User Manual

Cybersecurity Concepts – How to Secure the System
Main Server Folder Shares for Client and FEP Installations
3
62 | 85
A6V11646120_enUS_b_40
3.6 Main Server Folder Shares for Client and FEP
Installations
When installing additional installed clients for Desigo CC version 4.x, FEPs or a
remote web server, the project directory is no longer shared, with the only exception of
the individual folders that need to be accessed remotely. Access to the shares
typically is configured using SMC (the engineer only needs to assign the user
accounts/groups; SMC takes care of setting the access rights).
The local client and the web server on the Desigo CC server do not need file sharing;
only access rights to the folders in the project directory must be configured.
Below you can find a description of what can be actually configured.
NOTICE
Avoid Exposed Network Shares
Since exposed network shares could be used to illicitly discover Unrestricted
information from the network, avoid unrestricted use as much as possible. For
example, only to the users and the computer that need access.
In Desigo CC, shares are only needed for installed clients and the web server
(unless they are on the same machine), not for the Windows App and web clients.
Since these should be reached via dedicated server or control room network, never
expose the shares to the office network or customer intranet (direct or through VPN)
and never expose shares to the Internet.
See section Setting Up the Project in the Desigo CC online help.
Please take note the following terms:
● Windows client account
Refers to the user logged on to Microsoft Windows on the client machine; this
Windows user can be different from the user logged on to Desigo CC.
● Web server account
Refers to the account configured in the Desigo CC web server installation.
The following subdirectories of the [project] directory are accessed by the client
installation (installed client or FEP) and the web server.
● Documents
Provide read access on all files and subfolders to the web server account and all
Windows client accounts.
● Devices, Graphics, Libraries, and Profiles
Provide read/write access on all files and subfolders (including the permission to
delete them, but not the root folder itself) to the web server account and all
Windows client accounts.
– Graphics
Access may be Unrestricted to read-only for Windows client accounts that only
display but do not configure graphics.
– Libraries
Access may be Unrestricted to read-only for Windows client accounts that run
Desigo CC in Operation mode only.
– Profile
Provide read access to all Windows client accounts, read/write access to the
web server account.