Use Unique Service Type Accounts For Each Project; Disable Known Accounts When Possible; Assign The Minimum Required Permissions; Use Minimum Possible Number Of Admin Users - Distech Controls ECLYPSE ECY-STAT User Manual

Securing an ECY-STAT
Suspending an account shuts-off a single user's access to the controller – it does not disrupt many
users.
Permissions can be tailored to the needs of each user. A shared account may have more permissions
than all users should have.
A shared account has a shared password which is more likely to be leaked.
It is harder to implement password expiration requirements.

Use Unique Service Type Accounts for Each Project

System integrators should use different credentials for each job they do. Should an attacker gain ac-
cess to one system, they cannot readily access all systems installed by the same system integrator.

Disable Known Accounts When Possible

Create a new user admin account with new credentials. It is easier to attack the default admin account
when an attacker only has to guess the password.

Assign the Minimum Required Permissions

When creating a new user account, give that account only the minimum rights to access or modify the
system needed for that user.

Use Minimum Possible Number of Admin Users

A compromised admin account can be disastrous as it allows complete access to everything. Only
give a user admin privileges only when absolutely necessary.

HTTPS Certificates

HTTPS is a protocol which encrypts HTTP requests and their responses. This ensures that if someone
were able to compromise the network, they would not be able to listen in or tamper with the communi-
cations.
Make sure that HTTPS is enabled. For more information on how to enable HTTPS, see Web Server
Access.

Certificates

Generate and install a trusted SSL certificate. Refer to Web Server Access for information on how to
import a custom certificate.

Additional Measures

Update the ECY-STAT's Firmware to the Latest Release

Always keep the ECY-STAT's firmware up-to-date. The most recent firmware has the latest bug fixes,
security updates, and stability enhancements.

External Factors

Install Controllers in a Secure Location

Ensure that the ECY-STAT is installed in a physically secure location, and, if required, under lock and
key. Through physical access, an attacker can take over the controller to do with it what they please.
ECLYPSE Connected Thermostat (ECY-STAT) 99