Defense in Depth Measures Expected in the Environment

GENESIS is one layer of a defense-in-depth strategy. The GENESIS threat model assumes that the environment where GENESIS is installed provides the measures in this topic. Threats that these measures address are mitigated by the environment instead of by product features. If a measure is not in place at your site, the risk it addresses falls to the asset owner, who must mitigate it by other means or accept it.

The measures are grouped by the defense-in-depth layers described in the whitepaper Highly Secure HMI/SCADA and Automation Systems. Each row pairs an expected measure with the threat model assumption that it satisfies. For the product settings that harden GENESIS itself, see Security Hardening Guidelines.

Human Layer

Expected Measure	Threat Model Assumption
Train operators, engineers, and administrators in security awareness. Personnel open GraphWorX display files, Workbench packages, Pack and Go files, and imported graphics files only from trusted sources.	Social engineering attacks that persuade a user to open or deploy malicious project content are mitigated through user awareness.
Treat unsolicited requests for credentials, security configuration, or security recovery information as potential social engineering, even when the requester claims to be a colleague or technical support.	Attackers who impersonate trusted parties to obtain access are mitigated through user awareness and site procedures.
Grant administrative rights only to trusted, identified personnel, and monitor all system administration activities.	Users at the system administrator trust level are trusted not to act maliciously.

Physical Layer

Expected Measure	Threat Model Assumption
Limit physical access to server machines and networking devices. For example, keep server hardware and networking devices in locked rooms with restricted access.	Attackers cannot reach server hardware to tamper with it, boot alternate media, or copy disks.
Restrict access to backup media, for example by storing it at a secure off-site location.	Backups of configuration databases and logged data are protected to the same level as the live system.
Restrict physical access to computers that use a USB license key, and allow only server administrators to run applications that can write to the key.	The USB license key cannot be removed, wiped, or replaced by unauthorized personnel.

Network Layer

Expected Measure	Threat Model Assumption
Segment the network into zones separated by firewalls, and use demilitarized zones (DMZs) for systems that connect to the enterprise network or the internet. Follow ICS-CERT and NIST guidance. The whitepaper Highly Secure HMI/SCADA and Automation Systems includes a sample GENESIS architecture with zone segmentation.	GENESIS servers are not directly exposed to untrusted networks, and internet firewalls protect the automation network.
Configure firewall rules so that only the ports required by the services in use are reachable. Learn more	Only the GENESIS interfaces that the system uses are reachable from the network.
Make SQL Server reachable only from GENESIS servers and administrative workstations, not from client machines.	SQL Server is not accessible over the network to client machines.
Keep communication between the Security server and SQL Server, Active Directory, and other directory services on a private network. Keep communication between redundant servers on a private network, including Data Historian loggers, Alarm Historian servers, and other redundant server pairs or clusters.	Server-to-server and server-to-directory traffic happens over a private network.
Configure HTTPS for FrameWorX client/server communication and for web servers that host the HTML5 Server, and use strong TLS settings and ciphers. The installation does not secure these channels by default. HTTP Strict Transport Security (HSTS) is recommended. Learn more	Communication between clients and servers is protected in transit by a well-configured HTTPS transport.
Secure cloud services that GENESIS connects to, such as Azure IoT Hub, Azure Event Hubs, MQTT brokers, Microsoft Entra ID, and external identity providers, according to the service provider's security guidance.	Communication with cloud services and identity providers is secured by the customer's cloud administration.
Isolate building automation and device networks, such as BACnet and SNMP networks, from the internet.	Field-device protocols that lack strong authentication are reachable only from trusted networks.

Host Layer

Expected Measure	Threat Model Assumption
Use one of the officially supported operating systems documented in the GENESIS system requirements.	GENESIS runs on an operating system that its vendor still supports with security updates.
Install the latest security updates for the Windows operating system and the Microsoft .NET runtime, and keep them up to date.	The latest operating system and application security patches are applied.
Allow only system administrators direct file system access on GENESIS servers.	Tampering with binaries on the server is prevented by IT measures.
Keep the default operating system permissions on the GENESIS installation folder and on [ProgramData]\ICONICS\11, which holds configuration files, the license file, logged data, and log files. If you move a data or log location, restrict the new location to the same level.	Configuration, license, data, and log files on the local disk are protected by the operating system.
Harden Internet Information Services (IIS) and the Windows services that GENESIS uses according to your organization's server hardening standard.	Web servers and Windows services that host GENESIS components are hardened by the customer.
Install anti-virus software on all servers and workstations, keep it operational, and update the virus definition files regularly.	Malware is detected and blocked by host-based protection.
Patch all third-party plugins and tools that are embedded or deployed as part of IT systems to their latest versions.	Third-party software on the host does not introduce known vulnerabilities.
When WebHMI is deployed in Kubernetes, secure the cluster, the container registry credentials, and the Rancher management portal. Learn more	The Kubernetes cluster and its management tools are secured by the customer's cluster administrator.

Data Layer

Expected Measure	Threat Model Assumption
Use a SQL Server version that is included in the GENESIS list of supported versions. Refer to the system requirements.	GENESIS databases run on a SQL Server version that is supported and tested.
Install the latest SQL Server service packs and hot fixes.	Known SQL Server vulnerabilities are patched.
Harden SQL Server with Windows authentication or least-privilege SQL logins, and restrict who can read or modify GENESIS databases. Encrypt the databases. Learn more	Configuration data, security settings, and stored connection credentials in SQL Server databases are protected by SQL Server security.