Introduction
FrameworX was designed to enable applications on mission Our platform caters to mission-critical systems , in various segments, including Energy, with NERC requirementsin sectors like Energy, Oil & Gas, and Pharma with FDA requirements, and various other segments. Independently of regulations requirements, all applications, small to large, HMI to IoT, benefits from the stable, reliable infra-structure and strong security protections inherent. to the platform. This section will address some of those . Whether meeting NERC or FDA standards, it provides a stable, secure infrastructure from HMI to IoT. This section delves into key features.
On this page:
| Table of Contents | ||||
|---|---|---|---|---|
|
Security
and ReliabilityHighlights
Flexibility is a feature; Security and Reliability are mandatory and foundational requirements.
We built the platform design selection of technologies and the architecture of the modules to have stability and security at its core.
Easy and Secureprioritize stability and security throughout our platform's design, from technology selection to module architecture.
Easy Configuration and Maintenance
We created our platform thinking in different scenarios and topologies, from a local interface on an embedded panel to fault-tolerant servers that serve multiple projects and clients. The platform's development tools and project components are scalable, reusable, and consistentOur platform offers secure, straightforward configuration and maintenance for various scenarios, ensuring scalability and consistency.
Operational Stability
Our Operational stability is guaranteed with our platform's 100% managed code implementation provides unmatched operational stability since its intrinsically safe software architecture includes execution threads isolation, exception control, failure recovery, modular deployment, hardware abstractions, and operating system independence. , featuring robust exception handling and seamless failure recovery.
Redundancy and
HighAvailability
For high availability systems, the platform can have a our platform offers redundancy with a proven hot-standby system for real-time database, Alarm and Historian servers, and data acquisition deployed as a redundant hot-standby system, with no project changes required.The hot-standby redundancy is field-proven with hundreds of devices in the network and multiple clients. databases, alarms, and historians, catering to diverse network setups.
FDA 21 CFR Part 11 and NERC
The software platform has a range of security and compliance features that can be used to help organizations meet the requirements of FDA 21 CFR Part 11. It is important to note that compliance is an ongoing process, and therefore, organizations should regularly monitor and update their systems and policies to ensure adherence to the standards established by the FDA.
The platform was also designed following the applicable recommendations from NERC CIP, such as the CIP-007-1 - Cyber Security-System Management.
Title 21 CFR Part 11 is the part of Title 21 of the Code of Federal Regulations that establishes the United States Food and Drug Administration (FDA) regulations on electronic records and electronic signatures (ERES).
Part 11, as it is commonly called, defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records.
Listed below and described are some security-related features available in the product:
| Panel | ||
|---|---|---|
| ||
|
For detailed Explanation on how to add security management in project consist with these rules, go to to the page FDA 21 CRT Compliance page, under the chapter Security, Users and Roles.
For addition information on NERC CIP-007-1 - Cyber Security-System Management, go to the page NERC CIP Overview.
Built-in .NET Security
The FactoryStudio FrameworX development is based built on the .NET , using managed code, following security guidelines, where the development with .NET managed code must follow the .NET rules. There are specific guidelines followed for specific modules. For example, the Alarms adherence to the FDA guidelines are followed, for Electrical device communications with the IEC61850, or the other IEC are followed. Below are the main FS-Security topics and some basic information about them.
Link to Microsoft information about Security in .Net:
https://docs.microsoft.com/en-us/dotnet/standard/security/
framework, following strict security protocols. Each module adheres to specific guidelines aligned with its function, such as FDA compliance for the Alarms module and adherence to standards like IEC61850 for modules handling electrical device communications.
Below are the main security topics along with essential details about each.
| Tip | |
|---|---|
| Tip | |
| |
| |
Security must be implemented implementation is ingrained at the core , not level rather than being applied externally. The Platform Modules' have platform's modules incorporate built-in security related components designed from the their very core. For more detailed insights into security in .NET, refer to Microsoft's documentation available at: Microsoft .NET Security Information |
Communication Security
Communication between modules
The cryptography Cryptography plays a crucial role in securing communication between external modules — processes out of TServer: and TServer, encompassing processes such as ScriptTaskServer, DataAccess, Devices, TRichClient, SmartClient, ModuleInfo, TraceWindow, PropertyWatch, etc — and TServer uses basically two classes:and PropertyWatch. Two primary classes are employed for this purpose:
a) System.Security.Cryptography.RSACryptoServiceProvider RSACryptoServiceProvider (Asymmetric, KeySize: 1024): Performs Facilitates asymmetric encryption and decryption using utilizing the RSA algorithm implementation of the RSA algorithm provided by the cryptographic service provider cryptographic service provider (CSP).
bb) SystemSystem.Security.Cryptography.Rijndael (KeySize: 256).
Note 1: No external program gets access to the TServer without: Utilized for encryption and decryption, Rijndael operates with a key size of 256 bits.
It's essential to note:
- External programs can only access TServer after undergoing validation/authentication. TServer
- responds to external
- requests only following validation/authentication
- , accomplished either through user/password authentication or Windows Authentication.
- "RSACryptoServiceProvider" is
- utilized for generating private/public keys, while "
- Rijndael"
- handles the encryption/decryption process, leveraging the aforementioned private/public keys
- .
Note 3: The data are only compressed if block size is over 16000 bytes. The compression is GZIP". "ModuleInformation" displays estimated values of each connection. WCF adds some bytes while sending data, so the values in "ModuleInformation" are estimated.
- Data compression is employed only if the block size exceeds 16000 bytes, utilizing the GZIP compression method. The ModuleInformation feature offers estimated values for each connection, considering that WCF may introduce additional bytes during data transmission.
- ".NET Framework applications should
- utilize the TLS version supported by the operating system (OS)
- ."
- FactoryStudio does not manually
- configure the TLS
- version but rather relies on the OS's configuration.
- Remote access via WebAccess services (third-party
- programs or modules)
- utilizes either HTTP or HTTPS to consume available web services
- .
Communication with web clients
HTML5
provides flexibility in choosing between "http" or "https/ssl" protocols.
Further, you can setup your application to have mandatory long, as well various forms with custom authorization, like IP filterer, or Location, among other.
Secure WebGateway
The TWebGateway is a tool included in the platform to allow to route data across different security Network zones, like moving that from the Level 2, the factoryFloor, to Level 4, the enterprise.
It also prevents unsecured traffic from entering an internal network of an organization. It is used by enterprises to protect their employees/users from accessing and being infected by malicious web traffic, websites and virus/malware.You can configure compression settings like GZIP on the IIS server. Moreover, you can implement custom authorization methods such as IP filtering or location-based authentication, along with mandatory session settings.
Secure WebGateway
The TWebGateway is a crucial part of our platform, enabling smooth data transfer across different security network zones. It serves as a bridge, moving data from lower levels, like the factory floor (Level 2), to higher levels such as the enterprise (Level 4).
Acting as a protective barrier, the TWebGateway shields internal networks from insecure traffic. Enterprises rely on it to guard employees and users against potential threats from malicious web traffic, websites, viruses, and malware.
Files and Execution Protection
License/Softkey
The "License/Softkey"
feature employs the .NET class System.Security.Cryptography.Rijndael
, utilizing symmetric encryption with a key size of 256 bits.
Digital signature
All assemblies created by Tatsoft are signed digitally.
Project format (Configuration protection)
All project
settings, including security measures like cryptography, power recovery, and user/password protections, are stored in a relational database (.
dbsln file)
. The
source code and
compiled binaries for Scripts and Displays are also stored in
this file.
This centralized storage method streamlines project management and deployment, making access and maintenance easier.
User Authentication and Permissions
User Authentication
The Our platform supports Integration offers integration with various systems for user authentication:
Microsoft ActiveDirection, Widows| Panel | ||
|---|---|---|
| ||
|
|
|
|
Active-Directory / Windows Authentication
Enabling Windows Authentication
bypasses the project
's configured user list, relying on Windows policies instead. Windows manages user authentication directly, utilizing the currently logged-in Windows user for system access.
LDAP
When
LDAP is used, the project
ignores its configured user list and relies on policies managed by Windows and the LDAP Server. Authentication is handled by both Windows and the LDAP Server
, with the external user logged into the LDAP Server
being utilized within the system.
Runtime Users
The system dynamically generates users and
stores their credentials in SQL databases.
It seamlessly integrates with Active Directory or third-party
systems to retrieve users, enabling integrated security
and unified login capabilities.
Roles, Permission and Policies
Group and User Permissions
Our users have complete flexibility to define privileges based on groups or specific
individuals. Permissions can be
set globally or
linked to particular displays, objects, or input
actions, offering granular control over access levels.
User Policies
Our platform offers a comprehensive array of user management features, including identification policies, session duration
control, automated logoff
mechanisms, electronic signature capabilities, and robust audit-trail
functionality.
Database Injection Protection
In the database , calling Stored Procedure, operations involving stored procedures, there is a great significant concern about this part of "injection", because SQL injection. SQL injection can occur if parameters are passed as plain text in within SQL Statement, the "injection" could be possible. Against this statements, which could allow malicious code to be executed. To prevent this, we use the .NET API, where parameters are added to a list, making it impossible to code injectioncommand object’s parameter list. This approach makes SQL injection impossible by safely handling user input.
Security External Validation
Regularly the platform is accessed by Veracode, or third-party companies, on penetration testing report, gap analysis, and various other topics.
Any issues that would prevent a 100% approval are corrected.
In this section...
| Page Tree | ||||
|---|---|---|---|---|
|