> For the complete documentation index, see [llms.txt](https://support.onlogic.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.onlogic.com/support-articles/security-guidelines-iec-62443-4-1/sg-3-security-hardening-guidelines.md).

# SG-3: Security Hardening Guidelines

## Introduction and Purpose

This technical manual provides explicit, step-by-step instructions for reducing the attack surface of Industrial PCs (IPCs) in accordance with the IEC 62443-4-1 SG-3 (Security Hardening Guidelines) requirement. Initial out-of-the-box factory configurations are often optimized for ease of use rather than security, frequently leaving default credentials, open ports, and unmanaged services active. Implementing this guide ensures compliance with IACS (Industrial Automation and Control Systems) security objectives before connecting the asset to the operational network.

## Hardening Framework Overview

The following table outlines the core hardening categories, specific technical requirements, and underlying security objectives enforced during this out-of-the-box setup procedure:

<table data-header-hidden><thead><tr><th width="187.40740966796875"></th><th></th><th></th></tr></thead><tbody><tr><td>Hardening Category</td><td>Technical Requirement</td><td>IACS Security Objective</td></tr><tr><td>Identity Management</td><td>Remove default users; enforce unique accounts and complex passwords.</td><td>Prevent unauthorized access via known or weak credentials.</td></tr><tr><td>Service Minimization</td><td>Disable unused network services (SSH, Telnet, HTTP) and software packages.</td><td>Reduce the logical attack surface and potential entry points.</td></tr><tr><td>Network Security</td><td>Configure host-based firewalls with "deny-all" default settings.</td><td>Restrict communication to only necessary and authorized ports.</td></tr><tr><td>Physical Security</td><td>Password-protect the BIOS; disable boot from USB; lock unused ports.</td><td>Mitigate threats from individuals with physical access to the hardware.</td></tr><tr><td>Integrity Protection</td><td>Enable UEFI Secure Boot and measure the boot sequence via TPM.</td><td>Ensure the system has not been tampered with during the boot process.</td></tr></tbody></table>

## Step-by-Step Implementation Procedures

3.1 Physical Security & BIOS/UEFI Configuration (Pre-Boot Environment)

Physical modifications and low-level firmware configuration must be completed prior to operating system installation or network initialization.

1. Establish Firmware Security: Power on the IPC and enter the BIOS/UEFI setup utility (typically via F2, F12, or Del keys). Navigate to the Security tab and configure a strong supervisor/administrative password to restrict unauthorized modification of boot parameters.
2. Disable External Boot Vectors: Modify the Boot Priority order to set the internal primary drive (SSD/HDD) as the sole boot device. Explicitly disable booting from USB interfaces, optical drives, and network-based Preboot Execution Environment (PXE).
3. Lock Inactive Physical Interfaces: Physically seal or disable unused external ports (e.g., USB, Serial, extra RJ45 ports) using physical port locks or by disabling the controller directly within the BIOS peripherals menu.
4. Enable Chassis Intrusion Detection: If supported by the IPC hardware, enable the "Chassis Intrusion" alert feature in the BIOS to log or halt the system if the physical casing is opened.

3.2 Integrity Protection

Integrity protection ensures that the operating system kernel and boot loaders have not been modified by malicious software or rootkits.

* Enable UEFI Secure Boot: Inside the BIOS/UEFI interface, ensure the Boot Mode is explicitly set to Native UEFI (disable Legacy/CSM support). Locate and enable "Secure Boot" to enforce cryptographic signature verification on all loaded binaries.
* Activate Trusted Platform Module (TPM): Verify that TPM 2.0 (or equivalent hardware security chip) is enabled and activated in the firmware. This facilitates measured boot operations and anchors system encryption keys into hardware.
* Enable Storage Volume Encryption: Configure full disk encryption (such as Windows BitLocker or Linux LUKS) utilizing the TPM chip to automatically protect data at rest against physical drive theft.

3.3 Identity Management (OS Initialization)

During the initial boot of the operating system, default access structures must be systematically dismantled.

1. Purge Default Accounts: Identify and eliminate pre-configured OEM or OS accounts (e.g., "admin", "user", "root"). Under no circumstances should default factory usernames remain active.
2. Provision Unique Accounts: Establish role-based accounts dedicated to individual personnel. Create separate non-administrative user accounts for operational routines and distinct administrator accounts reserved strictly for maintenance.
3. Enforce Complex Password Policies: Apply local security policies mandating a minimum length of 14 characters, combining uppercase, lowercase, numeric, and special characters. Enforce account lockout thresholds (e.g., 3 failed attempts triggers a 15-minute lock).
4. Disable Guest and Anonymous Access: Explicitly disable the built-in "Guest" account profile and restrict anonymous SID/enumeration mappings within the operating system policies.

3.4 Service Minimization

Unnecessary processes running in the background present a severe, unmonitored risk profile.

* Identify Active Services: Execute a scan or review running processes to evaluate legacy protocols (e.g., Telnet, FTP, HTTP, SMBv1).
* Disable Protocols and Port Listeners: Explicitly turn off or uninstall unneeded daemon architectures. For example, disable legacy clear-text administration protocols (Telnet/HTTP) and enforce encrypted variants (SSH/HTTPS) exclusively if remote management is justified by operational requirements.
* Remove Superfluous Software: Uninstall development utilities, games, browsers, and default trial software packages shipped with the stock operating system image.
* Disable Auto-Run Features: Turn off media and external drive AutoPlay/AutoRun functionality to prevent malicious files from automatically executing when a USB or optical drive is connected.

3.5 Network Security (Host-Based Firewall)

The system must be isolated from the broader network environment by restricting boundary data transmissions.

1. Enforce a Deny-All Default Policy: Access the local host-based firewall settings (e.g., Windows Defender Firewall or iptables/ufw on Linux). Set the global behavior for all incoming connections to "Block/Deny All" across all network profiles (Domain, Private, Public).
2. Define Explicit Inbound Exceptions: Create surgical firewall rules allowing incoming traffic only on mandatory operational ports (e.g., specific industrial protocol ports such as Modbus TCP, OPC UA, or Ethernet/IP) and restrict the allowed source scopes to known, trusted engineering workstations or PLCs.
3. Restrict Outbound Traffic: Where feasible, limit outbound connectivity from the IPC to designated logging servers (Syslog) or local patch repositories, blocking general outbound internet access completely.
4. Disable Network Discovery and File Sharing: Turn off network discovery protocols (like LLMNR, NetBIOS, and mDNS) unless specifically required for control network communications.

3.6 Audit and Event Logging (System Accountability)

To support system accountability and satisfy diagnostic requirements, robust trace logging must be configured locally and prepared for transport.

1. Configure Local Audit Policies: Enable advanced auditing within local system security policies. Ensure active monitoring and logging are configured for the following critical event classes:
   1. Logon/Logoff events (both successful and failed attempts)
   2. Privilege use and administrative elevation
   3. Local security policy modifications (firewall shifts, account adjustments)
   4. System events (startup, shutdown, raw time adjustments)
2. Set Log Retention Restrictions: Set local log storage properties to prevent overwrite failures. Enforce a minimum log size (e.g., 1024MB) and configure the system to "Overwrite events as needed" or block operations until archived if strict storage limits exist.
3. Setup Centralized Log Forwarding: Configure local event forwarding utilities (such as Windows Event Forwarding or rsyslog on Linux) to push security and audit events to an designated, out-of-scope syslog server or SIEM agent situated in the local OT zone.

3.7 Patch Management Lifecycle (Offline Deployment Prep)

Maintaining security status requires systematic operating system and software maintenance processes, even in highly segregated (air-gapped) environments.

1. Define Baseline Target Version: Prior to deployment, catalog and verify the precise OS patch baseline version approved by the IACS vendor/integrator.
2. Configure Offline Update Channels: Disable default automated internet search routes for software updates. Configure the local updater agent to pull approved binaries only from an on-premise local management node (e.g., WSUS or local package mirror) or secure USB "transient" deployment procedures.
3. Establish Update Windows: Program local update installation policies to restrict automatic restarts of critical system nodes. Updates must only install manually during controlled engineering maintenance windows.

## Post-Hardening Verification Checklist

* Firm password prompt appears when attempting to access BIOS/UEFI.
* System fails to boot when an external bootable USB drive is inserted.
* Secure Boot status is verified as "Active" or "Enabled" within the OS environment.
* Full disk encryption status is active and verified.
* Default factory user accounts are completely deleted or disabled.
* Network discovery, AutoPlay, and Guest profiles are explicitly disabled.
* Local audit policy records successful and failed user logon attempts.
* Centralized log-forwarding destination is configured and pingable.
* Automatic operating system internet update checks are disabled.
* Port scan (e.g., local netstat check) confirms that unrequired ports (21, 23, 80) are unresponsive.
* Host firewall is running and successfully dropping unsolicited test pings or connection attempts.