Eaton VoCALL 16, Installation And Operation Manual

Page: 114 / 116

114
InStALLAtIon And opErAtIon mAnuAL 25-13741-E January 2020 www.eaton.com
APPENDIX
Account
Management
Logical access to the system | device should be restricted to legitimate users, who should
be assigned only the privileges necessary to complete their job roles/functions. Some of
the following best practices may need to be implemented by incorporating them into the
organization’s written policies:
• Ensure default credentials are changed upon first login. VoCALL 16 should not be deployed
in production environments with default credentials, as default credentials are publicly known.
• No account sharing – Each user should be provisioned a unique account instead of sharing
accounts and passwords. Security monitoring/logging features in the product are designed
based on each user having a unique account. Allowing users to share credentials
weakens security.
• Restrict administrative privileges - Attackers seek to gain control of legitimate credentials,
especially those for highly privileged accounts. Administrative privileges should be assigned
only to accounts specifically designated for administrative duties and not for regular use.
• Leverage the roles / access privileges mentioned in Section 11 to provide tiered access
to the users as per the business /operational need. Follow the principle of least privilege
(allocate the minimum authority level and access to system resources required for the role).
• Perform periodic account maintenance (remove unused accounts).
• Enforce session time-out after a period of inactivity.
Logging
and Event
Management
• Eaton recommends logging all relevant system and application events, including all
administrative and maintenance activities.
• Logs should be protected from tampering and other risks to their integrity (for example, by
restricting permissions to access and modify logs, transmitting logs to a security information
and event management system, etc.).
• Ensure that logs are retained for a reasonable and appropriate length of time.
• Review the logs regularly. The frequency of review should be reasonable, taking into
account the sensitivity and criticality of the system | device and any data it processes.
Refer section 14, 16 for more information.
Secure
Maintenance
Refer to section 16 for more information.