Security for Production Management Databases

Securing the databases

• Security settings in Database

• Encryption of settings

• Password complexity and number of retries

Protecting the databases from security threats

AVEVA™ Production Management uses SQL server for persisting data. Protecting your data is essential. Implementing the following recommendations will help to protect your data.

Authentication

We recommend using Windows Authentication as the authentication mode for SQL Server as per the recommendation from Microsoft. Windows Authentication uses Kerberos security protocol, provides password policy enforcement with regard to complexity validation for strong passwords, provides support for account lockout, and supports password expiration.

By using Windows Authentication, Windows groups can be created at the domain level, and a login can be created on SQL Server for the entire group. Managing access from at the domain level can simplify account administration.

For more information, see Types of Authentication in AVEVA Production Management.

Permissions

We recommend restricting access to the AVEVA™ Production Management SQL Server database. AVEVA™ Production Management requires a service account to be nominated during installation.

Things to take note of related to permissions:

• In cases where the AVEVA™ Production Management service is required to contact an external system, ensure that the system has provided the permissions required for the service.

• The Active Directory (AD) account under which the AVEVA™ Production Management service is going to run must be a member of the Windows Authorization Access group in the domain controller computer.

For more information on the required minimum permissions, see Installing AVEVA Production Management with least privilege account in the AVEVA Production Management Installer Guide.

Related topics

• Security for Application Server

• Security for Production Management Network

• General Considerations for ICS Security