Network security for cRIO controllers, how do I make my controllers more secure?

[rseabeck]

Hi everyone,

My company's IT group is cracking down on network devices without offering any alternatives, so that puts the onus on me to either convince them our setup is secure, or figure out how to make our setup more secure so that they'll let us continue to use our cRIOs' network connection features. Unfortunately I don't know anything about network security, so I don't even know where to begin to look. And they don't know anything about NI devices, so even if they had the time to do the research I don't think they'd be able to figure anything out.

Here's our current system:

We have several cRIO 9045 controllers running several test stands. Each test stand has its own web published front panel which is connected to through our network via ethernet and a web browser. Here's the article which describes the method we're using to remotely connect to the front panel: https://knowledge.ni.com/KnowledgeArticleDetails?id=kA03q000000YHxcCAG&l=en-US. Anyone not connected to our network will not be able to access the remote front panel since you'd need the IP address of the device on our network.

Each cRIO is set up with a username and password (which could certainly be made more robust if that's enough to convince IT that we're safe).

We also use the WebDAV feature to connect the file structures of these controllers to our file explorers.

So, given our current system, I'd like to familiarize myself with the security features of the cRIO family. To me, I don't see how it would even be possible to hack into our network through a cRIO because in order to control/connect/change anything on it you already need to be connected to the network, and at that point it's already too late for us. It's not like these things have their own wifi or bluetooth connection that some nefarious individual could sneak in through - they're just a dead end really.

Is there any documentation that shows the base security of these devices? I don't know much IT lingo, so you'll have to bear with me. But I really appreciate any insight you can provide.

[AustinMan@NI]

This is a good starting point:

NI Linux Real-Time Security User Guide

I am not an IT security expert, so please don't expect me to have all the answers. The best suggestion I can give is to explore the potential security vulnerabilities, then decide which ones could be exploited. Based on your post you have probably started doing this already.