Secure Architectural Paradigms for Remote Internet Monitoring of PCS 7 Process Data

Connecting a SIMATIC PCS 7 distributed control system directly to the public internet—or attempting ad-hoc workarounds such as bridging an S7-1200 via GPRS (CP 1242-7) to the plant bus or sharing an operator console using KVM extenders—violates fundamental industrial cybersecurity standards (IEC 62443) and introduces severe operational risk. The manufacturer-approved architecture mandates a segregated Demilitarized Zone (DMZ) bordered by industrial security firewalls (such as Siemens SCALANCE S615 or SC600). Process data intended for remote observation is mirrored into the DMZ using an OpenPCS 7 OPC UA server, a Process Historian / Information Server cluster, or a dedicated WinCC WebNavigator / WebUX server. Remote users access only the DMZ via encrypted VPN connections (e.g., SINEMA Remote Connect) with multi-factor authentication, strictly enforcing read-only permissions.

Executive Summary

Process plant stakeholders frequently demand visibility into real-time production metrics, tank levels, or energy consumption from remote corporate offices or mobile devices. However, process control systems controlling critical chemical, power, or manufacturing assets must maintain absolute isolation from external cyber threats. Ad-hoc proposals—such as attaching cellular modems directly to PLCs or extending local OS screens across unmanaged internet bridges—create unmonitored backdoors that expose the automation infrastructure to ransomware, sabotage, and packet injection. Achieving secure remote monitoring requires implementing an IEC 62443-compliant Defense-in-Depth architecture featuring DMZ server isolation, dedicated industrial perimeter firewalls, and cryptographic VPN tunnels.

Architecture and Fundamental Mechanics

The cybersecurity architecture of SIMATIC PCS 7 adheres to the Purdue Enterprise Reference Architecture (PERA) and IEC 62443 Defense-in-Depth concepts:

Purdue Model Zone Separation:
* Level 1 (Basic Control): S7-400 / CPU 410-5H controllers and distributed I/O communicating over the isolated Plant Bus.
* Level 2 (Area Supervisory Control): Redundant WinCC OS Servers and Engineering Stations on the Terminal Bus.
* Level 3 (Manufacturing Operations / DMZ): Intermediate servers (OpenPCS 7, SIMATIC Information Server, Web Servers) designed to interface with external networks.
* Level 4 (Enterprise Network / Internet): Corporate LAN, cloud analytics, and remote mobile observers.
The Demilitarized Zone (DMZ) Requirement:
* Direct communication between Level 4 (Internet) and Level 2 (OS Servers / Terminal Bus) is strictly prohibited.
* All cross-boundary data flows terminate within the DMZ (Level 3.5). The DMZ is bounded by two firewalls (or a multi-port industrial security firewall like SCALANCE S615 with distinct internal, external, and DMZ interfaces).
* The OS Servers in Level 2 push data outward to the DMZ servers (or the DMZ server queries OS servers via tightly restricted, authenticated ports). Remote internet clients only communicate with the DMZ.
Why Direct Cellular / KVM Bridges Fail Security Audits:
* Bridging an S7-1200 equipped with a CP 1242-7 GPRS module to the S7-400H plant bus creates an unmonitored, non-firewalled physical gateway into the safety and control layer.
* KVM-over-IP directly connected to the internet exposes active console sessions, enabling malicious takeover of operator controls.
Recommended Technical Solutions:
* SIMATIC Information Server / Process Historian: Archives process data in Level 2/3 and renders web-based reports and dashboards in Level 3/4 via HTTPS (port 443).
* OpenPCS 7 with OPC UA: Exposes real-time tag data securely via OPC UA (TCP port 4840) with certificate-based authentication and 256-bit AES encryption.
* WinCC WebNavigator / WebUX: Delivers read-only browser graphics hosted on a dedicated Web Server in the DMZ.

Step-by-Step Implementation Procedure

Follow these engineering and cybersecurity steps to deploy secure remote monitoring for PCS 7:

Establish Physical and Network Perimeter Security:
* Deploy an industrial security appliance, such as a SCALANCE S615 or SCALANCE SC636-2C, at the boundary between the PCS 7 Terminal Bus and the corporate/external network.
* Configure three distinct security zones on the firewall:
- Zone 1 (Internal): PCS 7 Terminal Bus (OS Servers, ES).
- Zone 2 (DMZ): Demilitarized Zone hosting intermediate visualization/OPC servers.
- Zone 3 (External): Corporate WAN / Internet gateway.
Deploy Intermediate Visualization / Data Gateway in the DMZ:
* Install a dedicated server in the DMZ configured as an OpenPCS 7 Server, WinCC Web Server, or SIMATIC Information Server.
* If using WinCC WebNavigator/WebUX: Configure the DMZ machine as a dedicated Web Server that fetches data from the OS Servers via the Terminal Bus.
* If using OPC UA: Configure OpenPCS 7 to aggregate tags from the redundant OS servers and expose an OPC UA endpoint with signed certificates.
Configure Stateful Firewall Packet Filtering Rules:
* Block all inbound traffic originating from External (Zone 3) into Internal (Zone 1).
* Permit only secure, encrypted protocols from External (Zone 3) into the DMZ (Zone 2):
- HTTPS (TCP 443) for WebUX or Information Server dashboards.
- OPC UA TCP (TCP 4840) for secure telemetry collectors.
- Permit tightly restricted communication from the DMZ (Zone 2) to the OS Servers (Zone 1) on specified SIMATIC communication ports (e.g., port 135 RPC, WinCC database ports) restricted to specific IP and MAC addresses.
Deploy Secure Remote Access via VPN / SINEMA Remote Connect:
* For mobile or remote users, deploy SINEMA Remote Connect (Siemens management platform for remote networks).
* Configure an OpenVPN or IPsec tunnel terminating at the perimeter SCALANCE S router.
* Enforce Multi-Factor Authentication (MFA) and role-based access control (RBAC).
Configure Read-Only User Authorizations:
* In WinCC User Administrator or the OPC UA security configuration, configure remote user accounts with strict View-Only privileges.
* Disable 'Process controlling' and 'Higher process controlling' permissions to prevent any setpoint manipulation or command execution from external networks.

Verification

Test the remote access architecture from an external internet network. Connect via the secure VPN tunnel; verify that multi-factor authentication is enforced. Launch the web browser and access the DMZ WebUX or Information Server dashboard via HTTPS. Confirm that live process values update dynamically. Attempt an operator action (e.g., modifying a setpoint or starting a pump); confirm that the authorization engine rejects the command with an access denied popup.

Limitations and Operational Precautions

Never place an Engineering Station or primary OS Server directly into a DMZ or public IP space. Never route cellular connections directly into the AS 400H Plant Bus. All remote access infrastructure must comply with the plant's corporate cybersecurity policy and undergo regular vulnerability assessments and firmware updates.

Engineer FAQ

Can I use an S7-1200 with GPRS as a secure bridge to PCS 7?

No. Direct fieldbus or backplane bridging between an unmanaged cellular modem and an S7-400 system bypasses perimeter firewalls and violates IEC 62443 security standards.

Why is a DMZ mandatory for remote access?

A Demilitarized Zone ensures that external internet clients never connect directly to critical plant servers. If a DMZ server is compromised, the internal firewall prevents lateral traversal into the control system.

What is SINEMA Remote Connect?

SINEMA Remote Connect is a Siemens management platform that provides centralized, encrypted OpenVPN connections with user access control and multi-factor authentication for industrial sites.

Can WebUX operate without installing client software?

Yes. WinCC WebUX delivers pure HTML5 and SVG graphics that run on modern web browsers (Chrome, Edge, Safari, iOS, Android) without client-side plugins.