Understand setting minimum permissions for interfaces

Most interfaces are granted too many permissions on Data Archive. Configuring only required permissions is a standard defensive measure to limit the impact in the event of compromise. Because most interfaces are configured for buffering, most interfaces themselves actually require no write permission to points. Most interfaces only require permission to read the configuration of all their points. Only the buffering process, such as PI Buffer Subsystem or PI Buffer Server, needs permission to write data to points, but does not require read permission for points.

Follow these best practices when configuring permissions for interfaces:

• Grant minimum permissions to the interface and buffer subsystem.

• The interface and the buffer subsystem should be split into two different PI identities as they have two different needs.

• Avoid assigning them to the same identity as this gives more permissions than required.