Future Design MCTB 4.3, Руководство пользователя

Страница: 136 / 240

MCTB
136
NOTE: When using password aging and the password expires for a user, the user will be required to change
their password before access to the system is permitted. A user can change their password at any
time (even if aging is not used) by selecting “Password” from the main security menu.
The
Log Off Time Period (minutes) field is a global for all users. The log off time begins once a user logs into
the system. If the user does not perform any actions within the specified time, the system will automatically log
the user out. User actions are defined as any action that requires a process change, i.e., changing a SP,
changing an alarm description, etc. Any field protected by security settings of the MCTB are user action fields.
The log off time can be set from 0 to 1440 minutes (24 hours). A value of zero disables the auto log off feature.
NOTE: If a user begins an action such as changing a set point, but does not complete the task and leaves
the numeric keypad shown, the system will log the user out if the log off time elapses. However, since
the keypad is still shown, the set point change can still be completed as the task had already begun.
In this case, if a user then enters a new set point, the audit trail will record the change under the user
that was previously logged in, but since the user was automatically logged out while the keypad was
shown, the user will be required to log in to access the set point again.
7.4.1 Two-Factor Authentication (2FA) -
MCTB 4.3” version 4MA V1.3 only
2FA is an extra layer of security used to make sure that the person trying to gain access to the system is who
they say they are. When enabled, the log in process will begin as normal with the user entering their user ID
and password. Then, instead of immediately gaining access, they will be required to enter a one-time passcode
(OTP) sent to their personal device via text message. Once the code is entered, access will be granted.
In order to enable 2FA, a USB memory device must first be inserted into the USB port of the MCTB. This USB
device then becomes a “security key” for the unit that allows 2FA to be bypassed should internet access be
lost. Without internet access, users will be unable to receive the OTP needed to log in. However, by inserting
the USB security key into the MCTB’s USB port, the OTP is bypassed and the user is able to log in by simply
entering their user ID and password.
This USB security key can be used for multiple MCTB’s by inserting it into each MCTB and enabling 2FA from
the Security Options screen. If 2FA is already enabled on the MCTB, turning 2FA off and then back on will add
the unit’s encrypted security key to the USB device. Additional USB security keys can be created, if necessary,
by inserting each USB device one at a time, and then turning 2FA off and then back on again.
The USB security key is not associated with any particular user in the system, but with the MCTB itself. Thus,
any user in the system can bypass 2FA when the USB security key is inserted in the MCTB. Therefore, it is
recommended that the system administrator retains access to any USB security key created.
NOTE: Any users entered into the system without a 2FA SMS Number (see section 7.1 Adding Users ) will
not be required to enter an OTP even if 2FA is enabled. Therefore, users previously entered into the
system without the 2FA SMS Number will have to be deleted and re-entered in order to hold them to
the 2FA log in requirement.