SPYDER MODEL 5 ENGINEERING TOOL
–
USER GUIDE
5
31-00282ES-01
The following check list describe the General Security Best Practices for Honeywell BACnet MS/TP-based products. They
are listed in order of increasing mitigation. The exact requirements of each site should be assessed on a case-by-case
basis. The vast majority of installations implementing all of the mitigation levels described here will be far in excess of
that required for satisfactory system security.
Incorporating the security check list items 1-5 will generally meet the requirements for most automation control network
installations.
Additional information can be obtained from:
•
Honeywell General Security Best Practices
–
System Engineering Guide (31-00129)
•
CIPer Model 30 Hardening Guide (31-00207-01)
Security Check List
1.
Use the latest version of IRM software including firmware and software modules.
2.
Include the WEBStation N4.x installation files, configuration files (including station backup), certificates and
licenses in the disaster recovery plan.
3.
Make sure that the PC running WEBStation N4.x, where possible, is secured against unauthorized physical access.
4.
Make sure that the local ethernet network that the PC is connected to is secured, e.g. by the use of firewalls and
intrusion detection systems.
5.
The PC is running the latest version of the Windows operating system, with all updates and service packs.
6.
The PC is running virus protection software.
7.
Appropriate user accounts are set up on PC and access to files is restricted to only those who are authorized.
8.
WEBStation N4.x is configured to use HTTPS using a certificate from a trusted Certificate Authority.
9.
WEBStation N4.x users are configured as required.
10.
WEBStation N4.x is configured to backup data regularly to a secure location as per your company's backup policy.
11.
Ensure that complete commissioning is carried out in a closed local area network without connecting to the internet
to avoid unauthorized sniffing of BACnet message packets.
