Security best practices for PI Connector for OPC UA

Adhere to the following security guidelines:

• The OPC UA username, specified in PI Data Collection Manager, must have the Browse and Read privileges, so that the connector can successfully replicate the underlying OPC UA variables and objects to the PI System.

• The Windows account under which the Connector service runs has no relevance.

• Because the OPC UA endpoint contains the TCP port number, firewalls can be used for enabling the communication on the given port number.

  Note: OSIsoft strongly recommends to use the highest available security profile. Employing the [NONE:NONE:BINARY] profile is not recommended for anything else than testing purposes.

Additional sources of information:

• Vendor manuals for the OPC UA server

• OPC UA specifications from the OPC Foundation website:

  • Part 2: Security Model

  • Part 13: Aggregates