Hardening the O3

This section describes how to harden Delta Controls O3^® devices against unauthorized access and use.

It is expected that device configuration will be carried out by personnel trained in Delta software and systems, based on the requirements set out by the IT security policy. Accordingly, this document does not provide step-by-step configuration instructions for enteliWEB users. For more details, refer to enteliWEB’s built-in help or go to help.deltacontrols.com.

The security practices described in this guide are recommended practices to securely configure O3 devices. However, Delta Controls cannot guarantee that the implementation of the security practices or recommendations described in this guide will ensure the security of O3 systems, or prevent or alter the potential impact of any unauthorized access or damage caused by a cybersecurity incident.

Related documents

• enteliWEB Network Hardening Guide
• KBA2252: Delta Product Security
• KBA2037: Securing enteliWEB using HTTPS

These documents are available on support.deltacontrols.com.

Overview

The O3 multisensor is an IoT device that communicates over Bluetooth^® Low Energy, MQTT, EnOcean, and BACnet. BACnet/Ethernet, BACnet/IP, and BACnet/SC protocol options are supported, but BACnet/IP and any associated IP services must be explicitly enabled by the user. We recommend using BACnet/Ethernet whenever possible and enabling BACnet/IP only when there is a need to connect multiple subnets over BACnet.

Enabling BACnet/IP enables the IP stack, which includes ICMP, ARP, TCP, UDP default port 47808 (configurable), and DNS. DHCP is also available.

The O3 does not route BACnet/SC to other interfaces, e.g. BACnet/SC to Ethernet, BACnet/SC to IP, etc.

Ports on the O3

Port	Type	Description
68	UDP	systemd-network (network configuration service)
1880	TCP	Default port for Node-RED. This port opens if a Node-RED flow containing a Node-RED dashboard is applied. This port will remain closed if no Node-RED dashboards exist in the device.
1883	TCP	Internal MQTT broker (mosquitto). This port opens if a user enabled external access to the MQTT broker. By default, this port is closed.

If enteliWEB is used as the BACnet front end, refer to the enteliWEB Network Hardening Guide for a list of ports on the enteliWEB server.

Hardening Steps

Upgrade device firmware

Upgrade O3 devices to the latest firmware - refer to Updating firmware for more details.

Disable BLE

Using the Proviso app, users can connect to the O3 over Bluetooth to change network settings, check diagnostic data, and upgrade firmware.

To secure the device against unauthorized writes over Bluetooth, disable Bluetooth Low Energy (BLE) communication.

• To disable BLE over BACnet, set object BV31 ("Enable BLE") to Off.
• To disable BLE over MQTT, publish {"data": "0"} to commands/object/bleEnable.

If you want to keep BLE enabled (for example, to upgrade firmware using the app), change the BLE PIN to a unique 6-digit value for each job. You can change the BLE PIN in the Proviso app, over BACnet, or over MQTT.

The new PIN cannot be 000000.

• To change the BLE PIN over BACnet, create object CSV45 with the name "BLE PIN," command it to manual mode, then enter the new PIN as the object value.
• To change the BLE PIN over MQTT, publish {"data":"VALUE" } to setting/ble/pin, where VALUE is the new PIN. After changing the BLE PIN, reset the device.

Configure internal MQTT broker

The internal MQTT broker is disabled by default. If you’re not using MQTT, ensure the internal MQTT broker remains disabled.

To confirm the broker is disabled, use enteliWEB or the Proviso app:

• In enteliWEB, command object BV48 (Internal MQTT Broker Enable) to manual mode, and ensure the object value is set to Off.
• Using the Proviso app, go to Settings > MQTT (Internal) and select . Confirm Enable MQTT broker is deselected.

If you want to enable the internal MQTT broker, you will need to secure writes to the broker by changing the default password. The default username/password to access the broker is user/admin.

The password is case-sensitive and must be between 5 and 31 characters in length. Special characters are allowed.

• To change the password over BACnet, create object CSV46 with the name "MQTT Password," command it to manual mode, then enter the new password as the object value.
• To change the password over MQTT, publish {"data":"NEW_PASSWORD" } to setting/mqttPassword, where NEW_PASSWORD is the new password.

After changing the MQTT password, reset the device. The new password does not take effect until the next reboot.

Use BACnet/Ethernet instead of BACnet/IP

Use BACnet/Ethernet whenever possible and BACnet/IP only when there is a need to connect multiple subnets over BACnet.

To disable BACnet/IP in enteliWEB, open the NP6 object, select the Out Of Service checkbox, then click Save. The network change is applied immediately.

Disabling BACnet/IP closes all open ports.