Organizational security practices

To prevent attackers from gaining access to the system, AVEVA recommends that your organization adopt thorough security practices:

• Physically secure your computers. Attackers who gain access to computers that run PI DataLink could gain access to all PI System data retrieved and stored in Excel files on that computer.

• Restrict computer access to authorized employees and guests. Procedures should prevent lost or stolen computers from accessing the company network.

• Apply the most recent security updates to all computers. Subscribe to the Security Notification service to stay informed about new security updates for operating systems and other components. For more information, see the Microsoft TechNet article Microsoft Technical Security Notifications.

• Protect against unauthorized administrators. Unauthorized administrators can launch numerous attacks. For example, they might do the following:

  • Install and run malicious software.

  • Configure remote access to take remote control of a computer.

• Audit all administrative activity and routinely review the audit logs. Require all administrators to undergo a background check before hiring and periodic rechecks as a condition of employment.

• Provide multiple layers of security. Relying solely on perimeter security, such as firewalls, increases risks if the firewall is compromised. You can provide another layer of defense by designing your network to isolate less secure clients from more secure clients. Personal firewalls on client computers add an additional layer. Enhance security further with intrusion-detection software and host-based intrusion-detection software that helps filter out suspicious activity; running antivirus software is essential. Finally, educating users about computer security is a critical part of a network security strategy.

• Create and maintain secure baselines for all systems. Specify each baseline with a detailed description of how to configure and administer the computer. The description must include all relevant configuration settings for a secure computer. To create a secure baseline, use the most secure operating system possible. More recent operating systems are more likely to be designed with security in mind and to contain features that make the operating system secure. Keep the operating system and applications up-to-date by applying security updates as they become available.

• Use strong passwords or passphrases. Never use blank passwords. For more information about password concepts, see the Microsoft TechNet article Account Policies.

• Control access to PI DataLink Excel files. Implement access-control procedures to ensure that all Excel files are stored securely and that attackers cannot modify the file contents or search for information within the file.