Security best practices

Adhere to the following security guidelines:

• The OPC UA username, specified on the data configuration page, must have the Browse and Read privileges, so that the connector can successfully replicate the underlying OPC UA variables and objects to the PI System.

• The Windows account under which the Connector service runs has no relevance.

• Because the OPC UA endpoint contains the TCP port number, firewalls can be used for enabling the communication on the given port number.

  Note: It is strongly recommended to use the highest available security profile. Employing the [NONE:NONE:BINARY] profile is not recommended for anything other than testing purposes.

Additional sources of information:

• Vendor manuals for the OPC UA server

• OPC UA specifications from the OPC Foundation website:

  • Part 2: Security Model

  • Part 13: Aggregates