ABB COM600 series 5.0 Cyber Security Deployment Manualline

Also see for COM600 series 5.0: Technical reference manual Technical reference manual

ABB COM600 series 5.0 Cyber Security Deployment Manualline Manual pdf 26 page image

Centralized user Activity Logging (CAL) serverThe CAL server in COM600 is capable of receiving and storing security events in theform of syslog messages. The security events include events generated both from withinCOM600 and/or from other devices (such as protection relays/RTUs) that share the samephysical perimeter with COM600.The security events received by CAL server, can be stored within COM600 for a max-imum configurable time period of up to ninety days. The security events can also beelectronically forwarded to up to six entities located outside the physical perimeter ofCOM600, through syslog messages. This allows for remote security event monitoringfrom devices outside the physical perimeter of COM600.The security events captured by CAL server can be viewed using COM600 WebHMI.These security events can be viewed only with COM600-Administrator privileges.Malicious Code Prevention3.4.Data Execution Prevention3.4.1.Data Execution Prevention (DEP) is a Windows Operating System security feature thatprotects from malicious code execution.In general, software is loaded into memory for execution. It also uses heap and stackfrom memory to manage its data for its functioning. Any vulnerabilities in software likebuffer overrun, could allow malicious code to be injected in to the memory through thedata it uses. Once the malicious code is loaded in to memory there is always the risk ofit being executed.The operating system provides isolation in memory for a software process between thecode being executed and the data it uses. Any attempt to execute code from the regionof memory marked for data used by a process will be blocked by using this DEP feature.DEP can be hardware or software enforced.DEP can be configured either to protect all programs or to protect only essential Windowsprograms or services. In COM600 DEP is by default configured to protect essentialWindows program or services.To configure DEP:1. Login to COM600 using a user account that has administrative privileges.2. Go to Control Panel.3. Click on System.4. In the subsequent System properties dialog, go to Advanced tab. Click Settingsunder Performance.5. In the subsequent Performance Options dialog, either select261MRS758267COM600 series 5.0Cyber Security Deployment Guideline