Securing an ECLYPSE Controller
106 ECLYPSE User Guide
Account Management and Permissions
User accounts must be properly managed to make it harder for an attacker to compromise
security, and to make it easier to detect that an attack has occurred. To set user account
parameters, see User Management on page 85.
Use a Different Account for Each User
Each user account should represent an individual user. Multiple users or user groups should
not share an account.
Suspending an account shuts-off a single user’s access to the controller – it does not disrupt
many users.
Permissions can be tailored to the needs of each user. A shared account may have more
permissions than all users should have.
A shared account has a shared password which is more likely to be leaked.
It is harder to implement password expiration requirements.
Use Unique Service Type Accounts for Each Project
System integrators should use different credentials for each job they do. Should an attacker
gain access to one system, they cannot readily access all systems installed by the same
system integrator.
Disable Known Accounts When Possible
Create a new user admin account with new credentials then delete the default admin
account. It is easier to attack the default admin account when an attacker only has to guess
the password.
Assign the Minimum Required Permissions
When creating a new user account, give that account only the minimum rights to access or
modify the system needed for that user.
Use Minimum Possible Number of Admin Users
A compromised admin account can be disastrous as it allows complete access to everything.
Only give a user admin privileges only when absolutely necessary.
To Next Page
Loading...
Need help?
General