+INF.13.A12 Secure Configuration of TBM Systems (S)

INF.13.A12 Secure Configuration of TBM Systems (S)

All systems in TBM and systems operated by TBM SHOULD be configured securely.

At minimum, these configurations SHOULD be tested before a system is put into operation. Configuration changes during productive operations SHOULD be tested on a test instance before activation or only carried out according to the principle of dual control.

The configuration of systems SHOULD be backed up to enable quick re-installation of an error-free version (rollback). Rollback tests SHOULD be set up on a test system or performed during maintenance windows. The configurations SHOULD be stored centrally.

Automated distribution of software updates and configurations SHOULD be set up for similar systems, including devices at the automation and field level (see section 4.1, TBM-Specific Terminology Used).

Configuration changes SHOULD be made known to all the parties involved in operational and service processes (fault clearance, on-call service, maintenance, etc). In particular, these include:

  • Changes to access mechanisms or passwords
  • Changes to communication and control parameters for integrated systems

In the event of a malfunction, it SHOULD be ensured that a maintenance technician can operate or parameterise the system affected (for example).

Furthermore, whether systems are configured according to the corresponding specifications SHOULD be checked both regularly and whenever required. The results SHOULD be documented in a transparent manner. Deviations from the specifications SHOULD be corrected.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.24 Destruction of Devices or Storage Media
blocks G 0.25 Failure of Devices or Systems
blocks G 0.26 Malfunction of Devices or Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.39 Malware
blocks G 0.41 Sabotage
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.47 Harmful Side Effects of IT-Supported Attacks