Device security
2.6
Security configuration
35
UM Security BRS-2A
Release
8.7
05/2022
Create user accounts. For each new user account, perform the following steps:
–
Create a user account with a dedicated name.
–
Assign the new user account an access role that offers only the least necessary privileges.
–
Assign the new user account a strong, individual password.
–
Apply the password policy check to the new user account.
For each new user account, configure a SNMPv3 policy as needed:
–
Set the SNMPv3 authentication type to
hmacsha
(delivery state:
hmacmd5
).
–
Set a SNMPv3 authentication password according to your policy.
–
Set the SNMPv3 encryption type to
aesCfb128
(delivery state:
des
).
–
Set a SNMPv3 encryption password according to your policy.
Remove user accounts with standard names.
Note:
To deter attackers, consider using different user account names and different passwords on
different devices.
Also consider using different SNMPv3 passwords on different devices.
2.6.20
Adapt session timeouts
Adapt session timeouts for the:
Graphical User Interface using HTTPS or HTTP
Command Line Interface using SSH
Command Line Interface using Telnet
Command Line Interface using the serial connection
Note:
Configure the session timeouts as short as possible and as long as practical. Set each
timeout to a value >0. This helps ensure that the device terminates the respective session
automatically when idle.
2.6.21
Configure time synchronization
The protocols NTP and PTP implicitly trust the time source. Configure the network time
synchronization protocol according to the requirements from the overarching network time
synchronization policy
(see on page 21 “Network time synchronization considerations”)
.
To receive time information from an upstream time server, the device has the role of a time
synchronization client. To redistribute the time information to other devices, the device has the role
of a time synchronization server. Thus, the client role is normally required, e.g., for synchronizing
the device system clock while the necessity of the server role depends on your network.
Parameters to be configured may include:
Enable only the client functions for the network protocols allowed by the policy.
Configure only trusted next-hop upstream time servers.
Tune the client functions of the chosen network time protocol on the device.
Enable the server functions of the device only if necessary.
Tune the server functions of the chosen network time protocol on the device.
Summary of Contents for HIRSCHMANN HiOS-2A
Page 6: ...Contents 6 UM Security BRS 2A Release 8 7 05 2022 ...
Page 8: ...Document History 8 UM Security BRS 2A Release 8 7 05 2022 ...
Page 10: ...Safety instructions 10 UM Security BRS 2A Release 8 7 05 2022 ...
Page 54: ...Network security support 3 11 Configure logging 54 UM Security BRS 2A Release 8 7 05 2022 ...
Page 62: ...Index 62 UM Security BRS 2A Release 8 7 05 2022 ...
Page 66: ......
