General guidelines for securing the host

The following are general guidelines for securing the host. More specific recommendations are provided in the subsequent table. You can refer to these guidelines when planning cybersecurity.

• Use an account with administrative privileges to install the ICS software, and one without administrative privileges to run the ICS software.

• Restrict configuration of ICS to a limited set of users.

• Consider running the ICS software as a Windows service, if that option is available. If the ICS software is run as a service, run it as a low privileged virtual service account.

• Once the host is fully configured and placed in its permanent location, restrict physical access and remote access to it so that only authorized personnel (for example, system administrators, application engineers, run-time operators) can use it.

• Consider disabling or removing physical ports (for example, USB, memory card) that might be used to connect external storage devices and then transfer data.