Definitions

Installation preparation

This document explains the preparations that are needed before the installation and configuration of an Impex system can be done. These steps and the information collected should be documented and kept ready at the time of the installation to ensure proper configuration.

USB Protect and Xtransfer

USB Protect needs the following documented:

1. IP-address
2. Netmask
3. Default gateway
4. DNS servers
5. Proxy configuration, optional
6. Fully qualified domain name
7. Fully qualified domain name for the ICC and REPO server
8. IP-address of the ICC

USB Protect needs the following configuration prepared:

1. Outbound firewall opening to the ICC server
2. Outbound firewall opening to DNS resolver, unless a hosts file entry for the ICC server is set up on the station instead
3. Outbound firewall opening to proxy, if used

Xtransfer need the following configuration prepared:

1. Outbound firewall opening to the ICC server
2. Outbound firewall opening to KDC server
3. Outbound firewall opening to CIFS server
4. Outbound firewall opening to DNS resolver
5. Outbound firewall opening to proxy, if used

USB Protect and Xtransfer need port TCP/443 to be open outwards to be able to communicate with the ICC server. USB Protect and Xtransfer will synchronise time and obtain software updates over this port. It also uses this connection to upload scanning reports and system logs. All traffic between the USB Protect station and the ICC server is encrypted with TLS. If USB Protect and Xtransfer cannot validate the server certificate, this is likely with a self-signed certificate or a certificate from an internal CA, the Trust On First Use (TOFU) method will be used. If USB Protect and Xtransfer use a proxy, the proxy must allow connections from the USB Protect to the ICC server. USB Protect is configured with the fully qualified domain name of the ICC server, and normally needs a DNS server to translate this name into an IP-address before it can connect. This lookup can be avoided by adding an entry to the hosts file on the USB Protect station itself, a local file that tells the station which IP-address belongs to the ICC server’s name, so it does not need to ask a DNS server. If a hosts file entry is set up this way, USB Protect does not need any DNS access. If it is not set up, USB Protect needs port TCP/53 and UDP/53 to be open outwards to a DNS server so it can resolve the ICC server’s name. Xtransfer needs port UDP/88 and TCP/88 to be open outwards to the KDC server. Xtransfer needs port TCP/445 to be open outwards to the CIFS server. Xtransfer needs port TCP/53 and UDP/53 to be open outwards to the DNS resolver.

DataLock

The server can be a virtual appliance or a physical server. The server should have the following minimum specification:

1. 16 GB memory
2. 2 GHz CPU, 2 cores or more depending on usage
3. 1 TB of disk storage or more depending on data usage in network flows

Note: The system should only have one disk.

The DataLock server needs the following information before installation can be completed:

1. IP-address
2. Netmask
3. Default gateway
4. Proxy configuration, optional
5. Resolver
6. Fully qualified domain name
7. Fully qualified domain name for the ICC and REPO server

If firewall openings are required, the following should be allowed:

1. Outbound firewall opening to the resolver
2. Outbound firewall opening to proxy, optional
3. Outbound firewall opening to the ICC server

DataLock needs port TCP/443 to be open outwards to be able to communicate with the ICC server. DataLock will synchronise time and obtain software updates over this port. It also uses this connection to upload scanning reports and system logs. All traffic between DataLock and the ICC server is encrypted with TLS. If DataLock cannot validate the server certificate, this is likely with a self-signed certificate or a certificate from an internal CA, the Trust On First Use (TOFU) method will be used. If DataLock uses a proxy, the proxy must allow connections from DataLock to the ICC server.

The DataLock needs TCP/22 to be open for incoming and outgoing SFTP connections.

Repo server

The server can be a virtual appliance or a physical server. It is also possible to have the Repo services installed in the ICC server. The server should have the following minimum specification:

1. 16 GB memory
2. 2 GHz CPU, 4 cores
3. 300 GB of disk storage

Note: The system should only have one disk.

The Repo server needs the following information before installation can be completed:

1. IP-address
2. Netmask
3. Default gateway
4. Proxy configuration, optional
5. Time server
6. Resolver
7. Fully qualified domain name

If firewall openings are required, the following should be allowed:

1. Outbound firewall opening to updates.sysctl.se
2. Outbound firewall opening to time service (NTP)
3. Outbound firewall opening to proxy, optional
4. Outbound firewall opening to Active Directory, if used
5. Inbound firewall from the ICC server
6. Inbound firewall from remote access solution, if used

ICC server

The server can be a virtual appliance or a physical server. The server should have the following minimum specification:

1. 16 GB memory
2. 2 GHz CPU, 4 cores
3. 500 GB of disk storage

Note: The system should only have one disk.

The ICC server needs the following information before installation can be completed:

1. IP-address
2. Netmask
3. Default gateway
4. Proxy configuration, optional
5. Time server
6. Resolver
7. Fully qualified domain name
8. Fully qualified domain name for the Repo server
9. Mail relay

If firewall openings are required, the following must be allowed:

1. Outbound firewall opening to time service (NTP)
2. Outbound firewall opening to Let’s Encrypt, if used
3. Outbound firewall opening to mail relay (SMTP), if used
4. Outbound firewall opening to proxy, if used
5. Outbound firewall opening to Active Directory, if used
6. Outbound firewall opening to Repo server
7. Inbound firewall from Impex stations
8. Inbound firewall from operators network
9. Inbound firewall from remote access solution, if used

Virtualisation requirements

If the Repo server, DataLock or the ICC server is installed as a virtual server we recommend the options below. Other options might be possible but would require additional testing.

1. Boot options a. EFI boot is mandatory b. Secure boot when possible, mandatory for DataLock
2. One of the following disk devices a. SATA b. PV SCSI
3. Network options a. VMXNET3
4. Hardware options a. TPM when possible

Network

The Impex solution is designed to fit into architectures based on IEC62443 and similar zone-based network designs, as well as other network topologies. These are two examples of how Impex can fit in a network. The ICC and the Repo can be on the same machine and do not need to be separate servers. The solution supports a proxy, but a proxy is not required.

Network with ICC and Repo installed on the same server in a basic network

                  +-------------------+   +--------------+
                  | updates.sysctl.se |   | Lets Encrypt |
                  +------^------------+   +-----^--------+
    Internet             |                      |
                         |     +----------------+
                         |     |
+------------------------------------------------------------+
                         |     |
    DMZ              +---+-----+---+
                     |  Firewall   <------+
                     +-------------+      |
                                          |
                                    +-----+----+
                      +------------->  Proxy   |
                      |             | if used  |
                      |             +----------+
                      |
                      |
                 +----+--------------------+
                 |                         |
                 |   ICC and optional Repo <------+
                 |                         |      |
                 +-------^-----------------+ +----^----+
                         |                   | Proxy   |
                         |                   | if used |
                         |                   +-+-------+
                         |                     |
+------------------------+---------------------+-------------+
                         |                     |
    Peripheral Network   |                     |
                         |                     |
                  +------+-------+     +-------+------+
                  | USB Protect  |     | USB Protect  |
                  +--------------+     +--------------+

Network with ICC and Repo installed on separate servers in a zone based network

                  +-------------------+   +--------------+
                  | updates.sysctl.se |   | Lets Encrypt |
                  +------^------------+   +-----^--------+
    Internet             |                      |
                         |     +----------------+
                         |     |
+------------------------------------------------------------+
                         |     |
    DMZ              +---+-----+---+
                     |  Firewall   <------+
                     +-------------+      |
                                          |
                                    +-----+----+
                 +------------------>  Proxy   |
                 |                  | if used  |
                 |                  +----------+
            +----+-------------+
            |                  |
            |  Repo, if used   |
            |                  |
            +----+-------------+
                 |
+------------------------------------------------------------+
                      |
    Internal network  |
                      |
                 +----+--------------------+
                 |                         |
                 |   ICC and optional Repo <------+
                 |                         |      |
                 +-------^-----------------+ +----^----+
                         |                   | Proxy   |
                         |                   | if used |
                         |                   +-+-------+
                         |                     |
+------------------------+---------------------+-------------+
                         |                     |
    Peripheral Network   |                     |
                         |                     |
                  +------+-------+     +-------+------+
                  | USB Protect  |     | USB Protect  |
                  +--------------+     +--------------+

Network for the DataLock

                  +-------------------+   +--------------+
                  | updates.sysctl.se |   | Lets Encrypt |
                  +------^------------+   +-----^--------+
    Internet             |                      |
                         |     +----------------+
                         |     |
+---------------------------------------------------------------------+
                         |     |
    DMZ              +---+-----+---+
                     |  Firewall   <------+
                     +-------------+      |
                                          |
                                    +-----+----+
                      +------------->  Proxy   |
                      |             | if used  |
                      |             +----------+
                      |
                      |
                 +----+--------------------+
                 |                         |
                 |   ICC and optional Repo <------+
                 |                         |      |
                 +-------^-----------------+ +----^----+
                         |                   | Proxy   |
                         |                   | if used |
                         |                   +-+-------+
                         |                     |
+------------------------+---------------------+-----------------------+
                         |                     |
    Office Network       |                     |
                         |                     |
                         |                     |
   +--------+       +----+-----+         +-----+----+      +--------+
   | Sender |-------> DataLock |         | DataLock <------| Sender |
   +--------+       +----------+         +----------+      +--------+
                         |                     |
                         |                     |
+------------------------+---------------------+------------------------+
                         |                     |
    Protected Network    |                     |
                   +-----v----+           +----v-----+
                   | Receiver |           | Receiver |
                   +----------+           +----------+

Internet dependencies

The Repo server requires internet connectivity to be able to access updates.sysctl.se for updates. All updates for operating system, ICC server, USB Protect, DataLock and AV-signatures are downloaded from updates.sysctl.se over a TLS-connection.

The ICC server supports the use of Let’s Encrypt¹ to get a trusted certificate. Let’s Encrypt is not required and certificates can be installed manually to the ICC and Repo. Using the Let’s Encrypt feature ensures that certificates are updated automatically. This greatly reduces administrative overhead, but as with all public CAs, the certificate will be published in the CT log.

The Repo server is the only device that requires an internet connection, and it only communicates with a clearly defined destination.

DMZ

The Repo server could be placed in a DMZ network segment. The Repo needs an outbound connection to the internet and specifically to updates.sysctl.se. This could be through a proxy.

Internal Network

As a suggestion, the ICC server can be placed in an internal network, and access to the ICC should be restricted by an external firewall. The ICC needs an outbound connection to the Internet and specifically to Let’s Encrypt when the module is used. This can be through a proxy.

The ICC server needs access to a time server to get the correct time and a DNS server to resolve DNS names. If email notifications are enabled, the ICC server must have access to a mail relay.

The ICC server requires inbound connections from the Impex stations to be able to receive scanning reports. It should also allow inbound access from administrators and operators so that they can access the web interface.

It should also allow inbound access from administrators to the SSH console.

Peripheral Network

In the peripheral network or where the USB Protect is placed, the only network access needed from the USB Protect is to the ICC server over TCP/443.

USB Protect is not listening on any network port, so it is not possible to connect to a station. It is possible to ping the devices; they allow ICMP echo and can send ICMP echo replies.

Protected Network

The protected network is where the only way to transfer files in is through DataLock.

Firewalls and proxies

Firewall

The firewalls should limit access to the Stations and the ICC server and only allow the defined ports and protocols that are needed by the service.

Network ports with ICC and Repo on separate servers

Network ports with ICC and Repo on the same server

Proxy

The ICC server, Repo server, DataLock, Xtransfer and USB Protect can use a proxy, but it is optional; if no proxy is used, it is still possible to use the services.

Proxy configuration

The ICC server, Repo server, DataLock and USB Protect have support for the most common proxies, and the proxy should be configured to limit the server to only access the required domains.

Transparent proxy

If there are any transparent proxies that try to inspect the traffic, the connection will fail due to strong encryption and certificate validation enforcements. It is recommended to use syslog to get audit logs from the systems.

Checklist

The information below should be filled in before the installation date.

Signature:

Name:

Contacts

Sysctl would like to have email and optional mobile numbers to contact persons.

Email address to receivers of new release information emails:

Email and number to system owner:

Servers

The ICC and Repo server could be either on the same machine or on separate servers.

ICC server

• Virtual machine is created

• Physical machine exists

• IP address:

• Netmask:

• Default gateway:

• Fully qualified domain name:

• Proxy configuration:

• NTP servers:

• DNS servers:

• SMTP server:

Repo server

• Virtual machine is created

• Physical machine exists

• IP address:

• Netmask:

• Default gateway:

• Fully qualified domain name:

• Proxy configuration:

• NTP servers:

• DNS servers:

Network

• Routing exists between ICC server and USB Protect
• Routing exists between ICC server and Xtransfer
• Routing exists between ICC server and DataLock
• Routing exists between Repo server and ICC
• Routing exists between Repo server and updates.sysctl.se

Firewall rules

• USB Protect has access to ICC server
• USB Protect has access to DNS resolver (not needed if a hosts file entry for the ICC server is set up on the station instead)
• USB Protect has access to proxy, if used
• Xtransfer has access to ICC server
• Xtransfer has access to KDC server
• Xtransfer has access to CIFS server
• Xtransfer has access to DNS resolver
• Xtransfer has access to proxy, if used
• DataLock has access to ICC server
• Operators have access to ICC server
• Repo server has access to updates.sysctl.se
• ICC server has access to Repo server
• ICC has access to Let’s Encrypt
• ICC has access to proxy
• ICC has access to NTP server
• ICC has access to DNS servers
• ICC has access to mail relay

Stations

USB Protect

• IP address:

• Netmask:

• Default gateway:

• Fully qualified domain name:

• Proxy:

• DNS resolver:

Xtransfer

• IP address:

• Netmask:

• Default gateway:

• Fully qualified domain name:

• Proxy:

• DNS resolver:

• KDC server:

• CIFS server:

DataLock

• IP address:

• Netmask:

• Default gateway:

• Fully qualified domain name:

• Proxy:

• DNS resolver: