User Manual

Intended Operation Environment (Including Deployment Options)

Isolated Network Deployment

A6V11917731_en_b_41

19 | 27

Zone Boundary Protection

● The Desigo CC isolated network is a security zone physically protected (for

example, locked in a rack in the server room). It uses separated networks that

only permit restricted access to its components.

● An exception can be made for a temporary connection open for maintenance

remote access to be closed immediately after the operation has been

completed.

● A separate VLAN alone does not meet the requirements for Zone Boundary

Protection. A firewall is also required.

● In case one of the allowed components is remote, a physically protected and

secured communication is also required through

tunneling

that enables the

users to create a virtual network between two remote points on an existing

public IP network and communicate through a VPN.

● The Zone Boundary Protection must be implemented through VPN and firewall

to limit the inbound and outbound communication to temporary exception for

maintenance remote access.

3.2 Isolated Network Deployment

Isolated Local Network

An isolated local network consists of servers that are connected in an environment

which has no connection to any other network. In this model, there is zero network

connectivity to a larger internal network or the Internet. Since there is no potential

for remote exploits from a large number of unknown sources, this environment

provides well defined physical, network, and security characteristics.

By definition, the access to this configuration is limited to personnel with access to

the trusted admin hosts on the closed local network. Threats consist of an

accidental connection being made to other networks, a trusted admin installing an

unsigned package, or an application that might inject a malware agent.

Guidelines for the isolated local network model:

● Set all default passwords for uniqueness and complexity.

● Limit physical access to essential personnel.

● Avoid installing untrusted third-party software.