Eaton SEFELEC 1000-M, User Manual

Page: 167 / 209

User manual SEFELEC 5x Series 166 v1.06
- Leverage the roles / access privileges, refer to section 6.6 of the operating manual to provide
tiered access to the users as per the business /operational need. Follow the principle of least
privilege (allocate the minimum authority level and access to system resources required for the
role).
- Perform periodic account maintenance (remove unused accounts).
- Ensure password length, complexity and expiration requirements are appropriately set,
particularly for all administrative accounts
- Enforce session time-out after a period of inactivity.
17.1.5. NETWORK SECURITY:
SEFELEC 5x supports network communication with other devices in the environment. This ca-
pability can present risks if it’s not configured securely. Following are EATON recommended
best practices to help secure the network.
EATON recommends segmentation of networks into logical enclaves, denying traffic between
segments except that which is specifically allowed, and restricting communication to host-to-host
paths (for example, using router ACLs and firewall rules). This helps to protect sensitive infor-
mation and critical services and creates additional barriers in the event of a network perimeter
breach. At a minimum, a utility Industrial Control Systems network should be segmented into a
three-tiered architecture for better security control.
Communication Protection: -SEFELEC 5x provides the option to encrypt its network communica-
tions. Please ensure that encryption options are enabled. You can secure the product’s commu-
nication capabilities by taking the following steps:
EATON recommends opening only those ports that are required for operations and protect the
network communication using network protection systems like firewalls and intrusion detection
systems / intrusion prevention systems.
17.1.6. REMOTE ACCESS:
Remote access to devices creates another entry point into the network. Strict management and
validation of termination of such access is vital for maintaining control over overall ICS security.
Refer to sections 12 to 15 of the operating manual for Remote access