Customer security responsibilities

Customers play a vital role in maintaining security and ensuring compliance with organizational and regulatory standards. Key areas of responsibility include:

Access management

• Identity and access control implementation

• Deployment of multi-factor authentication (MFA)

• User-access lifecycle management (provisioning and deprovisioning)

• Credential security maintenance

• Secure virtual machine (VM) passwords storage

Operational security

• Organizational security policy enforcement

• User security training and awareness training

• Incident reporting and escalation

• Internal compliance monitoring

Data governance

• Data classification and handling

• Compliance with relevant regulations

• Internal data security controls

• VM data backup

  As stated in the AVEVA Integration Studio service description, AVEVA does not backup the VMs or the data within them. Customers should regularly back up data in the event of VM failure.

VM operation and administration

AVEVA Integration Studio VMs deploy with secure defaults. Do not modify or disable security features such as:

• Windows automatic update configuration

• Windows Firewall

• Windows Defender

• Rule configuration of Windows Defender

• Windows system and application logs

Use caution when stopping services or modifying the registry.

Some services and registry entries are critical to the operation of AVEVA Integration Studio and the AVEVA applications that were installed.

Warnings about VMs

• Do not modify the static IP address or network configuration directly within the VM. This can lead to several issues, including loss of network connectivity, routing problems, and RDP access failures.

• Do not block all outbound traffic through firewall rules. This can prevent the Azure VM Agent from communicating with the Azure platform, which leads to management and connectivity issues, including loss of RDP access.

• Do not disable DHCP within the VM. Azure relies on DHCP for proper network configuration and platform communication.

• Do not stop the WSDOagent service. AVEVA uses this service to monitor the health and security of the VM.

Apply updates to AVEVA software

To support customer workflows that require specific versions of AVEVA System Platform and AVEVA Plant SCADA, AVEVA does not automatically update its software with the latest available patches and updates inside your VMs. To maintain your software's highest level of security:

• Download updates in the Products section of the AVEVA Knowledge and Support Center.

• Apply the latest updates regularly.

Apply updates to the operating system and third-party components

• AVEVA schedules updates in maintenance windows twice a week at 12:00 PM local time. If your VMs are running, the patches are automatically applied.

• If your VMs are not running at that time, updates are not applied. In this event, you must apply Windows updates as soon as possible through the standard operating system procedure.

Manage remote desktop protocol (RDP) Access

• By default, you can only make an RDP connection to an AVEVA Integration Studio VM after your IP address is allowed. See Manage instance RDP rules for details.

• Set up RDP rules with the following scope:

  • Instance rules apply access to the VMs in that instance. Instance rules are more granular and are recommended to restrict VM access to only the users that require it.

  • Global rules apply access to all VMs in your CONNECT folder.

Install customer-specific applications, software, and tools

• Customers who install their own software on the VMs are responsible for securely configuring and running the software and for applying available security patches and updates.

• Customers must exercise caution with files that are downloaded on (or uploaded to) the VM. This reduces the risk of introducing malicious code on the VM.