10 Cybersecurity
Xylem values system security and resilience. Defending against cybersecurity threats is a
shared responsibility. Xylem builds products that are secure by design. Our customers have
a responsibility to understand the risks inherent in their processes and take steps to operate
and maintain their solutions securely. This section reviews security features and provides
guidance to help securely operate this product. For details and updates on Xylem product
cybersecurity visit
https://www.xylem.com/en-us/about-xylem/cybersecurity/
10.1 Xylem Product Cybersecurity
Xylem performs appropriate due care in building security and resilience into products. Xylem
performs the following security activities for defense-in-depth:
• security engineers perform threat modeling to identify testable controls
• code is scanned for flaws with static analysis tools and hardened
• product components are analyzed and hardened
• security controls are verified through automated and manual tests
• Xylem maintains relationships with customers, integrators, and the cybersecurity
research community and the Product Security Incident Response Team (PSIRT)
coordinates the collection, analysis, remediation, and responsible disclosure of
vulnerability and remediation information to keep products secure
• cloud connections, data flows, and cloud infrastructure are continuously monitored by the
Product Security Operations Center (PSOC)
• Product security is governed through a three lines of defense model that includes:
product developers, product security engineers, and audit staff
10.2 Security Recommendations for End-User
optimyze Gateway has been tailored for very specific condition monitoring applications, as
such most security hardening is already in place. The following guidance provides
recommendation for customers for hardening the operating environment, secure operations,
account management, and disposal. In the table below:
Safeguards describe the security
guidance,
Security Context & Rationale provide overview of security features and value of
the security safeguard, and
References provide additional resources for further investigation
for implementing the recommended safeguards.
Safeguard
Security Context & Rationale
References
Restrict physical access
• Ensure physical access to
assets is limited. Include
physical isolation to protect the
environment and equipment
therein.
• Ensure strict control over
physical access in and out of
the facility.
Each of the communication ports
have been hardened to restrict
access and ensure integrity of
device operations. For example,
data transit to the cloud is
encrypted and the device is
provisioned before shipping. BLE
pairing requires proximity and the
magnetic key on the optimyze
sensor. Command line connection
requires authentication. This
safeguard supports the ability to
further limit exposure associated
with physical threats to the device
itself.
ATT&CK for ICS: M0801
NIST SP 800-53 Rev5: AC-3,
PE-3
ISA/IEC 62443-3-3: SR 2.1
10 Cybersecurity
14
optimyze
™
Gateway Instruction, Operation, and Maintenance Manual
