3
Quick installation manual Web Compact Controller
ZNO2050500 C 05/2021 www.eaton.com
restricted to authorized person-
nel only as system configuration
can be tampered by abusing these
accounts. Ensure password length,
complexity and expiration require-
ments are appropriately set, particu-
larly for all administrative accounts
(e.g., minimum 10 characters, mix of
upper- and lower-case and special
characters, and expire every 90 days,
or otherwise in accordance with
your organization’s policies).
•
Restrict Network Access:
Ideally,
Web Compact Controller
should be installed on a segre-
gated network. However, when the
Web Compact Controller
is connected to a wider network,
make sure that the IP address and
MAC address are filtered at the
router side, or using a firewall. In
addition to this, open only the ports
used by the Web Compact
Controller (SMTP as configured, 587
for SMTPS, 443 for HTTPS, and 5050
for OPC communication).
•
Logging and event management:
Make sure you log all relevant
system and application events,
including all administrative and
maintenance activities. Logs should
be protected from tampering and
other risks to their integrity (for
example, by restricting permissions
to access and modify logs, transmit-
ting logs to a security information
and event management system,
etc.). Ensure that logs are retained
for a reasonable and appropriate
length of time. Review the logs regu-
larly. The frequency of review should
be reasonable, taking into account
the sensitivity and criticality of the
Web Compact Controller
and any data it processes. The details
how to export the logs are defined
in chapter 7.14.
•
Secure maintenance:
In case the
firmware of the device needs to be
updated, you will be contacted by
your Eaton local support.
•
Malware Defenses:
Eaton recom-
mends deploying adequate mal-
ware defenses to protect the prod-
uct or the platforms used to run the
Eaton product.
•
Business continuity / cybersecurity
disaster recovery:
Eaton recom-
mends incorporating
Web Compact Controller into the
organization’s business continu-
ity and disaster recovery plans.
Organizations should establish
a Business Continuity Plan and a
Disaster Recovery Plan and should
periodically review and, where pos-
sible, exercise these plans. As part
of the plan, important device data
should be backed up and securely
stored, including the current con-
figuration and documentation of the
current permissions / access con-
trols, if not backed up as part of the
configuration. The PC can
be used to save the configuration of
a Web Compact Controller
using the “save file” button in the
main page.
•
Decommissioning:
It is a best prac-
tice to purge data before dispos-
ing of any device containing data.
Guidelines for decommissioning
are provided in NIST SP 800-88.
To ensure data is unrecoverable,
Web Compact Controller
must be securely destroyed. Method
of destruction include disintegra-
tion, Incineration, Pulverization, or
Melting of the electronic inside the
Web Compact Controller.
More information related to
cybersecurity best practices is avail-
able on SD card provided with the
device.
A copy of End user license agree-
ment is available on the SD card
provided with the device. By
agreeing to continued use the
product, terms and conditions of
EULA are applicable.
