Embedded Server Management
We recommend that physical servers are supplied with an Embedded Server Management (ESM) system. This allow a level of resilience to provide power recovery of a SCADA based server. An ESM system allows you to monitor the physical server in the event of an Operating System lockup or failure or if the server is physically turned off. There may also be specific instances where remote access would be required to allow full control of the physical server (for example, remote rebooting).
Although an ESM is a recommended tool it is also a potential security vulnerability. To configure an ESM to provide remote access to the Embedded Server Management tool, an IP address will need to be allocated from the relevant network range and entered within the system. It is recommended that the network address for management purposes are on a separate LAN isolated from the corporate and engineering LAN to prevent direct access from a possible compromised network.
To further harden access to the Management interface, it is recommended to define a user name and secure password.
With some management interfaces, there are options available to allow access to the Operating System by means of pass-through.
If this option exists, it is recommended to disable this feature.
With some management interfaces, there are options to allow remote enablement from a central management server. It is recommended to have this option disabled to prevent any possibility of a compromised management server gaining access to the management interfaces of connected systems.