Eaton SEFELEC 5 Series User Manual

User manual SEFELEC 5x Series 166 v1.06- Leverage the roles / access privileges, refer to section 6.6 of the operating manual to providetiered access to the users as per the business /operational need. Follow the principle of leastprivilege (allocate the minimum authority level and access to system resources required for therole).- Perform periodic account maintenance (remove unused accounts).- Ensure password length, complexity and expiration requirements are appropriately set,particularly for all administrative accounts- Enforce session time-out after a period of inactivity.17.1.5. NETWORK SECURITY:SEFELEC 5x supports network communication with other devices in the environment. This ca-pability can present risks if it’s not configured securely. Following are EATON recommendedbest practices to help secure the network.EATON recommends segmentation of networks into logical enclaves, denying traffic betweensegments except that which is specifically allowed, and restricting communication to host-to-hostpaths (for example, using router ACLs and firewall rules). This helps to protect sensitive infor-mation and critical services and creates additional barriers in the event of a network perimeterbreach. At a minimum, a utility Industrial Control Systems network should be segmented into athree-tiered architecture for better security control.Communication Protection: -SEFELEC 5x provides the option to encrypt its network communica-tions. Please ensure that encryption options are enabled. You can secure the product’s commu-nication capabilities by taking the following steps:EATON recommends opening only those ports that are required for operations and protect thenetwork communication using network protection systems like firewalls and intrusion detectionsystems / intrusion prevention systems.17.1.6. REMOTE ACCESS:Remote access to devices creates another entry point into the network. Strict management andvalidation of termination of such access is vital for maintaining control over overall ICS security.Refer to sections 12 to 15 of the operating manual for Remote access