Section 7.6,
Security Summary. Actually the best
security summary you will find is if you
go to our support site and you look for the white paper
called Best Security Practices.
Or Security Best Practices. If I go to
the Tech Support page and do a quick search
for Security Best Practices, you will
also find that it's
in the System Managers Resources. If I go in here,
you will find a nice white paper that describes
in great detail some of our security recommendations.
So that's really the best place to
look at all of this. But let's go through a list of things
we would suggest. Of course we suggest you have good physical
security. Have a lock on the door-- have the PI Server
not sitting out in the open somewhere. We are
surprised to see how many people have it sitting where a
lot of folks can get to it. Also in
the file system itself, it can be locked down. So for
example if I go into Windows Explorer in the PI
directory, there are all kinds of important
security functions that you can set.
So if I go into security, advanced,
we suggest that you get rid of the
execute permission that normally
people would have. So we do not want people to get to the
PI directory on their own and stat executing things.
Next, we do suggest
that your Windows Event Viewer
be adjusted so
that it does log all of the successful
or failed operations in our application.
And normally you will find
most of the things in PI are stored in that Event Viewer. If you
have not seen this before, this is actually
under Administrative Tools.
And let me find that within here. It's
under Control Panel. And within there, Administrative Tools.
And if we look at Event Viewer, this is normally where you would
find application logs
that include things from our software.
So PINet Manager, PI SDK etc.
This is where you would find the specific SDK
problems or application type problems.
We do suggest that in
the boot setting, you can setup Windows
such that it automatically logs in without the need for a
password. And of course we suggest that you do not do that.
And along the same lines, we do suggest
your screen saver has a password on it.
So if you go into your screen saver and setup
a password or set it so it requires a password.
We do not want you to be walking away from the computer,
and somebody else coming in and just logging in and start doing your system
management routine.
Now with regard to the PI Server itself, we suggest
first of all PI Trusts,
when you create them, do not give people access
to the PI Server with the
permissions of piadmin. As I said, in the trust you should
specify the name of a user who has permissions
only to write to the tags that are collected by that interface.
It's not usually a good idea to give them
piadmin although of course that will work, that's more of less
the sledge hammer approach. You are giving them permission
to edit everything including the data in that tag.
Much much better to create a specific user who only has
permission to edit data for the tags collected by that interface.
Now we would define a medium
security situation in which first of all you have
got passwords for all users that have any kind of write privileges.
We would want members of the piadmin
group to be the ones who would create points.
This is basically everybody who needs to create
points, you would just dump them into the piadmin group.
And then create a lab group that has
access to data, but not to the point configuration.
So for those lab technicians that need to make edits
to data, give them membership in a lab group.
Now a higher security would
be if you implement first of all, all of the
attributes of medium security, then also remove
world access so there will be no world read
access. It's for all of the points and the databases,
just set world privilege equals to none.
And in addition, we would suggest you create point groups.
This would be groups of users who can
edit only specific points.
Different groups within your organizations may
look at different sets of points. Maybe
there is a set of technicians who only need to look at
the Emerson points and do not need to look at the Honeywell or
Siemens points. So you can setup specific points
so that the people are not stepping over each other in their editing of points.
See in the previous, we suggested
you put everybody in the piadmin group
so that they could edit points.
But refinement on that would be to create these point groups
that are for specific sets of tags.
Now in addition
to looking at the
security best practices, we also suggest you download
this Introduction to PI Server System Management
which you will find on our Tech Support page.
So for example, in chapter 9,
you will find a section on
specifically on managing IP security. It goes through a lot of
the details that we have discussed in this class.