C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Configuring Certified Antivirus Software and Real-Time Whitelisting for PCS 7 V9.0

Configuring Certified Antivirus Software and Real-Time Whitelisting for PCS 7 V9.0

The certified antivirus solutions tested by Siemens for SIMATIC PCS 7 V9.0 are Symantec Endpoint Protection (SEP) 14, McAfee Endpoint Security (ENS) 10.5/10.6, and Trend Micro Apex One (replacing legacy OfficeScan/XG). To resolve severe system slowdowns and performance lag, you must strictly implement the official Siemens whitelist exclusions: exclude all WinCC project folders (.mdf, .ldf), SQL Server database directories, archive folders, and S7 engineering paths from on-access scanning, and disable deep packet inspection on Industrial Ethernet and Terminal Bus adapters.

Table of Contents

Executive Summary

Cybersecurity protection in critical industrial automation infrastructure running SIMATIC PCS 7 (V8.0 through V9.1) requires certified endpoint protection software. However, deploying default commercial antivirus configurations on Engineering Stations, OS Servers, and OS Clients frequently introduces severe system performance degradation, high CPU utilization, false-positive file quarantines of active Microsoft SQL Server databases, and terminal bus communication dropouts. This article details the Siemens-certified antivirus software list for PCS 7 V9.0, explains the mechanics of on-access scanning interference, and provides the definitive whitelist exclusion guidelines.

Architecture and Fundamental Mechanics

Architectural Mechanics of Antivirus Software in PCS 7 Control Systems:

  • Siemens Antivirus Certification Baseline:
  • Standard commercial antivirus software frequently interferes with industrial real-time tasks.
  • Siemens rigorously tests and certifies specific enterprise endpoint protection packages with each PCS 7 release:
    1. Symantec Endpoint Protection (SEP): Version 14.x.
    2. McAfee Endpoint Security (ENS): Version 10.5 / 10.6+.
    3. Trend Micro Apex One: (Successor to Trend Micro OfficeScan and XG, which reached end-of-support in 2021).

  • Official compatibility must always be validated via the online Siemens Compatibility Tool.

  • Root Causes of System Slowdown and Communication Failures:

  • On-Access File Locking: By default, antivirus engines lock and inspect every file as it is opened or written. In WinCC, Microsoft SQL Server writes hundreds of process tags and alarms per second to transaction log files (.ldf) and database data files (.mdf). Antivirus file-locking causes database write queues to stall, triggering high CPU spikes and WinCC runtime lag.

  • Network Threat Prevention (Firewall Filtering): Antivirus network inspection drivers monitor TCP/UDP packets. Inspecting high-frequency cyclic Industrial Ethernet, DCOM, and RPC traffic on the Terminal Bus creates latency, causing false 'Server Offline' indications.

  • The Siemens Whitepaper Exclusion Standard:

  • Endpoint protection must be configured as a passive background guardian, with strict file and folder exclusions for all real-time automation directories.

Step-by-Step Implementation Procedure

Step-by-Step Antivirus Configuration and Whitelisting Procedure:

  1. Verify Software Compatibility via Siemens Compatibility Tool:
    - Navigate to the online Siemens Compatibility Tool (compatibility.siemens.com).
    - Select your exact PCS 7 version (e.g. PCS 7 V9.0 SP2 / SP3).
    - Verify that your target antivirus build (e.g. Symantec Endpoint Protection 14.3 RUx) is officially certified.
  2. Configure Folder and Path Exclusions (Central Management Console):
    - In the antivirus central policy management console (e.g. Symantec Endpoint Protection Manager - SEPM), create a dedicated PCS 7 Policy Group.
    - Add the following mandatory folder exclusions for real-time On-Access Scanning:
    • All WinCC Project Paths: D:\WinCC_Projects\* or C:\Program Files (x86)\Siemens\WinCC\Projects\*.
    • Microsoft SQL Server Data and Log Directories:
      C:\Program Files\Microsoft SQL Server\MSSQL*\Data\*
    • Process Historian Database and Archive Paths:
      C:\HistorianArchive\*
    • STEP 7 Engineering Storage Directories: D:\S7Proj\*.
    • Windows Dynamic Caches: C:\ProgramData\Siemens\*.
  3. Configure File Extension Exclusions:
    - Exclude database and archive file extensions from real-time scanning:
    *.mdf, *.ldf, *.dbf, *.s7p, *.s7f, *.dcf, *.pck, *.pdl.
  4. Configure Process and Network Traffic Exclusions:
    - In the Network Intrusion Prevention / Firewall policy, exclude the Terminal Bus and Plant Bus network adapter IP ranges from deep packet inspection.
    - Add trusted application exemptions for core Siemens executables: CCProjectMgr.exe, CCScriptRt.exe, s7oiehsx.exe, sqlservr.exe.
  5. Schedule Full Scans during Non-Critical Maintenance:
    - Disable automated daily full system scans.
    - Schedule weekly or monthly manual full disk scans strictly during planned maintenance shutdowns.

Verification

Verification Procedure:
1. Performance Audit: Open Windows Task Manager on the OS Server. Monitor CPU and disk utilization while WinCC Runtime is active. Confirm that antivirus processes (e.g. ccSvcHst.exe or McAfee McShield) consume < 2% CPU during normal process archiving.
2. Log Audit: In the antivirus client management console, inspect the Scan and Threat logs. Confirm that zero WinCC database files (.mdf/.ldf) were scanned or blocked.
3. Multi-Client Responsiveness: On OS Clients, open process pictures and faceplates; verify instantaneous display switching without network hesitation.

Limitations and Operational Precautions

Operational Precautions and Antivirus Management Rules:
- Never Install Unapproved Consumer Antivirus: Consumer antivirus software (e.g. free retail scanners) lacks enterprise exclusion management and will destroy PCS 7 database integrity.
- Automated Signature Updates: Antivirus virus definition signatures should be staged through a central corporate management server (SEPM / ePO) and tested on an engineering testbed before automatic distribution to plant servers.
- USB Port Control: Combine endpoint protection with USB device control policies to prevent malware introduction via removable media.

Engineer FAQ

Which antivirus software is certified by Siemens for PCS 7 V9.0?

Siemens certifies Symantec Endpoint Protection 14, McAfee Endpoint Security 10.5/10.6, and Trend Micro Apex One for PCS 7 V9.0.

Why does Symantec Endpoint Protection make my PCS 7 station slow?

Because real-time on-access scanning is actively scanning fast-writing WinCC SQL Server database files (.mdf, .ldf). Configuring Siemens whitelist exclusions resolves the slowdown.

What file extensions must be excluded from antivirus scanning in PCS 7?

Mandatory exclusions include *.mdf, *.ldf, *.dbf, *.s7p, *.s7f, *.dcf, *.pck, and *.pdl.

Where can I verify if a specific antivirus build is compatible with my PCS 7 release?

Use the online Siemens Compatibility Tool (compatibility.siemens.com).

Should full disk antivirus scans run while the plant is operating?

No. Full disk scans should never run during production operations; schedule them exclusively during planned maintenance windows.

Technical References

Related Articles

Related Tags

  • Antivirus Configuration
  • Symantec Endpoint
  • Whitelist Exclusions
  • Cybersecurity
  • PCS 7 Performance
20 respuestas