ABB FBXi, CBXi and ASPECT® Network Security Best Practice Application Note

HOW-TO GUIDE

HT0045 Rev 6

FBXi, CBXi and ASPECT® SOLUTIONS Network Security Best Practice This document describes networking within the ABB Cylon Building Environment Management System (BEMS), in order to identify Security considerations and aid troubleshooting for Ethernet Networking on ABB Cylon systems.

DON’T EXPOSE YOUR DEVICES ON THE INTERNET ............................................................................................ 1 NETWORK SECURITY STRATEGY ........................................................................................................................... 2 CHANGE “FACTORY DEFAULT” CREDENTIALS ................................................................................................... 2 PATCH YOUR SYSTEMS ............................................................................................................................................ 2 USE ENCRYPTED COMMUNICATIONS .................................................................................................................. 2 DON’T FORGET PHYSICAL SECURITY ................................................................................................................... 3 DON’T FORGET ABOUT “PEOPLE” ......................................................................................................................... 3 ALWAYS FOLLOW DOCUMENTED BEST PRACTICES FOR SECURING YOUR DEVICES AND SYSTEMS ... 4

DON’T EXPOSE YOUR DEVICES ON THE INTERNET Although a comprehensive discussion of network security is far beyond the scope of this document, the following items provide a starting point for creating a secure installation of equipment. Where available, users should always defer to the security policies of the hosting network organization. 1. If possible, install the ABB Cylon BEMS solution on a standalone network which is dedicated to BMS controls only. Do not mix with other IP devices such as CCTV or credit card terminals. 2. Remember, if something is exposed to the Internet and publicly available for access, it is accessible by every person and computer on the planet. Therefore: Be deliberate in your decision making about what truly needs to be exposed. 3. Be aware that every device on the Internet is constantly being probed and attacked. In the past, users may have had a successful history with ABB Cylon solutions being open to the Internet, but due to today’s widespread use of the Internet, all Internet-enabled technologies are experiencing new security challenges. 4. Expose the minimum information of a device necessary to accomplish a task. This is often referred to as “minimizing your surface area”. Carefully evaluate whether something really needs public exposure or if other access methods are available (such as VPN). For example, a site may have multiple FBXi or CBXi Series Area Controllers and a single ASPECT®-Enterprise server. A suggested method of practice would be to only expose the ASPECT®-Enterprise server as a centralized point for external accessibility. 5. Use VPN (Virtual Private Network(s)) wherever possible. This allows authorized users within an organization to access a device without exposing it to the entire world. VPN access also provides an additional layer of user security credentials in order to gain access to a network.