Protect the applications and content on the host

In concert with a comprehensive security program for automation systems (for example, ISA/IEC 62443), consider the following to protect applications and content on the host:

• Enable Windows Firewall, and configure it to close all ports that are not used by the ICS software. For more information about port usage, see Managing Network Services and Ports.

• Disable Windows features such as remote desktop and file sharing, and remove unnecessary programs such as games and social media.

• Restrict access to the files, databases, registry and other resources on the host.

• Store the project files in a secure storage and restrict the access only to trusted users.

• When exchanging files over the network, use secure communication protocols.

• Encrypt project files when stored. For example, you can use Windows BitLocker to encrypt the hard drive of computers that are either mobile or not located in a secure facility. However, BitLocker may impact computer performance.

• Only use project files received from trusted sources.

• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage.

• Do not host working files on a remote share.

• Avoid storing sensitive data on mobile devices.