Transcription
iFIX 6.1Configuring Security FeaturesGE DigitalProficy Historian and Operations Hub: Data Analysis in Context1
Proprietary NoticeThe information contained in this publication is believed to be accurate and reliable. However, General Electric Company assumes noresponsibilities for any errors, omissions or inaccuracies. Information contained in the publication is subject to change without notice.No part of this publication may be reproduced in any form, or stored in a database or retrieval system, or transmitted or distributed in anyform by any means, electronic, mechanical photocopying, recording or otherwise, without the prior written permission of General ElectricCompany. Information contained herein is subject to change without notice. 2020, General Electric Company. All rights reserved.Trademark NoticesGE, the GE Monogram, and Predix are either registered trademarks or trademarks of General Electric Company.Microsoft is a registered trademark of Microsoft Corporation, in the United States and/or other countries.All other trademarks are the property of their respective owners.We want to hear from you. If you have any comments, questions, or suggestions about our documentation, send them to the following emailaddress:doc@ge.com
Table of ContentsConfiguring Security FeaturesReference DocumentsIntroduction112Protecting Your Process2iFIX Security Concepts2Understanding Security Status4Understanding iFIX SecuritySecurity Files55Using Security with a File Server6Using Security Without a File Server6User Accounts6Group Accounts7Assigning Privileges8Identical User Accounts9To create identical user accounts:Security AreasCreating a Recipe User AccountDo Not Use "RECIPE" as a Domain User AccountApplication FeaturesAssigning Special Application FeaturesRun-time Environment Protection9101011111314Securing Scripts and the Visual Basic Editor15Securing Pictures and Schedules15Electronic Signatures16Protecting SCADA Nodes17Restricting Database Write Access on a Node-by-Node Basis17The iFIX Screen Saver18Working with Visual Basic for Applications20Defining and Assigning Security Privileges21 2020 General Electric Company. All rights reserved.i
To implement an iFIX security strategy:21The Security Configuration Program21Exiting from the Security Configuration Program22Working with the Security Toolbox22Enabling and Disabling Security23Defining Security Areas23Assigning Security Areas23Creating Group and User Accounts24Limiting Login Time24Modifying Group and User Accounts24Deleting Group and User Accounts25iFIX Automatic Login25Windows Users and Automatic Login25Automatic Login and the Security Path26Automatic Login and Application Users26Creating a Public Account26Deleting an Automatic Login Configuration26Importing and Exporting the Security ConfigurationImporting User Account Passwords27Defining the Security Path28Defining the Backup Path28Configuring Global Security Paths29Restricting Access in the Run-time Environment30Locking Down the Windows Taskbar31Important Task Switching Information31Working with Touch Screens32Example: Securing the Run-time Environment32Using iFIX SecurityLogging in to iFIX ManuallyTo log into iFIX:Password Expiration Considerationsii2732333333 2020 General Electric Company. All rights reserved.
Changing the Account PasswordTo change the account password:3334Logging out of iFIX Manually34To log out of iFIX:34Understanding the Security Log FileUsing iFIX with Windows SecurityConfiguring Windows User AccountsSetting Passwords to ExpireTo configure the local password expiration policy:3435353636Limiting the Number of Invalid Login Attempts36To set the account lockout threshold:36Configuring the Account Disabled Message in iFIXTo configure the account disabled message:User Accounts that Log in to WindowsTo add the Act as Part of the Operating System right:36373737Domain Users Logging Into Windows37Control How iFIX Security Authenticates Windows Accounts38Example Entry in Secnet.ini FileDomain CachingUsing the Security Configuration ProgramTo connect your Windows and iFIX user accounts:Using Security Synchronizer3839393940Operational Overview40Administrative Considerations41How the Security Synchronizer Works42Preparing to Run the Security Synchronizer43Decide the Source of Windows Security Information43Create Windows Users44Create Windows Groups44Configuration Strategy44Limitations on Global Group Names45 2020 General Electric Company. All rights reserved.iii
Global Group Nesting Not Supported46The CreateWindowsGroups Tool46To create Windows groups using the CreateWindowsGroups tool:Assign Users to Windows Groups and Grant Privileges48Configure iFIX Security48Node-based Security48To specify the system user:48User-based Security49Running the Security Synchronizer Application49Using the Command Line51Command Line Parameter Example52When to Run the Security Synchronizer53Scheduling Security Synchronizer53Using the Task Scheduler Service53To use the Windows Task Scheduler:53Examples54Using an iFIX Database Program Block54Using the Security Synchronizer Automation Interface54Application Feature Name Aliases55Troubleshooting62Understanding Security Configuration Messages62Understanding Security Synchronizer Messages65Error Severity Categories65Application Error Codes (200-299)66User Account Error Codes (100-199)67General Error Codes (1-99)67Command Line Parameter Errors68Security Configuration Dialog BoxesApplication Feature Selection Dialog Boxiv476869Authorized69Available69 2020 General Electric Company. All rights reserved.
Add All69Add69Delete69Delete All69Automatic Login at Startup Dialog Box69Auto Started Nodes70Add70Modify70Delete70Automatic Login Node Dialog Box70Node70Application User70System User70Configuration Dialog Box70User Based Security70Security Path71Backup Path71Use These Paths for All Startup Profiles71Edit Security Area Dialog Box71Area71Name71Group Accounts Dialog Box71Current Groups71Add71Modify72Delete72Group Membership Selection Dialog Box72Authorized72Available72Add All72Add72 2020 General Electric Company. All rights reserved.v
Delete72Delete All72Group Profile Dialog BoxGroup Name72Security Areas73Application Features73Modify73Password Confirmation Dialog BoxRetype Password to Confirm ChangeSecurity Area Naming Dialog Box737373Security Areas73Modify73Security Area Selection Dialog Box73Authorized73Available74Add All74Add74Delete74Delete All74Select User Dialog Box74Select User List Box74User Accounts Dialog Box74Current Users74Add74Modify74Delete74User Profile Dialog Boxvi7275Use Windows Security75Windows Security Enabled75Windows Security Disabled75Group76 2020 General Electric Company. All rights reserved.
Security76Application76Modify76How Do I.76Configuring Security FeaturesTo implement security in the Security Configuration application:Managing User AccountsCreating a User AccountTo create a user account:Selecting Account Privileges777777787878Adding and Deleting Security Areas in a User Account78To add or delete security areas in a user account:78Adding and Deleting Application Features in a User AccountTo add or delete application features in a user account:7979Adding and Deleting Group Accounts in a User Account79To add or delete group accounts in a user account:79Creating a Recipe User AccountTo create a Recipe user account:reating a Public AccountTo create a public account:Deleting a User AccountTo delete a user account:Deleting All Group and User AccountsTo delete all of your accounts and disable security:Modifying a User AccountTo modify a user account:Saving a User AccountTo save a user account:Managing Group AccountsCreating a Group AccountTo create a group account: 2020 General Electric Company. All rights reserved.808080808181818181828282828383vii
Adding and Deleting Account Privileges83Adding and Deleting Security Areas in a Group Account83To add or delete security areas in a group account:84Adding and Deleting Application Features in a Group AccountTo add or delete application features in a group account:Deleting a Group Account8484To delete a group account:84Deleting All Group and User Accounts85To delete all of your accounts and disable security:Modifying a Group Account8585To modify a group account:85Configuring Security86Completing the Configuration Dialog Box86Defining the Security Path86To define the security and backup paths:86Enabling or Disabling Security87To enable or disable security:87Enabling or Disabling Global Security Paths87To enable or disable global security paths:Exporting the Security Configuration87Importing the Security Configuration88To import a security configuration:88Using Electronic Signatures88Entering an Electronic Signature88To enter an Electronic Signature:89Verifying an Action with an Electronic SignatureTo verify an action that requires an Electronic Signature:Configuring a Tab to Require Electronic SignaturesTo configure a tag to require Electronic Signatures:Configuring for Automatic Login8787To export the security configuration:viii848989909091 2020 General Electric Company. All rights reserved.
Creating or Modifying an Automatic Login FileTo add or modify an automatic login file:Deleting an Automatic Login FileTo delete an automatic login file:Creating or Renaming Security AreasTo create or rename a security area:Creating Windows Groups Using the CreateWindowsGroups Dialog BoxTo create Windows groups using the CreateWindowsGroups dialog box:Configuring the iFIX Screen SaverTo configure the iFIX Screen Saver:Enabling Environment ProtectionTo enable environment protection:Index 2020 General Electric Company. All rights reserved.91919191919292929393949495ix
Configuring Security FeaturesConfiguring Security Features is intended for system administrators who must configure and maintainsecurity for iFIX systems. The manual explains the concepts of iFIX security and steps you throughthe process of configuring iFIX security.Reference DocumentsFor related information about iFIX, refer to the following manuals:lUnderstanding iFIXlWriting ScriptslCreating RecipeslUsing Electronic SignatureslSetting Up the Environment 2020 General Electric Company. All rights reserved.1
IntroductionAs iFIX monitors your process, it creates data files, such as alarm files; iFIX also modifies and updatesother data, such as the process database. In some companies, access to iFIX applications and datafiles is available to everyone. In such an environment, changes to the data files and access to iFIX filesand applications are not critical to the process. However, in other companies these applications anddata are only available to authorized personnel because they are critical to the process.iFIX provides an integrated security program to assist you in protecting your process. Refer to the following sections for more details:lProtecting Your ProcessliFIX Security ConceptslUnderstanding Security StatusProtecting Your ProcessThere are different levels of security that you can implement to protect your process. On one level, youcan control the physical security of your machines and buildings. On another level, you can implementsecurity for your operating system and your network using firewalls, passwords, and filters.You can also restrict access to your iFIX applications and files, and protect your data files from unauthorized changes, by enabling iFIX security. This manual focuses on iFIX security. iFIX security isoptional and is disabled by default. When you enable iFIX security, you can restrict:lAccess to iFIX programs, operator displays, schedules, and recipes.lAccess to critical program functions (for example, reloading the process database).lWrite access to the process database.lData entry and alarm acknowledgement, by requiring electronic signatures and verification. Thiscan assist you in becoming compliant with the 21 CFR Part 11 regulation.Enabling security also allows you to track all the changes to the process database and forces operatorsto log in to iFIX. Logging in requires a login name and an optional password. Depending on your configuration, this data can be the same or separate from your Windows login name and password. Referto the Using iFIX with Windows Security chapter for more information.iFIX security is user-based, meaning operators cannot access iFIX applications, files, or databaseblocks unless you assign access to them. Assigning program, file, or database access to an operator iscommonly referred to as assigning a privilege to that operator.You can enable security using the Security Configuration program. This program is a flexible and easyto-use application that lets you assign operator rights, login names, and passwords. Refer to the Defining and Assigning Security Privileges chapter for more informationiFIX Security Concepts2 2020 General Electric Company. All rights reserved.
Before you restrict access to iFIX applications and files, you need to understand how security works.The security concepts described in the following list are described in more detail in the UnderstandingiFIX Security chapter. For information on using the concepts, see the Defining and Assigning SecurityPrivileges chapter.User Account – defines the privileges assigned to one person. iFIX identifies each user account with alogin name and an optional password. User accounts can belong to one or more groups. When a useraccount belongs to a group, it inherits all the privileges associated with the group. The user accountcan have privileges in addition to the group privileges.Group Account – assigns access to the most commonly-used privileges that two or more people mustshare. Allows you to bundle a set of privileges and assign them in one step to a user account.Application Feature – a privilege that allows an operator to access specific application functions. Forexample, the WorkSpace Runtime application feature provides access to the WorkSpace run-timeenvironment. To help simplify explanations, this manual collectively refers to applications and specific application functions as application features.Security Area – a physical or functional division of a plant. For example, security areas can be processhardware (such as pumps or ovens), utilities (such as fuel, water, or steam), or maintenance functions.The following figure shows how user accounts, group accounts, application features, and security areasinterrelate. Each user account has privileges that are directly assigned and inherits any privilegesassigned to the groups to which the user account belongs.Security ConceptsElectronic Signature – uniquely identifies operators performing or verifying changes to your process.You can require operators to enter a user name and password before acknowledging an alarm orentering data. This functionality can assist you in becoming compliant with the 21 CFR Part 11United States FDA government regulation. 2020 General Electric Company. All rights reserved.3
Run-time Environment Protection – restricts the things that operators can do during iFIX WorkSpaceRun Mode. For example, you can prevent operators from switching to other applications or exitingthe WorkSpace when you have Run-Time Environment Protection enabled.Understanding Security StatusWhen you initially start the iFIX Security Configuration program, iFIX security is disabled. The SecurityConfiguration program indicates this status by displaying an open lock on the screen. While security isdisabled, anyone can use iFIX programs or modify iFIX configuration files without restriction. Electronicsignature capability is also disabled when security is disabled.When you enable security, the lock closes and operators must log into iFIX with their user accounts togain access. For instructions on enabling and disabling security, refer to the section Enabling and Disabling Security.4 2020 General Electric Company. All rights reserved.
Understanding iFIX SecurityYour main design goal when developing an iFIX security strategy is to create group and user accounts.Using groups minimizes the amount of work needed to create the accounts while providing you with flexibility and power. For example, instead of creating five operator accounts that all assign the same security areas and application features, you can create one group account with these privileges and thenassign the group account to the five operators.To achieve this goal, assess your operators' needs and identify the common privileges they require.Once you identify these common privileges, you can create group accounts that provide them.For example, John, Dave, Tim, and George are all iFIX operators. Their needs are summarized in the following table:User nameJohnDaveTimGeorgeApplication featuresWorkSpace RuntimeWorkSpace RuntimeWorkSpace RuntimeWorkSpace RuntimeSecurity areasLine 1, Line 2, and Line 3Line 1, Line 2, and Line 3Line 1, Line 2, and Line 3Line 1, Line 2, and Line 3Since each operator requires access to the same application features and security areas, it is possibleto create a group account called Operators that provides these privileges. Once you create the groupaccount, you can assign it to each operator's user account, as the following figure shows.Assigning Account Privileges with a Group AccountSecurity Files 2020 General Electric Company. All rights reserved.5
You can share iFIX security files among all your iFIX nodes. However, you cannot share these files withFIX32 nodes. If you have a network with nodes of both types, use one set of security files for your iFIXand another set for your FIX32 nodes.When you.Do not share securityfiles.Share security files.You.Must copy the security files to each iFIX node.Can make system-wide changes quickly and avoid the need for copying files.Using Security with a File ServerUsing a file server, you can eliminate the need to copy security files to multiple computers. The simplestway to share your security files is to enter your file server path as the security path. To learn how tochange the security path, refer to the section, Defining the Security Path.Using Security Without a File ServerYou can set up security without a file server by storing all the security files and the Security Configuration program on each local computer. The security files reside in a path called the security path,which the Security Configuration program defines.Security also keeps another copy of the security files in a path called the backup path. Security usesthis path when it cannot find the security path, for example, if the security path becomes unavailable.Once you set up security and enable it on one computer, you must duplicate the security configurationon every node. The simplest way to do this is to copy your security files to every computer on your network. For a list of files to copy, refer to the Troubleshooting chapter.Also, make sure you enable security on every node. Otherwise, security may not function properly.User AccountsA user account defines the privileges assigned to one person. iFIX identifies each user account with alogin name and an optional password. User accounts can belong to one or more groups. When a useraccount belongs to a group, it inherits all the privileges associated with the group. The user account canhave privileges in addition to the group privilegesWhen designing a user account, always include the user's full name, login name, and password in yoursecurity plan. If you plan to use Windows security, you should also include the domain name if you planto store the user accounts on a domain controller.Including the user's full name is especially important when you are using electronic signatures, becausethe full name is recorded in messages sent to the audit trail for electronic signatures.6 2020 General Electric Company. All rights reserved.
Including the password is particularly important because iFIX security does not display user accountpasswords. Consequently, including user passwords ensures that you provide the correct password toyour operators.NOTE: iFIX user passwords are case insensitive when not using Windows security.Group AccountsWhenever possible, use group accounts to assign the majority of account privileges. You greatly simplify creating a security configuration if you take the time and effort to assess your operators' needs. Ifthe security requirements at your site do not warrant such an effort, use the sample group accountsprovided. These accounts provide you with a simpler approach to Configuring Security Features. Forexample, the sample group accounts define functional roles in a manufacturing facility. You could easilycreate other group accounts, such as those listed in the following table.To createa signersRecipeDevelopersAssign the following application features.Database Block Add-Delete, Database Manager, Database Reload, and Database Save.WorkSpace Configure, WorkSpace Runtime, WorkSpace Runtime Exit, EnableTask Switching, Runtime Visual Basic Editor Access, Database Manager, Database Save, Database Reload, and Database Block Add/Delete.Recipe Builder Development Window, Recipe Download from the RecipeBuilder, Recipe Save from the Recipe Builder, Recipe Upload from the RecipeBuilder, and Recipe Text Output from the Recipe Builder.Supervisors WorkSpace Runtime, WorkSpace Runtime Exit, and Enable Task Switching.Typically, when assigning privileges to an operator, you select the necessary group accounts first. Thisassigns common privileges needed by two or more operators doing similar tasks. Then, you can add anyspecific privileges an operator may require. Configuring your group and user accounts in this wayprovides a modular approach that is easy to maintain.For example, in the following figure, the group account Operators defines access to the iFIXWorkSpace run-time environment and specific security areas. These privileges define the commonsecurity rights shared by all operators. If an individual operator needs additional rights, for example, toenter electronic signatures, you can assign those rights in his or her own user account. 2020 General Electric Company. All rights reserved.7
Sample AccountsAssigning PrivilegesAfter you create your group accounts, you can assign any remaining privileges to individual useraccounts. These remaining rights should be unique privileges assigned to one person. If, however, youfind that two or more operators require the same privileges, consider creating additional group accounts.For example, consider the operator accounts for John, Dave, Tim, and George. Assume that George andDave need additional privileges to perform electronic signatures and access another security area, whileTim needs access to the functional security area Ovens. Since Tim is the only operator who requiresaccess to this security area, you can assign it directly to his user account. However, because bothGeorge and Dave require an extra application feature and security area, you might want to create asecond group account to provide these privileges. This is illustrated in the following figure.8 2020 General Electric Company. All rights reserved.
Assigning Extra Rights with Group AccountsIdentical User AccountsWhile the best way to maintain flexibility in your security strategy is to define common privileges withgroup accounts, you may find it easier not to use them. In general, this happens when you only have tocreate a small number of identical user accounts. If you decide not to include group accounts in yoursecurity plan, you can save time creating identical user accounts as described in the following steps.To create identical user accounts:1. Create one user account.2. Export your security configuration.3. Open the export file in a text editor.4. Copy and paste the user account as many times as needed.5. Change the user name, login name, and password of each user account.6. Save the file and import it back into the Security Configuration program. 2020 General Electric Company. All rights reserved.9
For more information on using this method, refer to the section Importing and Exporting the Security Configuration.Security AreasYou should keep a separate list of security areas as you plan each group and user account. When youfinish, the resulting list contains the names of the security areas you require, allowing you to define yoursecurity areas in one session instead of multiple sessions.Security areas restrict access to database blocks, operator displays, schedules, and recipes. The following table summarizes the access restrictions provided by security areas.When you assign a securityarea to a.Database blockOperator display, schedule, orrecipeYou restrict.Write access. Read access to blocks is available from anyoperator display.Read access to the file.If someone attempts to change a block's value illegally, security generates a message containing thelogin name of the person who attempted the change. iFIX sends this message to the security audit trailand every enabled alarm destination except the Alarm Summary. To learn more about these messages,refer to the Implementing Alarms and Messages manual. To learn about the security audit trail, refer tothe Understanding the Security Log File section.Creating a Recipe User AccountUsing the GE recipe package, you can download recipes to a process database. Typically, when security is enabled, you can protect the blocks in each process database by assigning them to security areas.As a result, recipe downloads can fail because the current operator may not have rights to change theblocks to which the recipe writes.You can eliminate this problem by creating a recipe user account. This account defines the securityareas to which your recipes can download. When a download begins, iFIX examines the security areasassigned to the Recipe user account instead of the currently logged in operator.You can create a Recipe user account by:lNaming it RECIPE.lDefining the required security areas.Once you create the account, copy it to the security path of every SCADA server.IMPORTANT: Security loads the Recipe user account into memory the first time a recipe downloads. If youmodify this account, the local computer continues to use the version in memory. To force the computer to reread the new version, log out the current user, log in with the Recipe user account, and log out again.10 2020 General Electric Company. All rights reserved.
Do Not Use "RECIPE" as a Domain User AccountBe aware that using "RECIPE" as a domain user account is not supported in the iFIX product. If you doattempt to use RECIPE as a domain user name, you will be able to download a recipe on a SCADAnode, but not on a View node.Application FeaturesYou should familiarize yourself with the available application features before you design any group oruser account. Very often it is possible to assign an application feature for a specific application function,such as the iFIX WorkSpace run-time environment, without providing access to the entire application.The following table lists the available application features.Application Feature DescriptionsApplicationFeatureAllows the user to.Alarm ShelvingShelve alarms in run mode. If the Alarm Shelving feature is not enabled for a user,the user will not be able to shelve an alarm even if the alarm shelving is enabled onthat block.Application Val- Generate baseline files in the Application Validator.idator - Creationof BaselinesApplication Val- Run the Application Validator and generate reports.idator - Run-timeAccessBackgroundTask ExitStop any background task such as SAC, Session Monitor, or Historical Collect.Batch Execution Perform a specified action in the Batch Execution product.- [Action Name]Change ManagementUse Change Management version control features in iFIX.Data ProviderServiceUse the Data Provider Service feature in iFIX.Database Block Add a block to, delete a block from, or modify a block in a database.Add-DeleteNOTE: In FIX32, this application feature only allows add and delete functionality.Database ManagerConfigure individual blocks in a database and import, export, save, print, query, sort,and summarize the contents of a database.DatabaseReloadReload the database in memory or load a different database.Database SaveSave the database in memory to disk.EDA Feature 155Access an Easy Database Access (EDA) application feature. You can provideaccess for up to 55 EDA application features.Electronic Signature - BypassBypass the Electronic Signature option, and test an application without the need torepeatedly enter signatures.NOTE: Selecting Add All when you are adding application features to a user or group 2020 General Electric Company. All rights reserved.11
account will not add this application feature. You must select it explicitly.Electronic Sig- Perform signed actions.nature - PerformByElectronic Sig- Verify signed actions.nature - Verify ByEnable Ctrl-AltDelLog off, shut down the computer, access the Windows Task Manager, or change thecomputer's password by pressing Ctrl Alt Del.The logged-in user needs this if iFIX is running as a service and they log off themachine.Enable TaskSwitchingSwitch between tasks.FIX32 - [Action]Perform a specified action in a FIX Desktop application. Be aware that FIX Desktopis no longer supported, as of iFIX 5.8.GE OEMReserved 1-12Access an application feature defined by an OEM (Original Equipment Manufacturer). You can provide access for up to 12 OEM application features.Historical Trend Configure the Classic Historical Assign program.AssignHistorical Trend Stop the Classic Historian HTC program.CollectionHistorical Trend Legacy application feature that is not used in iFIX.ExportiFIX - SystemShutdownShut down iFIX.Manual Failover Allows you to manually initiate a connection or SCADA failover.OPCRun the OPC UA Configuration tool on a SCADA Server, or change and save OPCUA Configuration UA configuration info
security for your operating system and your network using firewalls, passwords, and filters. You can also restrict access to your iFIX applications and files, and protect your data files from unau-thorized changes, by enabling iFIX security. This manual focuses on iFIX security. iFIX
