FEC920: USER GUIDE
Page 5
A
September 18
2.4.3 HMI Passwords
When entering passwords via the HMI, the following features help protect against unauthorized access:
• Each digit is obscured (replaced with an asterisk character) after entry, to help protect against an
unauthorized person seeing the password as it is typed in.
• Password entry is locked after a configurable number of invalid attempts (if Auditor option is enabled). If
this number of attempts is exceeded, the User account is disabled. This helps protect against “brute
force” attempts to guess the password.
• The controller records the number of successful and unsuccessful login attempts for each level of
password. This is recorded in the History. Regular auditing of this History is recommended, as a means
to help detect unauthorized access to the controller.
2.4.4 Ethernet security features
Ethernet connectivity is available on the
FEC920
. The following security features are specific to Ethernet:
2.4.4.1 Ethernet rate protection
One form of cyberattack is to try to make a controller process so much Ethernet traffic that this drains systems
resources and useful control is compromised. For this reason, the
FEC920
device includes an Ethernet rate
protection algorithm, which will detect excessive network activity and help to ensure the controller’s resources
are prioritized on the control strategy rather than the Ethernet. If this algorithm is activated, a message will be
entered into the History.
2.4.4.2 Broadcast Storm protection
A ‘broadcast storm’ is a condition which may be created by cyberattack: spurious network messages are sent
to devices which cause them to respond with further network messages, in a chain reaction that escalates until
the network is unable to transport normal traffic. The
FEC920
device includes a broadcast storm protection
algorithm, which will automatically detect this condition, stopping the controller from responding to the spurious
traffic. If this algorithm is activated, a message will be entered into the History.
2.4.5 Configuration backup and recovery
Using the iTools software, you can ‘clone’ a
FEC920
device, saving all its configuration and parameter settings
to a file. This can then be copied onto another controller, or used to restore the original controller’s settings.
Clone files are digitally signed using an SHA-256 cryptographic algorithm, meaning that if the file contents is
tampered with, it will not load back into a controller.
2.5 MEMORY INTEGRITY
When a
FEC920
device powers up, it automatically performs an integrity check on the contents of its internal
non-volatile memory devices. Additional periodic integrity checks are performed during normal runtime and
when non-volatile data is being written. If any integrity check detects a difference from what is expected, the
controller enters Standby mode and a message is displayed on then screen.
A5E45696052A Rev-AA
