Windows Security Guide Request

electro89 · Feb 26, 2020

Does anyone know of a good guide to locking down Windows workstations in a domain setup, so only specific software (such as your SCADA software) can be run without any other access to the OS or network? Typically I'd work with IT on these tasks but I'm familiar enough with the Windows environment that I'd like to be able to do it myself if need-be. For non-process related kiosk applications, I've used third party software to accomplish this, but just as a quick-and-dirty way of getting it running. For plant-related workstations I'd prefer it done the "proper" way, whatever way that may be.

Thanks in advance!

gclshortt · Feb 26, 2020

https://www.itprotoday.com/strategy/10-steps-lock-down-desktops

This depends on the SCADA Software. When writing VB.net applications (AdvancedHMI) you can turn off the form controls and maximize the control. Then use the set focus to ensure it is always on top of any other window.

I hope this helps you out.
Regards,

tragically1969 · Feb 26, 2020

electro89 said:
Does anyone know of a good guide to locking down Windows workstations in a domain setup, so only specific software (such as your SCADA software) can be run without any other access to the OS or network? Typically I'd work with IT on these tasks but I'm familiar enough with the Windows environment that I'd like to be able to do it myself if need-be. For non-process related kiosk applications, I've used third party software to accomplish this, but just as a quick-and-dirty way of getting it running. For plant-related workstations I'd prefer it done the "proper" way, whatever way that may be.

Thanks in advance!

Depends what OS but i have always just used a Shell if i needed a kiosk display:

https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher

electro89 · Feb 26, 2020

Up till now I have always just relied on running our SCADA (Citect) as a shell, but almost always run into issues when trying to embed something like an ActiveX object, where it will open up a vulnerability that gives the user access to the file system and internet. For example, if I wanted to embed Adobe Reader into Citect, or IE to display a local HTML page, this will introduce a lot of new ways to get past the shell. I just want to lock down the workstation so it will be virtually impossible for the end user to break the system.

More looking in terms of Active Directory and Group Policy settings.

Windows Security Guide Request

electro89

Member

gclshortt

Member

tragically1969

Member

electro89

Member

Similar Topics