Security and Privacy

This document outlines the security measures, data privacy practices, and architectural considerations in Industrial Asset Hub (IAH).

Siemens strictly adheres to data protection principles, emphasizing data minimization and Privacy by Design.

Personal Data Handling

The product processes and stores the following personal data for access management, notifications, and auditing:

First and last name
User ID
Email address
Timestamps of user actions
IP addresses
MAC addresses

Audit Logging Scope for Remote Access

Audit logs capture remote connection lifecycle events, including who started and who closed SSH or WebSocket remote connections. When remote access is used to reach an asset's web interface, the Remote Access Service also logs the proxied HTTP and HTTPS requests.

Actions performed inside an active SSH or WebSocket remote connection are not recorded in audit logs.

Customer Responsibilities

Customers remain fully responsible for the data they upload or input into the service, including ensuring data is free from malware, viruses, or unauthorized content.

Linking the collected personal data to other operational data (e.g., employee shift plans) to create new personal references, or storing additional personal information in custom user-defined fields, requires ensuring compliance with applicable data protection guidelines (e.g., GDPR).

While Siemens implements comprehensive security controls, including encryption and regular backups, we cannot be held liable for disruptions or damages caused by malicious or unauthorized customer-uploaded content.

Cybersecurity Information

Siemens designs products with industrial cybersecurity functions to support the secure operation of plants, systems, machines, and networks.

Protect your infrastructure against cyber threats by implementing and continuously maintaining a holistic, state-of-the-art industrial cybersecurity concept. IAH is one element of this broader concept.

Network Isolation: Systems and machines should only be connected to enterprise networks or the internet when strictly necessary, and only behind appropriate security measures like firewalls and network segmentation.
Best Practices: For more information on recommended measures, visit the Siemens Industrial Cybersecurity page.
Updates: Apply product updates immediately. Running unsupported versions increases exposure to cyber threats. Subscribe to the Siemens Industrial Cybersecurity RSS Feed to stay informed.

Asset Gateway Security Monitoring

Siemens continuously monitors both the latest and the previous release of the Asset Gateway application for potential security vulnerabilities.

When a vulnerability is identified, its severity and impact are assessed. Critical vulnerabilities are published via Siemens Security Advisories. Run the latest released version of the Asset Gateway to ensure the most up-to-date security patches are applied.

Network Security Architecture

Industrial Asset Hub is designed with a firewall-friendly architecture. All cloud-bound communication between the Asset Gateway and the IAH backend uses secure, TLS-encrypted channels. Southbound communication with OT assets uses protocol-specific methods (ARP, ICMP, SNMP, PROFINET DCP, LLDP) that operate at Layer 2 or Layer 3 without TLS.

Perimeter Protection and Deployment

All components operated on-premises must be protected by suitable perimeter defenses. In typical manufacturing environments, a network cell protection concept prevents direct exposure of the automation layer to the outside world.

The Asset Gateway acts as the bridge. Because it needs to reach automation-level protocols, it is typically deployed on the boundary between the machine network and the enterprise network (e.g., hosted on a Siemens Industrial Edge Device). The gateway device is dual-homed: one network interface faces the machine/OT network and the other faces the enterprise network.

Figure: Exemplary network sketch showing boundary deployment

Zone	Traffic direction	Purpose
Machine / OT network (Cell Zone)	Southbound: ARP, ICMP, SNMP, PROFINET DCP, LLDP	Asset Links discover and identify PLCs, HMIs, switches, and other automation assets in this zone.
Enterprise / cloud network	Northbound: HTTPS port 443, outbound-only	Connects to the IAH cloud backend for asset management, remote access, and job orchestration.

For details on configuring the Layer 2 interface for the machine network, see Configuring the IED Network.

Outbound-Only Communication

All communication between the plant and the cloud is initiated outbound from lower network levels (OT/plant) to upper levels (cloud). No inbound connections from the internet to the machine network are required.

The Asset Gateway only needs outbound HTTPS (port 443) access to the IAH backend endpoints.
The workflow engine uses an outbound-polling pattern: the on-gateway agent periodically polls the cloud-side workflow service for new jobs, rather than the cloud pushing jobs inbound.
Remote access uses reverse tunneling: the on-gateway agent opens an outbound WebSocket connection to the cloud, and cloud users connect through that already-established tunnel. No inbound port needs to be opened at the plant. See Remote Access Security for details.

This design aligns with IEC 62443 zone and conduit principles and works behind standard corporate firewalls without additional inbound rules.

Required Network Endpoints

The Asset Gateway communicates with the IAH backend services via REST over HTTPS (port 443). Allow outbound traffic from your firewall to the following access points.

Environment	Backend URLs / IP Addresses
Productive `<tenant>`.eu1.sws.siemens.com/industrialassethub/	Domain: cloud.eu1.sws.siemens.com IP Addresses: 3.163.252.234, 3.163.251.234, 3.163.250.234, 3.163.249.234, 3.163.248.234, 3.163.247.234, 3.163.246.234, 3.163.245.234, 3.163.244.234, 3.163.243.234, 3.163.242.234, 3.163.241.234, 3.163.240.234, 3.163.239.234, 3.163.238.234, 3.163.237.234, 3.163.236.234, 3.163.235.234, 3.163.234.234, 3.163.233.234, 3.163.232.234

Note

Additional network configurations, such as proxy settings, may be required depending on your IT policies. For Industrial Edge, these can be configured during device onboarding or in the system settings.

Single Cloud Entry Point

The Asset Gateway routes all cloud-bound traffic through a single internal proxy component. All other on-gateway components (discovery, remote access, workflow execution) send their requests to this proxy, which is the only component that holds cloud credentials and initiates outbound connections.

The proxy authenticates to the cloud backend using X.509 certificate-based authentication, obtains a JWT, and forwards authenticated requests on behalf of the local agents. Authentication credentials are never shared with other gateway components.

This centralized proxy pattern provides three security benefits:

Credential isolation: Only one component holds the private key and JWT. Compromise of any other gateway component does not expose cloud credentials.
Network policy enforcement: Only one component needs outbound internet access. Firewall rules can be narrowed to a single source.
Audit simplicity: All cloud-bound traffic flows through a single point, making monitoring and logging straightforward.

Asset Link Network Confinement

Asset Links communicate only with the machine network (southbound) and with the Asset Gateway via an internal interface (laterally). Asset Links never communicate directly with the cloud.

Some Asset Links require Layer 2 network access to use broadcast-based discovery protocols (PROFINET DCP, LLDP). This access is confined to the machine-facing network interface and does not extend to the enterprise-facing interface. Asset Links that operate only at Layer 3 (such as Asset Link SNMP) do not require Layer 2 configuration. The Default IP Scanner supports both Layer 2 (ARP) and Layer 3 (ICMP) and does not require Layer 2 configuration for its Layer 3 mode.

For details on which Asset Links require Layer 2 access, see Asset Links — Layer 2 Network Access.

Multi-VLAN Discovery Security

When using multi-VLAN discovery, the Asset Gateway creates temporary network interfaces to scan remote VLANs. These interfaces exist only for the duration of a discovery job and are torn down immediately afterward, minimizing the window of cross-VLAN exposure.

Warning

VXLAN mode does not provide encryption or authentication by default. When the underlay network is untrusted (shared corporate backbone, WAN link), establish an IPsec or WireGuard VPN tunnel before running a multi-VLAN discovery job. See Securing VXLAN Traffic.

Remote Access Security

The remote access feature uses a two-party model that maintains the network separation principle:

The cloud-side Remote Access Service creates and authorizes a session.
The on-gateway Remote Access Agent accepts a reverse WebSocket tunnel and forwards traffic to the target asset.

Neither party alone is sufficient to establish a connection. The tunnel is always initiated outbound from the gateway to the cloud — no inbound port needs to be opened at the plant. This replaces uncontrolled VPN connections with a controlled, audited, session-based mechanism.

On-Premises Device Security

Siemens is responsible for the security of the IAH backend and for monitoring the Asset Gateway and Asset Links applications for vulnerabilities. Secure the device on which these applications run.

Software Updates

Keep all software layers on the host device current:

Host operating system and firmware: Apply security patches for the Edge device OS and hardware firmware promptly. For Siemens Industrial Edge Devices, updates are distributed through the Industrial Edge Management (IEM) system.
Industrial Edge platform: Ensure the Industrial Edge runtime is kept at a supported, up-to-date version.
Asset Gateway and Asset Links: Install new releases as soon as they become available. Running an outdated version of either application leaves known vulnerabilities unmitigated. Subscribe to the Siemens Industrial Cybersecurity RSS Feed to receive timely notifications.

Running unsupported or outdated software on the boundary device is one of the most common entry points for attacks on OT environments.

Secure Device Configuration

Apply the following baseline configuration to the Edge device:

Restrict management access: Limit Edge device management interface, and IEM access to authorized personnel and management networks only. Never expose the device management interface to the open internet.
Use strong, unique credentials: Disable default accounts and passwords. Use individual accounts per administrator so actions can be attributed and audited.
Apply least-privilege networking: Only permit network traffic that is operationally required. Outbound connections should be limited to the endpoints listed in Required Network Endpoints. All other outbound traffic should be blocked by default.
Disable unused services: Turn off any services, protocols, or open ports on the host that are not required by the Asset Gateway or Asset Links applications.
Review configuration regularly: Periodically audit firewall rules, user accounts, and software versions to ensure the device remains in a known, secure state.

Operational Impact and Best Practices

Impact on Production Networks

IAH supports both active and passive scanning methods to discover asset-specific information.

Active scanning sends probes (ARP, ICMP, SNMP, mDNS) into the network to identify connected devices, including those that communicate infrequently and would otherwise be missed by passive monitoring alone. Because active scanning generates additional network traffic, it can potentially influence communication processes within your production environment.

Passive scanning listens to existing network traffic without injecting any packets. It is disabled by default and can be enabled per gateway. Passive scanning collects limited information (MAC address, vendor, observed protocol, and, when observed, IP address) compared to active scanning. For configuration details, see Default IP Scanner — Passive Discovery.

Best Practice: IAH uses industry-standard discovery protocols, but not all legacy field devices are fully compliant. Run an initial test scan during a scheduled maintenance window, or on a dedicated test network, before executing a full discovery scan in a live production environment.

Secure Disposal of Local Components

When decommissioning on-premises IAH components (like the Asset Gateway), securely remove all application data:

Stop Containers: Stop all running containers (e.g., using docker-compose down or your Industrial Edge Management interface).
Remove Data: Delete all associated Docker volumes, images, and residual application data from the host device.
Delete Credentials: Securely wipe any server user credentials or onboarding configuration files (gateway-config.json) from the local client machines used during setup.
Audit: Document the disposal process, including the date and the specific hardware components wiped, to satisfy your internal compliance requirements.

Cookies

For information on cookie handling in the web application, refer to the official Siemens Cookie Notice.

Any questions left?

Ask the community