General guidelines for securing the host

Here are a few guidelines to secure the host:

• Use an account with administrative privileges to install the ICS software, and one without administrative privileges to run the ICS software.

• Restrict configuration of ICS to a limited set of users or groups.

• Consider running the ICS software as a Windows service, if that option is feasible. If the ICS software is run as a service, run it as a low privileged virtual service account.

• Once the host is fully configured and placed in its permanent location, restrict physical access and remote access to it so that only authorized personnel (for example, system administrators, application engineers, runtime operators) can use it.

• Consider disabling or removing physical ports (for example, USB, memory card) that might be used to connect external storage devices and then transfer data.