Security Hardening Guidelines

These guidelines describe how to harden a GENESIS installation and keep it hardened. Apply them after installation and review them whenever you change the system. For the protections that the environment is expected to provide, see Defense in Depth Measures Expected in the Environment.

Web Server and HTTPS

  • After installing the product, follow Microsoft guidelines for configuring SSL settings to accept only HTTPS connections. For more information, see How to Set Up SSL on IIS 7 or later.

  • FrameWorX client/server communication is not encrypted by default. Configure the FrameWorX Server connection to use Secured (HTTPS) for all clients and for connections between FrameWorX servers. Learn more

  • When you connect FrameWorX servers to each other, do not use the Anonymous client authentication mode on production systems. It is intended for testing only. Learn more

  • Configure strong TLS settings and ciphers, and consider enabling HTTP Strict Transport Security (HSTS) on web servers that host GENESIS web content. Learn more

Services, Endpoints, and Interfaces

  • Do not run services that aren't necessary. For example, disable any unused point managers and stop their services, as well.

  • Disable all FrameWorX Server endpoints that aren't needed by removing them from the server configuration file (C:/ProgramData/ICONICS/11/Servers/FwxServer.config.json).

    We recommend that you back up this file before making modifications.

  • Disable the OPC UA interface, unless the OPC UA interface is being used by a third-party OPC UA client. This can be done by modifying C:/ProgramData/ICONICS/11/Servers/FwxServer.config.json.

    We recommend that you back up this file before making modifications.

    In the "Server" section, add "OpcUaInterface": false. For example:

    "Server": { /* Enables/disables OPC UA interface */ "OpcUaInterface": false, [...] }

  • Disable network server discovery on servers that do not need to announce themselves to other FrameWorX servers. On the Settings tab of the Platform Services Configuration dialog, in the Discovery group, clear the Broadcast Alive State setting.

    When enabled (default), the server periodically broadcasts its presence over the network so that it can be discovered by other servers. Disabling it stops these broadcasts (see Port Security).

  • Keep the Bridging Command Line Activity and File Transfer Activity disabled unless your transactions require them. Both activities act on the host operating system and are disabled by default. If you enable them, enable them only on the nodes that need them. Learn more

GENESIS Security

Configure GENESIS Security to secure configuration and run-time operations. For the accounts, password policies, and authentication options, see Account Management Guidelines.

  • Set up GENESIS Security and enforce a strong password.

  • On production systems, set Security Active to Active in Global Settings. The Testing option grants all permissions when no user is logged in, and the Inactive option always grants permissions. Learn more

  • Set up security to allow only authorized operators to see the Security settings.

  • Set up the automatic logout of users to help prevent unauthorized access to the system. Learn more

  • Limit the information that the login dialog reveals. In the Global Settings configuration panel, clear the following checkboxes. Learn more

    • Provide list of existing users in the login dialog

    • Show currently logged in user in login dialog

    • Provide detailed login error code

  • Do not select Password required to logout in account policies. Requiring a password to log out gives an attacker another way to guess passwords. Learn more

  • Clear Allow simultaneous login unless several users must be logged in on the same computer at the same time. When it is selected, only the permissions of the most recent user apply.

  • Select Check file security in configuration mode so that GraphWorX also applies file security when displays are edited.

  • Use the Files privilege to restrict the display files that each user or group can open, create, and modify. Allowing users to open only known display files protects them from displays that come from untrusted sources. Learn more

  • Disable the Start Application application action in the Security server configuration unless you are using the Start Application command in GraphWorX. If using the Start Application command, be aware that it can be used to start any application. As a result, you should be careful when you use it.

  • If using GENESIS Security in Database mode, as opposed to using it in conjunction with Active Directory, use binary TCP or HTTPS for the FrameWorX communications protocol. Do not use HTTP.

    When GENESIS Security is set to Active Directory mode, no user passwords are stored, but the password for the connection from the Security server to Active Directory is stored. This password is obfuscated. You can avoid storing passwords in the database altogether by leaving the Active Directory connection user name and password blank. In this case, the security will use Integrated Windows Authentication to connect to the Active Directory. For Integrated Windows Authentication to work, the FrameWorX Server must run under the Network Service account and the computer must be domain-joined.

  • For more detailed and complete information on configuring the GENESIS Security server, see GENESIS Security Overview.

Communications

  • Use secure, encrypted OPC UA communications. For more information, see Creating an OPC UA Connection. We recommend that you become familiar with OPC UA Security Concepts and Security Guidelines.

  • Using OPC Classic communications is not recommended for two reasons:

    • The Classic OPC Point Manager, which provides access to OPC Classic, must run under the SYSTEM account to provide it with elevated security access to the system.

    • The Classic OPC servers don't provide any security.

  • For BACnet, isolate the BACnet network from the internet, and use BACnet/SC, which requires certificates and encrypts communication, instead of BACnet/IP where possible. Learn more

  • For SNMP, use SNMP v3, which is the only SNMP version that supports authentication and encryption. Do not rely on SNMP v1 or v2c community strings on untrusted networks. Learn more

  • For MQTT connections to cloud brokers, use the Secured MQTT ("mqtts:") or Secure Web Sockets ("wss:") protocol, and set Security Mode to TLS ver. 1.3 (recommended). Learn more

  • Alarm acknowledgment by SMS or email cannot verify the identity of the person who replies, because phone numbers and email addresses can be spoofed. An acknowledge code identifies the worker, but it does not authenticate them. If you allow acknowledgment by SMS or email, require acknowledge codes by selecting Enable Acknowledge ID in Alert Notifications. For secure acknowledgment, have users log in to GraphWorX or MobileHMI. Learn more

Scripting and Project Content

  • Scripting technologies may open the system to the execution of arbitrary, insecure code, and should be avoided. Commanding and Bridging are recommended replacements.

    • If GraphWorX scripting is not needed in your project, we recommend that you do not enable GraphWorX scripting. It has been disabled by default in GENESIS version 11.

    • ScriptWorX64 has been removed from GENESIS version 11. We recommend that you do not install ScriptWorX64 on the system.

    • When scripting must be used, ensure that the script includes an audit log (GenEvent) reporting method call to properly log all write operations if using scripts that perform write operations.

  • Import Workbench packages, Pack and Go packages, and GraphWorX display files only from trusted sources. Learn more

  • To prevent the possibility of tampering with GraphWorX display files if web publishing capabilities are required, configure the FTP server where the display files are stored to require a user/password for write access to the server. If web publishing capabilities aren't required, ensure FTP access to the website is fully disabled.

Databases, Data, and Logs

  • Secure the SQL Server database(s) used in the system by encrypting the databases. Additionally, we recommend that you apply the best practices as defined in the Microsoft article, SQL Server Security Best Practices.

  • Treat the configuration databases, their backups, and exported configurations as sensitive, because they contain security settings and the credentials that GENESIS uses to connect to other systems. Restrict access to them to administrators.

  • Do not use the SQL Server Java language extension, and do not install Java Runtime Environment (JRE). The SQL Server installation includes older versions of java .jar files which may expose your system to potential vulnerabilities when JRE or the language extension is installed.

  • Enable the local configuration cache for the applicable applications, so that servers continue to run if the configuration database or the network fails. In Workbench, go to Home > Configure Application(s) settings and select Local Cache. The cache is a copy of the configuration databases, so protect its folder in the same way. Learn more

  • Keep the default operating system permissions on the [ProgramData]\ICONICS\11 folder, which contains logged data, certificates, the license file, and log files. If you move a data or log location, restrict the new location in the same way.

  • Configure the audit log to record the operator actions and configuration changes that your organization needs to trace, and restrict access to the displays that show the audit log. The settings are in Workbench > Servers and Redundancy > Server Settings > Audit Event Settings. Learn more

  • TraceWorX logs can contain tag names and configuration file locations. Enable tracing only when you diagnose a problem, and only for the relevant components. Set Max Size and Max Parts so that the logs cannot fill the disk, and do not set a Log File Path in a shared location. Share log files only with trusted parties. Learn more

  • When you use the SQL Query Engine with GENESIS Security, do not store GENESIS credentials in plain text in shared or saved SQL scripts. Learn more

Kubernetes Deployments

  • When WebHMI is deployed in Kubernetes, protect the cluster credentials, restrict access to Kubernetes secrets, and secure the traffic between the WebHMI pods and FrameWorX Server. Learn more