Security Hardening Guidelines
Introduction
Your PC can run a variety of applications to enhance security in your control environment. The system has factory default settings that require reconfiguration to align with Schneider Electric's device hardening recommendations of the defense-in-depth approach.
The following guidelines describe procedures in a Windows operating system. They are provided as examples only. Your operating system and application may have different requirements or procedures.
Disabling the Remote Desktop Protocol
Schneider Electric’s defense-in-depth approach recommendations include disabling remote desktop protocol (RDP) unless your application requires the RDP.
In Windows 11, remote desktop protocol (RDP) is disabled using (toggle to Off).
Updating Security Policies
Update the security policies on the PCs in your
system by gpupdate in a command window.
For more information, refer to the Microsoft documentation on gpupdate.
Managing Updates
Before deployment, update all PC operating systems using the utilities on Microsoft’s Web page. To access this tool in Windows, select .
Workstation Protection
To reduce the security risks associated with the engineering workstation, enable the memory exploit settings such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). These security settings can be enabled by using the system exploit protection settings in Windows 11 operating system. For more information, refer to the Microsoft security features web page.
Enforce Secure Passwords
Use strong passwords meeting the required elements such as uppercase letters, lowercase letters, numbers, and special characters. Enabling this feature helps prevent unauthorized access by reducing the risk of weak passwords.
Use of Non-Default Ports
Changing the default communication ports for protocols such as HTTPS, DWPS, and Modbus TCP adds an additional layer of security.
IP Allow List
The IP allow list feature restricts access to the system by permitting only specified IP addresses. This helps prevent unauthorized devices from connecting to the system and ensures that only trusted sources can communicate with the TeSys Tera system. To access the IP allow list feature, navigate to in the Standard Web Server.