Security At Opc Ua; Security Settings - Siemens SIMATIC S7-1500 Function Manual

OPC UA communication

9.2 Security at OPC UA

9.2 Security at OPC UA
9.2.1

Security settings

Addressing risks
OPC UA allows the exchange of data between different systems, both within the process
and production levels and to systems at the control and enterprise level.
This possibility also entails security risks. That is why OPC UA provides a range of security
mechanisms:
● Verification of the identity of OPC UA server and clients.
● Checking of the identity of the users.
● Signed/encrypted data exchange between OPC UA server and clients.
These security policies should only be bypassed in cases where it is absolutely necessary:
● During commissioning
● In stand-alone projects without external Ethernet connection
If you have selected the endpoint "None" for "UA Sample Client" of the OPC Foundation, for
example, the program issues a clear warning:
When STEP 7 compiles your project it also checks whether you have considered the setting
options for the protection and warns you of possible risks. This also includes an OPC UA
security policy with the setting "no security", which corresponds to the end point "None".
Note
Disabling security policies you do not want
If you have enabled all security policies in the secure channel settings of the S7-1500 OPC
UA server – thus, also the end point "None" (no security) – unsecured data traffic (neither
signed nor encrypted) between the server and client is also possible. The OPC UA server of
the S7-1500 CPU also sends its public certificate to the client at "None" (No security). And
some clients check this certificate. However, the client is not forced to send a certificate to
the server. The identity of the client may possibly remain unknown. Each OPC UA client can
then connect to the server irrespective of any subsequent security settings.
When configuring the OPC UA server, make sure that only security policies that are
compatible with the security concept of your machine or plant are selected. All other security
policies should be disabled.
Recommendation: Use the setting "Basic256Sha256 - Sign and Encrypt", which means that
the server only accepts Sha256 certificates. The security policies "Basic128Rsa15" and
"Basic256" are deactivated by default and should not be used as an end point. Select end
points with a higher security policy.
146
Function Manual, 11/2019, A5E03735815-AH
Communication