Security and Privacy

This document outlines the security measures, data privacy practices, and architectural considerations in Industrial Asset Hub (IAH).

Siemens strictly adheres to data protection principles, emphasizing data minimization and Privacy by Design.

Personal Data Handling

The product processes and stores the following personal data for access management, notifications, and auditing:

First and last name
User ID
Email address
Timestamps of user actions
IP addresses
MAC addresses

Audit Logging Scope for Remote Access

Audit logs capture remote connection lifecycle events, including who started and who closed SSH or WebSocket remote connections. Audit logs also capture HTTP and HTTPS calls handled by the asset webserver.

Actions performed inside an active SSH or WebSocket remote connection are not recorded in audit logs.

Customer Responsibilities

Customers remain fully responsible for the data they upload or input into the service, including ensuring data is free from malware, viruses, or unauthorized content.

Linking the collected personal data to other operational data (e.g., employee shift plans) to create new personal references, or storing additional personal information in custom user-defined fields, requires ensuring compliance with applicable data protection guidelines (e.g., GDPR).

While Siemens implements comprehensive security controls, including encryption and regular backups, we cannot be held liable for disruptions or damages caused by malicious or unauthorized customer-uploaded content.

Cybersecurity Information

Siemens designs products with industrial cybersecurity functions to support the secure operation of plants, systems, machines, and networks.

Protect your infrastructure against cyber threats by implementing and continuously maintaining a holistic, state-of-the-art industrial cybersecurity concept. IAH is one element of this broader concept.

Network Isolation: Systems and machines should only be connected to enterprise networks or the internet when strictly necessary, and only behind appropriate security measures like firewalls and network segmentation.
Best Practices: For more information on recommended measures, visit the Siemens Industrial Cybersecurity page.
Updates: Apply product updates immediately. Running unsupported versions increases exposure to cyber threats. Subscribe to the Siemens Industrial Cybersecurity RSS Feed to stay informed.

Asset Gateway Security Monitoring

Siemens continuously monitors both the latest and the previous release of the Asset Gateway application for potential security vulnerabilities.

When a vulnerability is identified, its severity and impact are assessed. Critical vulnerabilities are published via Siemens Security Advisories. Run the latest released version of the Asset Gateway to ensure the most up-to-date security patches are applied.

Network Security Architecture

Industrial Asset Hub is designed with a firewall-friendly architecture. All system components initiate outbound connections from lower network levels to upper levels using a secure, TLS-encrypted communication channel.

Perimeter Protection and Deployment

All components operated on-premises must be protected by suitable perimeter defenses. In typical manufacturing environments, a network cell protection concept prevents direct exposure of the automation layer to the outside world.

The Asset Gateway acts as the bridge. Because it needs to reach automation-level protocols, it is typically deployed on the boundary between the machine network and the enterprise network (e.g., hosted on a Siemens Industrial Edge Device).

Figure: Exemplary network sketch showing boundary deployment

Required Network Endpoints

Allow outbound traffic from your firewall to the following access points so the Asset Gateway can communicate with the IAH backend services.

Environment	Backend URLs / IP Addresses
Productive `<tenant>`.eu1.sws.siemens.com/industrialassethub/	Domain: cloud.eu1.sws.siemens.com IP Addresses: 3.163.252.234, 3.163.251.234, 3.163.250.234, 3.163.249.234, 3.163.248.234, 3.163.247.234, 3.163.246.234, 3.163.245.234, 3.163.244.234, 3.163.243.234, 3.163.242.234, 3.163.241.234, 3.163.240.234, 3.163.239.234, 3.163.238.234, 3.163.237.234, 3.163.236.234, 3.163.235.234, 3.163.234.234, 3.163.233.234, 3.163.232.234

Note

Additional network configurations, such as proxy settings, may be required depending on your IT policies. For Industrial Edge, these can be configured during device onboarding or in the system settings.

On-Premises Device Security

Siemens is responsible for the security of the IAH backend and for monitoring the Asset Gateway and Asset Links applications for vulnerabilities. Secure the device on which these applications run.

Software Updates

Keep all software layers on the host device current:

Host operating system and firmware: Apply security patches for the Edge device OS and hardware firmware promptly. For Siemens Industrial Edge Devices, updates are distributed through the Industrial Edge Management (IEM) system.
Industrial Edge platform: Ensure the Industrial Edge runtime is kept at a supported, up-to-date version.
Asset Gateway and Asset Links: Install new releases as soon as they become available. Running an outdated version of either application leaves known vulnerabilities unmitigated. Subscribe to the Siemens Industrial Cybersecurity RSS Feed to receive timely notifications.

Running unsupported or outdated software on the boundary device is one of the most common entry points for attacks on OT environments.

Secure Device Configuration

Apply the following baseline configuration to the Edge device:

Restrict management access: Limit Edge device management interface, and IEM access to authorized personnel and management networks only. Never expose the device management interface to the open internet.
Use strong, unique credentials: Disable default accounts and passwords. Use individual accounts per administrator so actions can be attributed and audited.
Apply least-privilege networking: Only permit network traffic that is operationally required. Outbound connections should be limited to the endpoints listed in Required Network Endpoints. All other outbound traffic should be blocked by default.
Disable unused services: Turn off any services, protocols, or open ports on the host that are not required by the Asset Gateway or Asset Links applications.
Review configuration regularly: Periodically audit firewall rules, user accounts, and software versions to ensure the device remains in a known, secure state.

Operational Impact and Best Practices

Impact on Production Networks

IAH utilizes active scanning methods to discover asset-specific information. Active scanning is required to identify connected devices that communicate infrequently and would otherwise be missed by passive network monitoring.

Because active scanning generates additional network traffic, it can potentially influence communication processes within your production environment.

Best Practice: IAH uses industry-standard discovery protocols, but not all legacy field devices are fully compliant. Run an initial test scan during a scheduled maintenance window, or on a dedicated test network, before executing a full discovery scan in a live production environment.

Secure Disposal of Local Components

When decommissioning on-premises IAH components (like the Asset Gateway), securely remove all application data:

Stop Containers: Stop all running containers (e.g., using docker-compose down or your Industrial Edge Management interface).
Remove Data: Delete all associated Docker volumes, images, and residual application data from the host device.
Delete Credentials: Securely wipe any server user credentials or onboarding configuration files (gateway-config.json) from the local client machines used during setup.
Audit: Document the disposal process, including the date and the specific hardware components wiped, to satisfy your internal compliance requirements.

Cookies

For information on cookie handling in the web application, refer to the official Siemens Cookie Notice.

Any questions left?

Ask the community