Network Security

This section applies to all exposed services of the components (Industrial Edge Hub, Industrial Edge Management, Industrial Edge Device) being part of Industrial Edge Ecosystem.

Component	Purpose	Description
System firewall	Minimize attacks for Industrial Edge Devices (IED)	By default, only port 443 should be open on the IED, protected through Transport Layer Security (TLS). Incoming traffic is routed through this port. Apps on the IED can open further ports on demand. By default, on the IEM the port 443/9433/9444 is exclusively open, and the customer can configure a specific port range for the relay server functionality.
Web interfaces	Common termination of TLS for all services	All web interfaces (except custom ports opened by apps) are secured through TLS 1.2 and strong cipher suites. Secure HTTP headers and cookies with Secure-Flag are applied on all web interfaces to mitigate common web vulnerabilities.
User authentication on web services	Allow only authenticated and authorized access to web services	IE provides a user authentication and authorization mechanism for HTTPS based communication that can be used by apps. Apps that open additional ports are responsible for securing the communication via these ports.
DoS	Denial-of-Service attacks	Internet facing services offered by Industrial Edge being operated as SaaS solutions are protected against Denial-of-Service attacks. Components being managed by the customer itself have to be protected by the customer's infrastructure.
Management ports	Intercommunication between the IE ecosystem components	Intercommunication between the Industrial Edge Device to the Management, from the App Publisher to the Management and from the Management to the Hub are initiated only by the component being mentioned firstly. This means for instance, that the management ports for the IED don't need to be exposed to external. All communication is encrypted. Access via an Internet proxy is also supported.
Port collisions	Avoid blocking of system-relevant ports on operated IEDs	Allocating system-relevant ports by deployed Industrial Edge Apps on an Industrial Edge Device is blocked by a list of system-critical ports being specified in the policy being enforced during the installation process on the Industrial Edge Management.