33
INM 9476-ETG Rev 2
Category
Description
Account Management
(continued)
•
Leverage the roles / access privileges to provide
tiered access to the users as per the business
/operational need. Follow the principle of least
privilege (allocate the minimum authority level
and access to system resources required for
the role).
•
Perform periodic account maintenance
(remove unused accounts).
•
Ensure password length, complexity and
expiration requirements are appropriately set,
particularly for all administrative accounts (e.g.,
minimum 10 characters, mix of upper- and
lower-case and special characters, and expire
every 90 days, or otherwise in accordance with
your organization’s policies).
•
Enforce session time-out after a period of
inactivity.
Time Synchronization
Many operations in power grids and IT networks
heavily depend on precise timing information.
•
Ensure the system clock is synchronized
an authoritative time source (using manual
configuration, NTP, SNTP, or IEEE 1588). Please
refer to section 9.7.4 of this manual
Network Security
The 9476 Gigabit Switch supports network
communication with other devices in the
environment. This capability can present risks if
it’s not configured securely. Following are Eaton
recommended best practices to help secure the
network. Additional information about various
network protection strategies is available in
Eaton Cybersecurity Considerations for Electrical
Distribution Systems [R1].
Eaton recommends segmentation of networks into
logical enclaves, denying traffic between segments
except that which is specifically allowed, and
restricting communication to host-to-host paths (for
example, using router ACLs and firewall rules). This
helps to protect sensitive information and critical
services and creates additional barriers in the event
of a network perimeter breach. At a minimum, a
utility Industrial Control Systems network should
be segmented into a three-tiered architecture (as
recommended by NIST SP 800-82[R3]) for better
security control.
Eaton recommends opening only those ports that
are required for operations and protect the network
communication using network protection systems
like firewalls and intrusion detection systems /
intrusion prevention systems. Use the information
below to configure your firewall rules to allow
access needed for The 9476 Gigabit Switch to
operate smoothly
The default ports used on The 9476 Gigabit Switch
are:= 80 Web Port (HTTP)
443 Secure Web Port(HTTPS)
