Security requirements

This system requires the latest technology and procedures to prevent malicious attacks. This includes physical security, running the software on your Supervisor PC behind a firewall, strong password protection, as well as communications security within each station and between stations.

Physical location

In company-wide installation with multiple routers, controllers and Supervisor PCs, each piece of equipment needs to be physically secure. Make sure that no casual visitor has access to these pieces of equipment.

Firewall

A firewall program running on the Supervisor computer is highly recommended. Initially, you should disable the firewall while configuring a new system. After configuration, remember to enable the firewall allowing access through PC ports as necessary.

User names, passwords, and passphrases

User names and passwords protect access to platforms, stations, and the Supervisor and controller databases.
A passphrase protects the platform’s file system.

All passwords and passphrases are case sensitive.

Best practice: When you receive a new controller, you may choose to power it up and verify that it is functional before placing it in stock ready to assign to a particular job. At this time, its passphrase and user credentials may be very generic. You should create stronger passphrases and passwords before installing the controller at a customer site.

Secure communication

Two aspects of communication are important: encryption, and server authentication. If either is compromised, your system becomes vulnerable to an external attack. This includes the Photo ID station, which runs Asure ID and EntsecAsureID software (the client). Without secure communication links, the remote controllers and EntsecAsureID will not connect to the system station.

PKI (Public Key Infrastructure), which uses certificates to verify server identity and encrypt data transmission, provides this secure link. If the station’s server certificate is signed by an external CA (Certificate Authority), such as Verisign and Thawte, EntsecAsureID should connect to a station without requiring additional configuration.

NOTE: Having a recognized CA sign the server certificate provides the highest level of PKI security and requires the least amount of system preparation because the root certificates for recognized CAs already reside in the client’s Windows trust store.

If, instead of using an external CA, you are your own CA, you use your root certificate to sign each station’s server certificate and import it into the station’s User Key Store. Then you import your root CA certificate into each station’s Windows trust store.

Secure communication is configured with admin privileges using Workbench. The Niagara Station Security Guide explains how secure communication works and provides procedures for creating and signing certificates, and for installing certificates (server and signed CA root certificates) in a station.

Caveat

In Niagara 4.9, RTSP (Real Time Streaming Protocol) over TCP (Transmission Control Protocol), which is used for streaming media servers (video on demand and voice recording), is not secure. It does not use a TLS connection.