Securing An Eclypse Controller; Introduction; Passwords; Change The Default Platform Credentials - Acuity Controls nLight ECLYPSE User Manual

Securing an ECLYPSE Controller

CHAPTER 10
Securing an ECLYPSE Controller
This section describes how to secure an ECLYPSE controller from unauthorized access and use.

Introduction

This chapter describes how to implement best security practices for ECLYPSE controllers. Security is built up layer upon
layer to make the system more resistant to attacks. This involves taking simple but effective steps to implement built-in se-
curity features.

Passwords

A username / password combination (or credentials) authenticates a user's access rights to a controller. If an attacker
gains access to a user's password, the attacker has access to carry out any action on the controller that is allowed by that
user's permissions.

Change the Default Platform Credentials

At the first connection to an ECLYPSE you will be forced to change the password to a strong password for the admin ac-
count to protect access to the controller.
It is important to create new user accounts with strong passwords to protect the controller from unauthorized access. The
username / password can be changed in User Management and see also Supported RADIUS Server Architectures.

Use Strong Passwords

Passwords should be hard to guess. Avoid birth dates and common keyboard key sequences. A password should be com-
posed of a random combination of 8 or more uppercase and lowercase letters, numbers, and special characters.
If FIPS 140-2 mode is enabled, password must be a random combination of 14 or more uppercase and lowercase letters,
numbers, and special characters. The controller will reset to a default username and password when FIPS 140-2 is en-
abled, and the user will then be prompted to reset both. See FIPS 140-2 Mode.
Do not allow a browser to remember a user's login credentials
When logging into a controller with certain browsers, the browser asks to remember a user's login credentials. When this
option is set, the next time the user logs in, the credentials will automatically be filled in. While this is convenient, anyone
with access to the computer can log in using those credentials. Do not set this option for administrator accounts or when
accessing an account from an unsecure computer.

Account Management and Permissions

User accounts must be properly managed to make it harder for an attacker to compromise security, and to make it easier
to detect that an attack has occurred. To set user account parameters, see User Management.
nLight ECLYPSE
88