Optimized  Architecture

Optimization Layers

Performance Metrics

(*) Those are expected numbers in a typical implementation. Exact metrics depending on solution design and hardware

Built-in Performance Monitoring Tools:

• Real-time performance dashboards
• Resource utilization tracking
• Bottleneck identification
• Historical trend analysis

Operational Stability

• 100% Managed Code - No memory leaks or pointer errors
• Exception Handling - Graceful failure recovery at every level
• Multi-threaded Execution - Parallel processing with thread safety
• Resource Management - Automatic garbage collection and optimization

Security Architecture

Defense in Depth Implementation

Security Zones Architecture (ISA-99/IEC 62443)

TSecureGateway enables secure data transfer across zones, bridging Level 2 (factory floor) to Level 4 (enterprise) while maintaining isolation and protection against threats.

Authentication & Authorization

Flexible Authentication Methods

Role-Based Access Control (RBAC)

• Granular Permissions - Display, object, and action-level control
• Group Hierarchies - Inherited permissions with override capability
• Dynamic Roles - Runtime permission changes based on context
• User Policies - Password complexity, session duration, auto-logoff

Compliance & Standards

Industry Standards Implementation

DevOps & Version Control

Enterprise Development Practices

Solution Configuration Protection

• Encrypted Configuration - All settings in protected .dbsln file
• IP Protection - Source code and binaries secured
• Single File Deployment - Simplified distribution and management
• Access Control - Role-based modification rights

Redundancy & High Availability

Hot-Standby Configuration

(*) Those are expected numbers in a typical implementation. Exact metrics depending on solution design and hardware

Supported Redundancy Modes:

• Server redundancy (primary/standby)
• Database redundancy (mirrored/centralized)
• Network redundancy (dual-path)
• Device redundancy (PLC communication)

External Validation

• Regular third-party penetration testing
• Veracode security assessments
• Gap analysis and remediation
• 100% approval requirement for release

"Overview" 

Tagline: Designed for Reliable Performance

(Refer and link to the Technology Stack/Foundation as the number one importance on both performance and security

Diagnostic Architecture

Logging Infrastructure

Scalability Factors

Enterprise Unlimited (Distributed) (*2)
100,000+

Enterprise Unlimited (Stand-alone)
15,000-100,000 I/O (*)

Enterprise Scaled
1,500 to 15,000 I/O

MachineHMI
Up to 1,000 I/O

Security Highlights

Security and Reliability

We prioritize stability and security throughout our platform's design, from technology selection to module architecture.

Easy Configuration and Maintenance

Our platform offers secure, straightforward configuration and maintenance for various scenarios, ensuring scalability and consistency.

Operational Stability

Operational stability is guaranteed with our platform's 100% managed code implementation, featuring robust exception handling and seamless failure recovery.

Redundancy and Availability

For high availability, our platform offers redundancy with a proven hot-standby system for real-time databases, alarms, and historians, catering to diverse network setups.

FDA 21 CFR Part 11 and NERC

The software platform has a range of security and compliance features that can be used to help organizations meet the requirements of FDA 21 CFR Part 11. It is important to note that compliance is an ongoing process, and therefore, organizations should regularly monitor and update their systems and policies to ensure adherence to the standards established by the FDA.

The platform was also designed following the applicable recommendations from NERC CIP, such as the CIP-007-1 - Cyber Security-System Management.

Title 21 CFR Part 11 is the part of Title 21 of the Code of Federal Regulations that establishes the United States Food and Drug Administration (FDA) regulations on electronic records and electronic signatures (ERES).

Part 11, as it is commonly called, defines the criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and equivalent to paper records.

Listed below and described are some security-related features available in the product:

For detailed Explanation on how to add security management in project consist with these rules, go to the page FDA 21 CRT Compliance page.

For addition information on NERC CIP-007-1 - Cyber Security-System Management, go to the page NERC CIP Overview.

Built-in .NET Security

FrameworX development is built on the .NET framework, following strict security protocols. Each module adheres to specific guidelines aligned with its function, such as FDA compliance for the Alarms module and adherence to standards like IEC61850 for modules handling electrical device communications.

Below are the main security topics along with essential details about each.

Web Client Communication Security

HTML5 provides flexibility in choosing between "http" or "https/ssl" protocols.

The production servers will use HTTPS, but the allowing http connection on development, simplifies the early state of the projects.

The HTTPS uses TLS security. 

The TSecureGateway is a crucial part of our platform, enabling smooth data transfer across different security network zones. It serves as a bridge, moving data from lower levels, like the factory floor (Level 2), to higher levels such as the enterprise (Level 4).

Acting as a protective barrier, the TSecureGateway shields internal networks from insecure traffic. Enterprises rely on it to guard employees and users against potential threats from malicious web traffic, websites, viruses, and malware.

Files and Execution Protection

User Authentication and Permissions

User Authentication

Our platform offers integration with various systems for user authentication:

Roles, Permission and Policies

Database Injection Protection

In database operations involving stored procedures, there is a significant concern about SQL injection. SQL injection can occur if parameters are passed as plain text within SQL statements, which could allow malicious code to be executed. To prevent this, we use the .NET API, where parameters are added to a command object’s parameter list. This approach makes SQL injection impossible by safely handling user input.

Security External Validation

Regularly the platform is accessed by Veracode, or third-party companies, on penetration testing report, gap analysis, and various other topics.

Any issues that would prevent a 100% approval are corrected.

Security & Users

Overview

Security & Users management in FrameworX 10.1 provides comprehensive access control, authentication, authorization, and audit capabilities to protect your industrial systems. This guide covers user management, role-based security, integration with enterprise authentication systems, and cybersecurity best practices following industry standards including ISA-99/IEC 62443.

Security Architecture

Defense in DepthSecurity Zones (ISA-99/IEC 62443)

User Management

User Account Types

SecureGateway module simplifies connecting Level 3 and Level 4 opeartoins 

Creating Users

Manual User Creation

1. Navigate to Security → Users
2. Click New User
3. Configure user properties:

User Configuration:
??? Identity
?   ??? Username: john.smith
?   ??? Full Name: John Smith
?   ??? Email: jsmith@company.com
?   ??? Employee ID: EMP001
??? Authentication
?   ??? Type: Forms / Windows / Certificate
?   ??? Password: (if Forms)
?   ??? Domain: COMPANY (if Windows)
??? Authorization
?   ??? Role: Operator
?   ??? Groups: [Production, Maintenance]
?   ??? Areas: [Line1, Line2]
??? Settings
    ??? Account Enabled: Yes
    ??? Password Expires: 90 days
    ??? Session Timeout: 20 minutes
    ??? Concurrent Sessions: 1

Bulk User Import

csv

# Users.csv format
Username,FullName,Email,Role,Groups,Password
jsmith,John Smith,jsmith@company.com,Operator,"Production,Line1",TempPass123!
mjones,Mary Jones,mjones@company.com,Supervisor,"All",TempPass456!
bwilson,Bob Wilson,bwilson@company.com,Engineer,"Engineering",TempPass789!

Import process:

1. Prepare CSV file
2. Security → Users → Import
3. Map columns
4. Validate and import
5. Force password change on first login

Password Policies

Password Requirements Configuration

Password Complexity Rules

Requirements (3 of 4):
? Uppercase letters (A-Z)
? Lowercase letters (a-z)
? Numbers (0-9)
? Special characters (!@#$%^&*)

Additional Rules:
? Cannot contain username
? Cannot contain common words
? No sequential characters (123, abc)
? No repeated characters (aaa)

Role-Based Access Control (RBAC)

Predefined Roles

Administrator (Level 0)
??? Full system access
??? User management
??? Security configuration
??? All operations

Engineer (Level 100)
??? Solution configuration
??? Display design
??? Script development
??? No user management

Supervisor (Level 200)
??? All operator functions
??? Setpoint changes
??? Alarm management
??? Report generation

Operator (Level 300)
??? View displays
??? Acknowledge alarms
??? Basic control
??? No configuration

Viewer (Level 999)
??? View only
??? No control
??? No acknowledgment
??? No configuration

Creating Custom Roles

xml

<!-- Custom Role Definition -->
<Role Name="MaintenanceTech" Level="250">
  <Permissions>
    <!-- Display Permissions -->
    <Display View="All" Control="Maintenance" />
    
    <!-- Tag Permissions -->
    <Tags Read="All" Write="Maintenance/*" />
    
    <!-- Alarm Permissions -->
    <Alarms View="All" Acknowledge="Maintenance" Configure="None" />
    
    <!-- Report Permissions -->
    <Reports View="All" Generate="Maintenance" Configure="None" />
    
    <!-- Script Permissions -->
    <Scripts Execute="Maintenance" Develop="None" />
    
    <!-- System Permissions -->
    <System Backup="Yes" Restore="No" Configure="No" />
  </Permissions>
  
  <Restrictions>
    <TimeWindow Start="06:00" End="18:00" />
    <DaysOfWeek>Monday,Tuesday,Wednesday,Thursday,Friday</DaysOfWeek>
    <IPRange>192.168.1.0/24</IPRange>
  </Restrictions>
</Role>

Permission Matrix

Authentication Methods

Windows Authentication

Integration with Active Directory:

xml

<Authentication Type="Windows">
  <Domain>COMPANY.LOCAL</Domain>
  <DefaultDomain>COMPANY</DefaultDomain>
  <AllowLocalAccounts>false</AllowLocalAccounts>
  
  <GroupMappings>
    <Map ADGroup="Domain\SCADA_Admins" Role="Administrator" />
    <Map ADGroup="Domain\SCADA_Engineers" Role="Engineer" />
    <Map ADGroup="Domain\SCADA_Operators" Role="Operator" />
  </GroupMappings>
  
  <UserSync>
    <Enabled>true</Enabled>
    <Schedule>0 2 * * *</Schedule> <!-- Daily at 2 AM -->
    <BaseDN>OU=SCADA,DC=company,DC=local</BaseDN>
  </UserSync>
</Authentication>

Forms Authentication

Built-in user database:

csharp

// Login validation
public bool ValidateLogin(string username, string password)
{
    // Hash password
    string hashedPassword = HashPassword(password);
    
    // Check database
    var user = GetUser(username);
    
    if (user != null && user.PasswordHash == hashedPassword)
    {
        // Check account status
        if (!user.IsEnabled)
            return LogFailure("Account disabled");
            
        if (user.IsLocked)
            return LogFailure("Account locked");
            
        if (user.PasswordExpired)
            return RequirePasswordChange();
            
        // Success
        CreateSession(user);
        LogSuccess(user);
        return true;
    }
    
    // Failed
    IncrementFailedAttempts(username);
    return false;
}

Certificate Authentication

Smart card and certificate-based:

xml

<Authentication Type="Certificate">
  <TrustedRootCA>CN=Company Root CA</TrustedRootCA>
  <RequiredFields>
    <Field>SubjectName</Field>
    <Field>Thumbprint</Field>
  </RequiredFields>
  
  <Mappings>
    <Map Certificate="CN=John Smith" User="jsmith" />
    <Map Certificate="OU=Engineering" Role="Engineer" />
  </Mappings>
  
  <Validation>
    <CheckRevocation>true</CheckRevocation>
    <RequireSmartCard>true</RequireSmartCard>
  </Validation>
</Authentication>

Two-Factor Authentication (2FA)

csharp

// 2FA Implementation
public class TwoFactorAuth
{
    public bool ValidateLogin(string username, string password, string token)
    {
        // First factor - password
        if (!ValidatePassword(username, password))
            return false;
            
        // Second factor - token
        if (!ValidateToken(username, token))
            return false;
            
        return true;
    }
    
    private bool ValidateToken(string username, string token)
    {
        // Time-based OTP (TOTP)
        var secret = GetUserSecret(username);
        var totp = new Totp(secret);
        
        return totp.VerifyTotp(token, out long timeStepMatched);
    }
}

Authorization & Access Control

Tag-Level Security

xml

<!-- Tag Security Configuration -->
<TagSecurity>
  <Tag Name="Production.Setpoint">
    <Read>Operator, Supervisor, Engineer, Administrator</Read>
    <Write>Supervisor, Engineer, Administrator</Write>
  </Tag>
  
  <Tag Name="Maintenance.*">
    <Read>All</Read>
    <Write>MaintenanceTech, Engineer, Administrator</Write>
  </Tag>
  
  <Tag Name="Security.*">
    <Read>Administrator</Read>
    <Write>Administrator</Write>
  </Tag>
</TagSecurity>

Display Security

xml

<!-- Display Access Control -->
<DisplaySecurity>
  <Display Name="Overview">
    <View>All</View>
    <Elements>
      <Button Name="StartProcess" Roles="Operator,Supervisor" />
      <Button Name="EmergencyStop" Roles="All" />
      <Input Name="Setpoint" Roles="Supervisor,Engineer" />
    </Elements>
  </Display>
  
  <Display Name="Engineering">
    <View>Engineer, Administrator</View>
    <Control>Engineer, Administrator</Control>
  </Display>
  
  <Display Name="UserManagement">
    <View>Administrator</View>
    <Control>Administrator</Control>
  </Display>
</DisplaySecurity>

Area-Based Security

Plant Security Zones:
??? Area 1 (Production)
?   ??? Line 1
?   ?   ??? Operators: [User1, User2]
?   ?   ??? Supervisor: [Super1]
?   ??? Line 2
?       ??? Operators: [User3, User4]
?       ??? Supervisor: [Super1]
??? Area 2 (Packaging)
?   ??? Operators: [User5, User6]
?   ??? Supervisor: [Super2]
??? Area 3 (Utilities)
    ??? Operators: [User7]
    ??? Supervisor: [Super3]

Audit Trail & Compliance

Audit Configuration

xml

<AuditConfiguration>
  <General>
    <Enabled>true</Enabled>
    <Storage>Database</Storage>
    <Retention>7 years</Retention>
  </General>
  
  <Events>
    <Login>true</Login>
    <Logout>true</Logout>
    <FailedLogin>true</FailedLogin>
    <TagWrite>true</TagWrite>
    <AlarmAck>true</AlarmAck>
    <SetpointChange>true</SetpointChange>
    <ConfigChange>true</ConfigChange>
    <UserModification>true</UserModification>
  </Events>
  
  <Details>
    <IncludeOldValue>true</IncludeOldValue>
    <IncludeNewValue>true</IncludeNewValue>
    <IncludeWorkstation>true</IncludeWorkstation>
    <IncludeTimestamp>true</IncludeTimestamp>
  </Details>
</AuditConfiguration>

Audit Log Structure

sql

CREATE TABLE AuditLog (
    ID BIGINT IDENTITY PRIMARY KEY,
    Timestamp DATETIME2 NOT NULL,
    Username NVARCHAR(50) NOT NULL,
    FullName NVARCHAR(100),
    Workstation NVARCHAR(50),
    IPAddress NVARCHAR(45),
    Action NVARCHAR(50) NOT NULL,
    ObjectType NVARCHAR(50),
    ObjectName NVARCHAR(255),
    OldValue NVARCHAR(MAX),
    NewValue NVARCHAR(MAX),
    Result NVARCHAR(20),
    Comments NVARCHAR(MAX),
    Signature VARBINARY(256)
);

-- Index for performance
CREATE INDEX IX_AuditLog_Timestamp ON AuditLog(Timestamp);
CREATE INDEX IX_AuditLog_Username ON AuditLog(Username);
CREATE INDEX IX_AuditLog_Action ON AuditLog(Action);

21 CFR Part 11 Compliance

Electronic signatures and records:

csharp

public class Part11Compliance
{
    public void RecordChange(string tagName, object oldValue, object newValue)
    {
        // Require authentication
        var credentials = RequestCredentials();
        if (!ValidateCredentials(credentials))
            throw new SecurityException("Invalid credentials");
            
        // Require reason
        string reason = RequestReason();
        if (string.IsNullOrEmpty(reason))
            throw new ValidationException("Reason required");
            
        // Create audit record
        var audit = new AuditRecord
        {
            Timestamp = DateTime.UtcNow,
            Username = credentials.Username,
            Action = "Tag Modification",
            TagName = tagName,
            OldValue = oldValue,
            NewValue = newValue,
            Reason = reason,
            ElectronicSignature = GenerateSignature(credentials)
        };
        
        // Store with integrity check
        StoreAuditRecord(audit);
    }
    
    private byte[] GenerateSignature(Credentials creds)
    {
        // Generate cryptographic signature
        using (var rsa = RSA.Create())
        {
            var data = Encoding.UTF8.GetBytes($"{creds.Username}:{DateTime.UtcNow}");
            return rsa.SignData(data, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
        }
    }
}

Security Configuration

System Security Settings

xml

<SecuritySettings>
  <!-- Session Management -->
  <Sessions>
    <Timeout>20</Timeout> <!-- Minutes -->
    <MaxConcurrent>1</MaxConcurrent>
    <ExtendOnActivity>true</ExtendOnActivity>
    <WarningBefore>5</WarningBefore> <!-- Minutes -->
  </Sessions>
  
  <!-- Communication Security -->
  <Communication>
    <RequireEncryption>true</RequireEncryption>
    <TLSVersion>1.2</TLSVersion>
    <CipherSuites>
      <Suite>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</Suite>
      <Suite>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</Suite>
    </CipherSuites>
  </Communication>
  
  <!-- Client Restrictions -->
  <ClientRestrictions>
    <AllowedIPs>
      <Range>192.168.1.0/24</Range>
      <Range>10.0.0.0/8</Range>
    </AllowedIPs>
    <BlockedIPs>
      <IP>192.168.1.99</IP>
    </BlockedIPs>
  </ClientRestrictions>
</SecuritySettings>

Hardening Checklist

Operating System

•  Latest OS patches installed
•  Unnecessary services disabled
•  Windows Firewall configured
•  Local security policies applied
•  Antivirus installed and updated

FrameworX Application

•  Default accounts disabled/renamed
•  Strong passwords enforced
•  SSL/TLS configured
•  Unnecessary modules disabled
•  Latest FrameworX updates

Network

•  Firewall rules configured
•  VLANs implemented
•  VPN for remote access
•  Network monitoring active
•  IDS/IPS deployed

Physical

•  Server room access controlled
•  Workstations locked
•  USB ports disabled
•  Screen lock timeout set
•  Clean desk policy

Security Monitoring

Real-Time Security Dashboard

Security Status Dashboard
????????????????????????????????????????????????
? Current Sessions: 12                         ?
? Failed Logins (24h): 3                      ?
? Configuration Changes (24h): 2               ?
? Suspicious Activities: 0                     ?
????????????????????????????????????????????????
? Recent Security Events:                      ?
? 10:23 - User login: jsmith                  ?
? 10:15 - Failed login: unknown               ?
? 09:45 - Password changed: mjones            ?
? 09:30 - Role modified: Operator             ?
????????????????????????????????????????????????

Security Reports

sql

-- Failed login attempts report
SELECT 
    Timestamp,
    Username,
    IPAddress,
    COUNT(*) as Attempts
FROM SecurityLog
WHERE Action = 'Login Failed'
    AND Timestamp > DATEADD(day, -7, GETDATE())
GROUP BY Timestamp, Username, IPAddress
HAVING COUNT(*) > 3
ORDER BY Timestamp DESC;

-- Privilege usage report
SELECT 
    Username,
    Action,
    COUNT(*) as Count
FROM AuditLog
WHERE Action IN ('Setpoint Change', 'Force Value', 'Config Change')
    AND Timestamp > DATEADD(month, -1, GETDATE())
GROUP BY Username, Action
ORDER BY Count DESC;

Incident Response

Security Incident Procedure

Incident Detected
      ?
      ?
Classify Severity
      ?
      ??? Critical: Immediate response
      ??? High: Within 1 hour
      ??? Medium: Within 4 hours
      ??? Low: Next business day
      ?
      ?
Contain Threat
      ?
      ??? Isolate affected systems
      ??? Disable compromised accounts
      ??? Block suspicious IPs
      ?
      ?
Investigate
      ?
      ??? Review logs
      ??? Identify root cause
      ??? Assess damage
      ?
      ?
Remediate
      ?
      ??? Apply patches
      ??? Reset credentials
      ??? Restore from backup
      ?
      ?
Document & Learn

Best Practices

User Management

• Use individual accounts (no shared accounts)
• Implement least privilege principle
• Regular access reviews (quarterly)
• Disable unused accounts immediately
• Enforce strong password policies

Authentication

• Use Windows Authentication when possible
• Implement two-factor for critical access
• Regular password rotation
• Account lockout after failures
• Session timeout enforcement

Authorization

• Role-based access control
• Granular permissions
• Area-based restrictions
• Time-based access windows
• Regular permission audits

Monitoring

• Enable comprehensive audit logging
• Regular log review
• Automated alerts for suspicious activity
• Security dashboard for operators
• Incident response procedures

Troubleshooting Security Issues

AI Assistant Data

<details> <summary>Structured Information for AI Tools</summary>

json

{
  "page": "Security & Users",
  "type": "Security Reference",
  "purpose": "Comprehensive security and user management documentation",
  "sections": {
    "architecture": ["Defense in depth", "Security zones", "ISA-99/IEC 62443"],
    "userManagement": ["Account types", "Password policies", "Bulk import"],
    "authentication": ["Windows/AD", "Forms", "Certificates", "Two-factor"],
    "authorization": ["RBAC", "Tag security", "Display security", "Areas"],
    "compliance": ["Audit trail", "21 CFR Part 11", "Electronic signatures"],
    "monitoring": ["Real-time dashboard", "Security reports", "Incident response"]
  },
  "standards": {
    "industrial": "ISA-99/IEC 62443",
    "regulatory": "21 CFR Part 11",
    "enterprise": "Active Directory, LDAP"
  },
  "bestPractices": [
    "Least privilege principle",
    "Individual accounts",
    "Strong passwords",
    "Regular audits",
    "Comprehensive logging"
  ]
}

</details>

In this section...