable Tracking
Perform these tasks in the Security Editor tool to enable the Syslog service to
track Syslog events in the Syslog server:

Tab Task
Profiles Create a new profile with the applicable audit cases.

Policies Enable at least the minimum security (Security on, no login).

Select the Audit checkbox to implement the audit for the new profiles you
want to monitor.

42 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Recovery Procedure with a Detected Error

Introduction
Use the Security Editor tool to control access to EcoStruxure Control Expert and
the loader management software. If an error is detected (such as incorrect
passwords, an access attempt by an unauthorized user, etc.), follow the recovery
procedure that corresponds to the case.

Undefined User Access

These types of access are available when a user is not defined in the security
database while security is enabled:

Configuration Access

Access is configured with an avoidable login The undefined user can access EcoStruxure
(Security On, Password Optional). Control Expert or the loader management
software with the default profile.

Access is configured with a mandatory login The undefined user cannot access EcoStruxure
(Security On, Password Required). Control Expert or the loader management
software.

For Security Editor, access is set to a mandatory login (Security On, Password
Required) and cannot be modified. An undefined user cannot access Security
Editor.
NOTE: If the database of the Security Editor is corrupted or it was deleted,
access to EcoStruxure Control Expert or the loader management software is
not possible, even if security is not active (Security Off).

Availability of Security Components After Installing EcoStruxure

Control Expert
The manner in which you install EcoStruxure Control Expert has an impact on the
availability of the security components:

Installation Results
Type

Install There is no action relative to the security components.

Repair There is no action relative to the security components.

Upgrade Moves the security database files to a backup folder to facilitate a later migration of
the database.
Removes all other security components.

Remove Removes all security components.

NOTE: The security components are created the first time you launch the
Security Editor.

EIO0000004105.03 43
Security Editor Security Editor Tool Implementation

EcoStruxure Control Expert Predefined Profiles

Introduction
This topic presents the available predefined profiles you can use to associate at
user creation.

Predefined User Profiles

EcoStruxure Control Expert provides these user profiles:

Predefined Profile Applicable Program Type Description

ReadOnly Program The user can only access the project in read mode, except for the controller
address, which can be modified. The user can also copy or download the project.
Program-PROCESS

Program-SAFE

Operate Program The user has the same rights as with a ReadOnly profile, with the added
possibility of modifying execution parameters (constants, initial values, task cycle
Program-PROCESS times, etc.).

Safety_Operate Program The user has similar rights as with the Operate profile, but with respect to the
safety-related program, except that:
Program-PROCESS
• Transferring data values to the non-safety-related controller is not
permitted.
Program-SAFE
• Commanding the safety-related program to enter maintenance mode is
permitted.

Adjust Program The user has the same rights as with an Operate profile, with the added
possibility of uploading a project (transfer to the controller) and modifying the
Program-PROCESS controller operating mode (Run, Stop, ...).

Safety_Adjust Program The user has similar rights as with the Adjust profile, but with respect to the
safety-related program, except that:
Program-PROCESS
• Transferring data values to the non-safety-related controller is not
permitted.
Program-SAFE
• Commanding the safety-related program to enter maintenance mode is
permitted.

Debug Program The user has the same rights as with an Adjust profile, with the added possibility
of using the debugging tools.
Program-PROCESS

Safety_Debug Program The user has similar rights as with the Debug profile with respect to the safety-
related program, with these exceptions:
Program-PROCESS
• Stopping or starting the program is not permitted.
Program-SAFE • Updating initialization values is not permitted.
• Transferring data values to the non-safety-related controller is not
permitted.
• Forcing inputs, outputs or internal bits is not permitted.
• Commanding the safety-related program to enter maintenance mode is
permitted.

Program Program The user has the same rights as with a Debug profile, with the added possibility
of modifying the program.
Program-PROCESS

Safety_Program Program The user has similar rights as with the Program profile, but with respect to the
safety-related program, except that:
Program-PROCESS
• Stopping or starting the program is not permitted.
Program-SAFE • Updating initialization values is not permitted.
• Transferring data values to the non-safety-related controller is not
permitted.
• Forcing inputs, outputs or internal bits is not permitted.
• Commanding the safety-related program to enter maintenance mode is
permitted.

44 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Predefined DTM roles (access rights to modify DTMs) are associated with the
user profiles. Preconfigured user profiles are associated with specific DTM roles,
and a new user profile is associated with a selected DTM role. This table shows
the correspondence between profile names and DTM roles:

User Profile DTM Role

SecurityAdmin Administrator

Adjust SystemOperator

Debug MaintenanceEngi-
neer
Operate SystemOperator

Program PlanningEngineer

ReadOnly SystemObserver

Safety_Adjust SystemOperator

Safety_Debug MaintenanceEngi-
neer
Safety_Operate SystemOperator

Safety_Program PlanningEngineer

NOTE:
• Refer to the directions for creating a new user profile, page 24.
• When you map a DTM role to a user profile, choose the role that best
corresponds to the access rights for that profile.

EIO0000004105.03 45
Security Editor Security Editor Tool Implementation

EcoStruxure Control Expert and EcoStruxure Control

Expert Classic Access Rights
Introduction
These are the categories of EcoStruxure Control Expert access rights:
• Topology Manager
These are the categories of EcoStruxure Control Expert Classic access rights:
• Project services
• Adjustment/debugging
• Libraries
• Global modification
• Elementary modification of a variable
• Elementary modification of DDT compound data
• Elementary modification of a DFB type
• Elementary modification of a DFB instance
• Bus configuration editor
• Input/output configuration editor
• Runtime screens
• Cyber security
NOTE: EcoStruxure Control Expert Classic access rights also apply to Control
Expert editor.

Topology Manager
These are the minimum access rights that are required to execute a command in
EcoStruxure Control Expert when security is on:
Commands and actions related to the system project.

Command/actions Access rights

Actions that modify the state or content of a system Modify system project
project or the value of an attribute of an object in a
system project.

Actions related to physical views, such as, creating, Modify system project
modifying, or deleting physical views, changing
assignments or position of devices, links between
devices.
Actions related to logical networks, such as, Modify system project
creating, modifying, or deleting networks, changing
network assignments or IP address assignments of
devices.
Define Password or Clear Password (system Manage system project settings
project Password and Webuser Password)

New System Project Create system project

NOTE: If you want to set the system project password when you create the
system project, the Manage system project settings right is also required.

Import System Project Import system project

NOTE: If you select to replace an existing system project, the Delete system
project right is also required.

Delete (system project) Delete system project

Import (topology, .xpt) Modify system project

46 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Commands and actions related to the control project managed by Topology

Manager.

Command/actions Access rights

Import (EcoStruxure Control Expert Classic project, • Modify system project

.sta, .zef) • Open an existing project
• Save as a project
• Import a project
• Modify project settings
• Create or modify application password

Edit Control Project • Modify system project

• Create a new project (required only if the control project does not exist.)
Synchronize
• Open an existing project
Build • Save a project
Commands of the Compare controller context • Save as a project
menu
• Create or modify application password (required only if the control project
Commands of the Control Engineering controller is edited the first time after setting or changing the system project password.)
context menu • Modify project settings
• Modify the I/O configuration
• DDT Add Remove
• DDT modification
• DFB type Add Remove
• Variable Add Remove
In addition, for M580 safety and redundant safety PACs, the following access rights
are required:
• Modify safety project settings
• Modify the safety I/O configuration
• Safety DDT modification
• Safety DDT Add Remove
• Safety variable Add Remove
In addition, only for the Build command, the following access right is required:
• Build off-line
Save Control Project as Save as a project

Deploy > Configuration or Deploy in the • Modify system project

DEPLOYMENT VIEW • Start Stop or Initialize the PLC
(Includes selecting Run controller after • Transfer project to PLC
deployment with the Deploy > Configuration
command)

Deploy > Set IP Address by USB

Stop or Run in the DEPLOYMENT VIEW Start stop or initialize the PLC

Build Target Modify system project

Upload • Modify system project

• Open an existing project
• Save as a project
• Create or modify application password (required only if a system project
password is set.)
• Modify project settings
• Transfer project to PLC
In addition, for M580 safety and redundant safety PACs, the following access right
is required:

Modify safety project settings

Project Services
These access rights apply to project services:

EIO0000004105.03 47
Security Editor Security Editor Tool Implementation

Access right Description

Create a new project Create a new project.

Open an existing project Open an existing project.

Save a project Save the open project.

SaveAs a project Save the project with a new name or to a new location.

Import a project Import a project. (A partial import is considered a program modification.)

Build off-line Launch a generation of the executable in offline mode.

Build on-line STOP Launch a generation of the executable in online mode when the controllers are de-energized.

Build on-line RUN Launch a generation of the executable in online mode when the controllers energized.

Start, stop or initialize the PLC Command the controller to energize, de-energize, or initialize.
NOTE: Only process tasks are started or stopped:
• For a non-safety-related controller, controller starts or stops.
• For an M580 safety controller, tasks other than the SAFE task start or stop.

Update init values with current Update the initial values with the latest values (only non-safety-related data).
values
Transfer project from PLC Transfer the executable program from the controller to the terminal.

Transfer project to PLC Transfer the executable program from the terminal to the controller.

Transfer data values from file to Transfer data from a file to the controller (non-safety-related data only).
PLC
Restore project backup in PLC Restore the contents of backup memory (Premium) or the memory card (Modicon M340 and
Modicon M580) in the controller executable area.
NOTE: On Modicon M580, you can save to flash memory if no memory card is inserted.

Save to project backup in PLC Save the project program in the backup memory (Premium) or the memory card (Modicon M340
and Modicon M580).
NOTE: On Modicon M580, restore from flash memory if no memory card is inserted.

Set address Access a controller through the network.

Modify options Modify project attributes.

Adjustment/Debugging
These access rights apply to adjustments and debugging:

Access right Description

Modify variable values Modify the value of the variables (non-safety-related variables only).

Modify safety variable values Modify the value of the safety-related variables.

Force internal bits Force internal bits.

Force outputs Force outputs.

Force inputs Force inputs.

Task management Command the execution of project program tasks (energize, de-energize; initialization).

SAFE Task management Command the execution of safety project program SAFE tasks (energize, de-energize,
initialization).

Task cycle time modification Modify cycle times for cyclical tasks.

SAFE Task cycle time modification Modify cycle times for cyclical SAFE tasks.

Suppress message in viewer Delete the message displayed in the viewer.

Debug the executable Debug the executable program.

Replace a project variable Replace all occurrences of a variable in the program with another variable (non-safety-
related variables only).

Replace a safety project variable Replace all occurrences of a safety-related variable in the program with another.

48 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Libraries
These access rights apply to libraries:

Access right Description

Create libraries or families Create libraries or families of user functions.

Create safety libraries or families Create safety-related libraries or families of user functions.

Delete libraries or families Delete libraries or families of user functions.

Delete safety libraries or families Delete safety-related libraries or families of user functions.

Put an object into library Insert an object in a library.

Put an object into safety library Insert an object in a safety-related library.

Delete an object from library Delete an object from a library.

Delete an object from safety library Delete an object from a safety-related library.

Get an object from a library Import an object from a library to the project.

Get an object from the safety library Import an object from a safety-related library to the project.

Global Modification
These access rights apply to global modifications:

Access right Description

Modify the documentation Modify the documentation.

Modify the functional view Create, delete, or modify a functional module.

Modify the animation tables Modify the structure (not the values) of animation tables.

Modify constants value Modify the value of the project constants.

Modify safety constants value Modify the value of the safety project constants.

Modify the program structure Modify the executable code structure (add/delete a section; modify the activation conditions for a
section; modify section order.)

Modify the safety program Modify the safety executable code structure (add/delete a section; modify the activation conditions
structure for a section; modify section order.)

Modify program sections Modify the executable code for a section.

Modify safety program sections Modify the executable code for a section in the safety program.

Modify project settings Modify the generation options.

Modify safety project settings Modify the safety project settings.

Elementary Modification of Variables

These access rights apply to elementary modifications of variables:

Access right Description

Variable add/remove Add or delete a variable.

Safety Variables add/remove Add or delete a safety-related variable.

Variable main attributes modifications Modify a variable's name, type, and address.

Safety Variables main attributes modifications Modify a safety-related variable's name, type, and address.

Variable minor attributes modifications Modify the comment and the initial value for a variable.

Safety Variables minor attributes modifications Modify the comment and the initial value for a safety-related variable.

EIO0000004105.03 49
Security Editor Security Editor Tool Implementation

Elementary Modification of DDT Compound Data

These access rights apply to elementary modifications of DDT compound data:

Access right Description

DDT add/remove Add or delete a compound data item.

DDT modifications Modify the structure, comment, and initial value of a compound data item.

Safety DDT modifications Modify the structure, comment, and initial value of a safety compound data item.

Elementary Modification of a DFB Type

These access rights apply to elementary modifications of DFB variables:

Access right Description

DFB type add/remove Add or delete a DFB type.

Safety DFB type add/remove Add or delete a safety DFB type.

DFB type structure modification Modify the structure of a DFB type.

Safety DFB type structure modification Modify the structure of a safety DFB type.

DFB type sections modification Modify the code section of a DFB type.

Safety DFB type sections modification Modify the code section of a safety DFB type.

Elementary Modification of a DFB Type Instance

These access rights apply to elementary modifications of DFB type instances:

Access right Description

DFB type instance modification Add, delete, or modify (name and type) a DFB instance.

Safety DFB type instance modification Add, delete, or modify (name and type) a safety DFB instance.

DFB type instance minor attributes modification Modify the comment and the initial value for a DFB instance.

Safety DFB type instance minor attributes modification Modify the comment and the initial value for a safety DFB instance.

Bus Configuration Editor

These access rights apply to edits in the bus configuration:

Access right Description

Modify the configuration Modify the configuration.

Modify the safety configuration Modify the safety configuration.

I/O sniffing Execute bus configuration sniffing.

50 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Input/Output Configuration Editor

These access rights apply to edits in the input and output configuration:

Access right Description

Modify the I/O configuration Modify the input/output configuration.

Modify the safety I/O configuration Modify the safety input/output configuration.

Adjust the I/O Adjust inputs/outputs.

Adjust the safety I/O Adjust safety inputs/outputs.

Save_param Save the module input/output parameters explicitly. (The initial parameter
values are replaced by the latest values).

Restore_param Restore the module input/output parameters explicitly. (The initial

parameter values are replaced by the latest values).

Runtime Screens
These access rights apply to runtime screens:

Access right Description

Modify screens Modify runtime screens.

Modify messages Modify runtime messages.

Add/remove screens or families Add or delete a runtime screen.

Cyber Security
These access rights apply to cyber security:

Access right Description

Create or modify application password Create and modify the application password.

Enter Maintenance mode Enter maintenance mode.

Adapt Auto-Lock timeout Adapt the Auto-lock timeout.

EIO0000004105.03 51
Security Editor Security Editor Tool Implementation

EcoStruxure Control Expert and EcoStruxure Control

Expert Classic Access Rights Assigned to Predefined
Profiles
Introduction
EcoStruxure Control Expert access rights are grouped in these categories:
• Topology Manager
EcoStruxure Control Expert Classic access rights are grouped in these categories:
• Project services
• Adjustment/debugging
• Libraries
• Global modification
• Elementary modification of a variable
• Elementary modification of DDT compound data
• Elementary modification of a DFB type
• Elementary modification of a DFB instance
• Bus configuration editor
• Input/output configuration editor
• Runtime screens
• Cyber security
NOTE: For predefined profiles, the Audit and Confirm options of all access
rights are disabled.
NOTE: EcoStruxure Control Expert Classic access rights also apply to Control
Expert editor.

Topology Manager

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug

Access right

Create system project – – – – – – – ✔ ✔

Modify system project – – – – – – – ✔ ✔

Import system project – – – – – – – ✔ ✔

Delete system project – – – – – – – ✔ ✔

Manage system project settings – – – – – – – ✔ ✔

✔ Included

– not included

52 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Project Services

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

Create a new project – – – – – – – ✔ ✔

Open an existing project ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Save a project – – – – – – – ✔ ✔

SaveAs a project ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Import a project – – – – – – – ✔ ✔

Build off-line – – – – – – – ✔ ✔

Build on-line STOP – – – – – – – ✔ ✔

Build on-line RUN – – – – – – – ✔ ✔

Start, stop or initialize the PLC – ✔ – ✔ – – – ✔ ✔

Update init values with current values – – – ✔ – – – ✔ ✔

Transfer project from PLC ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Transfer project to PLC – ✔ ✔ ✔ ✔ – – ✔ ✔

Transfer data values from file to PLC – ✔ – ✔ – ✔ – ✔ ✔

Restore project backup in PLC – – – – – – – ✔ ✔

Save to project backup in PLC – – – – – – – ✔ ✔

Set address ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Modify options – ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

✔ Included

– not included

EIO0000004105.03 53
Security Editor Security Editor Tool Implementation

Adjustment/Debugging

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

Modify variable values – ✔ – ✔ – ✔ – ✔ ✔

Modify safety variable values – – ✔ – ✔ – ✔ – ✔

Force internal bits – – – ✔ – – – ✔ ✔

Force outputs – – – ✔ – – – ✔ ✔

Force inputs – – – ✔ – – – ✔ ✔

Task management – – – ✔ – – – ✔ ✔

SAFE Task management – – – – ✔ – – – ✔

Task cycle time modification – ✔ – ✔ – ✔ – ✔ ✔

SAFE Task cycle time modification – – ✔ – ✔ – ✔ – ✔

Suppress message in viewer – ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Debug the executable – – – ✔ ✔ – – ✔ ✔

Replace a project variable – – – – – – – ✔ ✔

Replace a safety project variable – – – – – – – – ✔

✔ Included

– not included

Libraries
The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug

Access right

Create libraries or families – – – – – – – ✔ ✔

Create safety libraries or families – – – – – – – – ✔

Delete libraries or families – – – – – – – ✔ ✔

Delete safety libraries or families – – – – – – – – ✔

Put an object into library – – – – – – – ✔ ✔

Put an object into safety library – – – – – – – – ✔

Delete an object from library – – – – – – – ✔ ✔

Delete an object from safety library – – – – – – – – ✔

Get an object from a library – – – – – – – ✔ ✔

Get an object from the safety library – – – – – – – – ✔

✔ Included

– not included

54 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Global Modification
The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

Modify the documentation – ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Modify the functional view – – – – – – – ✔ ✔

Modify the animation tables ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

Modify constants value – ✔ – ✔ – ✔ – ✔ ✔

Modify safety constants value – – ✔ – ✔ – ✔ – ✔

Modify the program structure – – – – – – – ✔ ✔

Modify the safety program structure – – – – – – – – ✔

Modify program sections – – – – – – – ✔ ✔

Modify safety program sections – – – – – – – – ✔

Modify project settings – – – – – – – ✔ ✔

✔ Included

– not included

Elementary Modification of a Variable

The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug

Access right

Variable add/remove – – – – – – – ✔ ✔

Safety Variables add/remove – – – – – – – – ✔

Variable main attributes modifications – – – – – – – ✔ ✔

Safety Variables main attributes modifications – – – – – – – – ✔

Variable minor attributes modifications – ✔ – ✔ – ✔ – ✔ ✔

Safety Variables minor attributes modifications – – ✔ – ✔ – ✔ – ✔

✔ Included

– not included

EIO0000004105.03 55
Security Editor Security Editor Tool Implementation

Elementary Modification of DDT Compound Data

The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

DDT add/remove – – – – – – – ✔ ✔

DDT modifications – – – – – – – ✔ ✔

✔ Included

– not included

Elementary Modification of a DFB Type

The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

DFB type add/remove – – – – – – – ✔ ✔

Safety DFB type add/remove – – – – – – – – ✔

DFB type structure modification – – – – – – – ✔ ✔

Safety DFB type structure modification – – – – – – – – ✔

DFB type sections modification – – – – – – – ✔ ✔

Safety DFB type sections modification – – – – – – – – ✔

✔ Included

– not included

Elementary Modification of a DFB Instance

The access rights for this category are as follows:
Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug

Access right

DFB instance modification – – – – – – – ✔ ✔

Safety DFB instance modification – – – – – – – – ✔

DFB instance minor attributes modification – ✔ – ✔ – ✔ – ✔ ✔

Safety DFB instance minor attributes – – ✔ – ✔ – ✔ – ✔

modification
✔ Included

– not included

56 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Bus Configuration Editor

The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

Modify the configuration – – – – – – – ✔ ✔

Modify the safety configuration – – – – – – – – ✔

I/O sniffing – – – – – – – ✔ ✔

✔ Included

– not included

Input/Output Configuration Editor

The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

Modify the I/O configuration – – – – – – – ✔ ✔

Modify the safety I/O configuration – – – – – – – – ✔

Adjust the I/O – ✔ – ✔ – ✔ – ✔ ✔

Adjust the safety I/O – – ✔ – ✔ – ✔ – ✔

Save_param – – – ✔ – – – ✔ ✔

Restore_param – – – ✔ – – – ✔ ✔

✔ Included

– not included

Runtime Screens
The access rights for this category are as follows:
Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug

Access right

Modify screens – – – – – – – ✔ ✔

Modify messages – – – – – – – ✔ ✔

Add/remove screens or families – – – – – – – ✔ ✔

✔ Included

– not included

EIO0000004105.03 57
Security Editor Security Editor Tool Implementation

Cyber Security
The access rights for this category are as follows:

Safety_Program
Safety_Operate
Safety_Adjust

Safety_Debug
ReadOnly

Program
Operate
Adjust

Debug
Access right

Create or modify application password – – – – – – – ✔ ✔

Enter Maintenance mode – – ✔ – ✔ – ✔ – ✔

Adapt Auto-Lock timeout – ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔

✔ Included

– not included

58 EIO0000004105.03
Security Editor Tool Implementation Security Editor

OS Loader Access Rights

Introduction
This topic presents the available access rights for OS Loader product.

Description
The OS Loader access rights are as follows:

Access right Description

Sniffing You can launch a sniffing program on the network.

Connect/disconnect You can connect/disconnect OS Loader to a device.

Read Device Properties You have access to the device properties.

Read Executive Properties You have access to the OS properties

Start/Stop You can start/stop controller.

Upload executive You can upload OS from device

Download executive You can download OS to device

EIO0000004105.03 59
Security Editor Security Editor Tool Implementation

Assigned OS Loader Access Rights to Predefined Profiles

Introduction
This topic presents the access rights assigned to the predefined profiles.

Project services
Access right ReadOnly Program

State Audit Confirm State Audit Confirm

Sniffing ✔ Yes No ✔ No No

Connect/disconnect ✔ Yes No ✔ No No
Read Device Properties ✔ Yes No ✔ No No

Read Executive Properties ✔ Yes No ✔ No No

Start/Stop – Yes No ✔ No No

Upload executive ✔ Yes No ✔ No No

Download executive – Yes No ✔ No No

✔ Included

– not included

60 EIO0000004105.03
Security Editor Tool Implementation Security Editor

Security Database Migration Tool

Migration Procedure
The first time you launch the Security Editor, you are prompted to migrate an
existing security database. You can follow the prompts or choose to migrate an
existing database during a subsequent login.
Throughout the procedure below, accept the on-screen prompts to proceed with
the migration.
Migrate a security database:

Step Action

1 Launch the tool with one of these methods:

• Type Security Database Migration Tool in the Windows search box.
• Double-click the executable file for the tool (SecDBConv.exe) in your downloaded
EcoStruxure Control Expert program folder.

2 When prompted, log in to the previous database by entering the access credentials for
the SecurityAdmin account, page 12 on the Security Database Migration Tool login
page.
NOTE: In legacy versions of EcoStruxure Control Expert (earlier than version 15.3),
use the credentials for the Supervisor (super user) account, as discussed in the
description of the migration of the administrator role.

3 Select Login and accept any prompt to log in to the current database.

4 Enter the access credentials for the same administrative user as above on the Security
Database Migration Tool login page.

5 Select Login and wait for confirmation that the previous data are migrated to the current
database.

NOTE: You can confirm that the database is migrated by verifying that the
appropriate data appears on the tabs in the Security Editor.

EIO0000004105.03 61
Security Editor

Index
C
Control Expert
access rights .....................................................46
predefined profiles .............................................52
Security Editor ...................................................46

O
OS Loader
access rights .....................................................59
security editor ....................................................59
OS Loader
predefined user profiles ......................................60

62 EIO0000004105.03
Schneider Electric
35 rue Joseph Monier
92500 Rueil Malmaison
France
+ 33 (0) 1 41 29 70 00
www.se.com

As standards, specifications, and design change from time to time,

please ask for confirmation of the information given in this publication.

© 2023 Schneider Electric. All rights reserved.

EIO0000004105.03