BECKHOFF IPC-Security - Manual (Page 7)

2. Introduction
2.1. Abstract
Beckhoff Industrial PCs and Embedded PCs provide a platform based on a standardized and wellsupported
operating system to provide a high level of flexibility for developing and executing applications. The Docu-
mentation for IPC-Security provides a list of potential security threats and how to protect against them.
The documentation is structured according to different attacker models and countermeasures for the arising
potential threats. This documentation is far from being complete but will be frequently updated and main-
tained in the future. Please note that, depending on the scenario, it may not make sense to activate all of the
listed countermeasures. Sometimes it may even prove to be unnecessary. In any case the reader should
make sure to fully understand his/her scenario before planning to implement any security mechanisms.
Security is just another view on risk-management, so there definitely is no completely secure state, just as
there is no completely risk-free automation process.
However the documentation provides a good baseline protection, which may be sufficient for most applica-
tions.
2.2. Target audience and goals
The primary purpose of this documentation is to give customers an overview about standard security mea-
sures and strategies on Industrial-PCs (IPC) and Embedded-PCs (EPC) that are based on Microsoft Win-
dows.
In this context, it is important for customers to understand that Microsoft Windows already includes many
features to enhance security on an IPC or EPC, e.g. the so-called “Application Whitelist”. Those features
can greatly increase the protection of industrial controllers. Because many people are not aware of them,
they sometimes dread choosing Microsoft Windows on their automation systems.
Furthermore it is also important to differentiate the IPC/EPC we use in an automation scenario with the PC
we use in a consumer scenario as an engineering computer or at home. Both scenarios have different
security requirements and entirely different workflows, e.g. system maintenance and the deployment of
Windows Updates.
2.3. Structure of this document
This documentation is split into three main areas.
IPC Security 7