Pilz 311502, Руководство по эксплуатации, Страница: 11 / 51

Security
Operating Manual PCOM sec br2
1004534-EN-04
| 11
3.4 Commissioning
} Before commissioning, create the environment described in the chapter Operating
environment [ 10] .
}
For the VPN and HTTPS protocols, the device requires an encrypted key that is created
during commissioning. To exclude an attack during commissioning, please follow the in-
structions in the chapter Establish connection to SecurityBridge [ 22] .
} Change the default password for the user account "admin".
3.5 User accounts
} Assign only safe passwords. Criteria for a safe password:
– The password should have at least 8 characters.
– The password should contain upper and lower case characters, as well as special
characters and numbers.
– If possible, the password should not be available in dictionaries.
– The password should not be made up of standard variants and repetitions or key-
board patterns (so not: 1234abcd).
– Use a password manager for optimum management of complex passwords.
– When assigning the password, please note that language-dependent characters may
not be available in all the keyboard languages.
}
Make sure you regularly change the passwords of the user accounts on the system and/
or ask the users to change their passwords themselves.
} Retain the passwords safely and train the personnel to deal with Phishing and Social En-
gineering attacks.
} Strictly separate the user accounts for the product administration and the access to the
systems in the protected network.
}
Make the users aware of the responsible use of their access data.
3.6 Operation
Please note the following measures when operation the device:
}
The computers used to monitor the system must be secured to the general best practice
rules for security.
}
As soon as possible, install firmware updates that Pilz provides for the device.
}
Make sure you regularly check the event log of the product for security-relevant entries. A
list of security-relevant entries can be found in chapter
Security-relevant log
messages [ 49] .
}
Wherever possible, forward the entries of the event log to a log server (see chapter Man-
age logging [ 31] ). This ensures that the entries will be available for a longer period
of time, and that it is made more difficult for an attacker to delete entries.
} Regular safety updates for the operating system and the installed applications must be
run on the computer that uses the VPN client.