Security Considerations

This topic provides security considerations for ArcGIS setup and ArcFM recommendations.

ArcGIS Server

All ArcGIS Servers must be protected against cross-site scripting attacks by configuring the origins allowed to be accessed.

ArcGIS Server is usually hosted within another HTTP stack (IIS, Apache). Follow the vendor's best practices for hardening the server against attack.

If you install ArcGIS Web Adaptor to allow ArcGIS Server to integrate with your existing web server, you must enable HTTPS on your web server, which means you need to obtain a server certificate and bind it to the website that hosts ArcGIS Web Adaptor.

You must specify the log retention period for ArcGIS Server logs. The retention period aligns with your policy but we recommend the debug level be set to the default value of Error. Only change this setting when actively troubleshooting an issue. The ArcGIS Server logs should not be disabled at any time. See the Esri topic about how to specify server log settings for more information.

Portal for ArcGIS

Your Portal-based authentication can use Portal built-in users or Active Directory-based users. Whether you use built-in users or AD-based users, you need to let traffic come from Auth0 (a hosted service that enables single sign-on) through the firewall to your Portal instance. Decide which groups, whether built-in or AD-based, map to which roles as specified in the ArcFM Solution XI Series Named User Functionality Matrix. We make assignments via group information from the identity provider so that group membership can be managed in a central location.

Client Devices that Run the Solution Center Application

Solution Center provides users with access to an important asset of the organization: its GIS data. As such, it is important to secure that data against theft.

For Windows, refer to Microsoft's documentation on BitLocker.

Recommendations specifically for securing client devices:

1. Enable full disk encryption on devices that host Solution Center.

2. Configure screen lock timeout for a maximum of five minutes.

3. Follow these recommendations for general Windows settings:

   • Do not grant local administrator privileges to end users.

   • Do not grant end-user account permissions to install applications.

   • Use application “allow-listing” to permit only approved applications or executables to run.

   • Use real-time endpoint protection to detect unauthorized changes to installed components.

Solution Center allows users to save various configuration files, that get saved to a local or network directory. Schneider Electric recommends you give users access only to secure locations determined by your IT department. File permissions are managed by the user’s Windows profile.

Uninstalling the Application and Transferring Equipment:

Uninstall the application from the Control Panel. If your company intends to transfer the equipment to another user, you should follow best practices for the secured deletion of the previous user’s AppData directories.

Privacy Policy

For details about how Schneider Electric processes and protects your personal information, see the myArcFM article ArcFM Privacy.

Digital Signatures

Schneider Electric ArcFM XI series software is always digitally signed. However, in the extremely rare event that an issue arises, the software should not be installed and you should contact Technical Support. If the application doesn’t open, then there might be an issue with the validity of the digital signature.

For an extra level of security, you can manually check the digital signature for any of our software. You have a couple options:

Digital Signature Details

1. Contact Technical Support to obtain the digitally-signed hash number for the executable that we deployed to you.

2. Right-click the executable and select Properties > Digital Signatures tab.

3. Under Signature List, select the Schneider Electric entry and click Details. You can view the signing status near the top of the Digital Signatures Details window.

   

   
   

4. Under Countersignatures, select DigiCert Timestamp and click Details.

5. In the Signature section, look for Subject Key Identifier and select it.

6. Using the hash number in the Value section, compare it with the one Technical Support provided.

7. If they don’t match, you should contact Technical Support to obtain the properly signed executable.

Command Line Hash Comparison

1. Contact Technical Support to obtain the digitally-signed hash number for the executable that we deployed to you.

2. At a command prompt, switch to the subfolder where the executable is located.

3. Type Get-FileHash <name of executable>.exe | Format-List and hit Enter, after which you are given a hash number.

4. At the command prompt, type (Get-FileHash <name of executable>.exe).hash -eq “<hash number given to you by Technical Support>” and hit Enter. You then receive a response of True or False.

5. If the response is false, you should contact Technical Support to obtain the properly signed executable.