| THE FUTURE IS WHAT WE MAKE IT

Securing WIN-PAK
Software

WIN-PAK Security Guide

June 2020

This document contains Honeywell Proprietary information. Information contained herein is to be used solely
for the purpose submitted, and no part of this document or its contents shall be reproduced, published, or
disclosed to a third party without the express permission of Honeywell international.
HONEYWELL DISCLAIMS THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PURPOSE AND
MAKES NO EXPRESS WARRANTIES EXCEPT AS MAY BE STATED IN ITS WRITTEN AGREEMENT WITH AND FOR ITS
CUSTOMER.
In no event is Honeywell liable to anyone for any direct, special, or consequential damages. The information
and specification in this document are subject to change without notice.
About this document
This Technical note explains about the mandatory security settings that needs to be performed
on WIN-PAK software application

Related documents • WIN-PAK_User_Guide.pdf

• WIN-PAK_GX_User_Guide.pdf
• WIN-PAK_TA_User_Guide.pdf
• Readme.txt

Support For information about updates to this bulletin, contact your nearest Honeywell
office or Technical Assistance center

WIN-PAK Security Guide 2

Contents
1 ABOUT THIS GUIDE ........................................................................................................................................ 5
1.1 INTRODUCTION .................................................................................................................................................5
1.2 INTENDED AUDIENCE .........................................................................................................................................5
1.3 ASSUMPTIONS AND PREREQUISITES ......................................................................................................................5
1.3.1 Important Terminologies .........................................................................................................................5
2 SECURING ACCESS TO THE WINDOWS OPERATING SYSTEM .......................................................................... 6
2.1 SCOPE.............................................................................................................................................................6
2.1.1 Windows user accounts and passwords ..................................................................................................6
2.1.2 Password policies and settings ................................................................................................................6
2.1.2.1 Strong passwords ............................................................................................................................................ 7
2.1.2.2 Account lockout............................................................................................................................................... 7
2.1.3 User account policies and settings ...........................................................................................................7
2.1.3.1 Windows security settings............................................................................................................................... 7
2.1.3.2 Web application firewall ................................................................................................................................. 7

3 WIN-PAK SECURITY FEATURES ....................................................................................................................... 9

3.1 SECURE ARCHITECTURE FOR DOMAIN ENVIRONMENT...............................................................................................9
3.2 SECURELY INSTALLING AND CONFIGURING WIN-PAK ............................................................................................10
3.2.1 Receiving WIN-PAK Software .................................................................................................................10
3.2.2 Installation .............................................................................................................................................10
3.2.2.1 Things to remember for secure installation of WIN-PAK ............................................................................... 10
3.2.3 Authentication Mechanism ....................................................................................................................10
3.2.3.1 Strong passwords .......................................................................................................................................... 11
3.2.4 TLS & Certification Management ...........................................................................................................11
3.2.4.1 Setup Certificates .......................................................................................................................................... 12
3.2.5 Application Whitelisting .........................................................................................................................12
3.2.6 Third-party Applications ........................................................................................................................12
3.3 SECURELY MAINTAINING WIN-PAK ...................................................................................................................12
3.3.1 Scope ......................................................................................................................................................12
3.3.2 Microsoft Security Updates ....................................................................................................................12
3.3.3 Microsoft Service Packs..........................................................................................................................13
3.3.4 WIN-PAK Updates ..................................................................................................................................13
3.4 GDPR ..........................................................................................................................................................13
3.4.1 Deleting the user information ................................................................................................................13
3.4.2 Exporting the user information ..............................................................................................................13
4 SYSTEM MONITORING ................................................................................................................................. 14
4.1 OVERVIEW .....................................................................................................................................................14
4.1.1 Security Audit Logs .................................................................................................................................14
4.1.1.1 Considerations .............................................................................................................................................. 14
4.1.2 Securing HTTP Headers - IIS ...................................................................................................................15
4.1.3 Controlled Trusted Secure Network .......................................................................................................15
4.2 VIDEO MANAGEMENT SYSTEM SECURITY MANUAL................................................................................................15
4.3 RECOMMENDED ENVIRONMENT ........................................................................................................................15
5 INSTALLING CA CERTIFICATE ........................................................................................................................ 16

WIN-PAK Security Guide 3

 5.1 PROCURING AND INSTALLING CA CERTIFICATE ......................................................................................................16
5.1.1 Installing the Certificate .........................................................................................................................16
5.1.2 Bind the Certificate to a website ............................................................................................................19
5.2 UNINSTALLATION ............................................................................................................................................21

WIN-PAK Security Guide 4

1 About this Guide
1.1 Introduction

WIN-PAK is a state-of-the-art access control software. It uses the access control mechanism to authenticate
employee access at secured areas. In WIN-PAK SE/PE, and Time & Attendance (T&A), the access is
authenticated using access cards or key codes provided to the employees. In addition, the access control
tracks the employee access, controls the entry and exit details, and generates reports of all access cards
and keycode activities.

1.2 Intended Audience

This guide has been created exclusively for the Information Technology (IT), Operations and Security
personnel who are employed by Honeywell customers, those who use WIN-PAK.

1.3 Assumptions and Prerequisites

It is assumed that the users of this document possess a high degree of technical knowledge and familiarity
with:
• Microsoft Windows operating systems
• Networking systems and concepts
• Security issues and concepts

ATTENTION

The information about the security program for the access management system should be well protected.
Easy access by unauthorized personnel will cause harm to your access management system or process
operations.

1.3.1 Important Terminologies

The following Microsoft terms are important when understanding security concepts and configuration.
Definitions can be found on the related Microsoft web sites.

• Access Control List (ACL) is a list of permissions assigned to an object. It defines the users
or system procedures that are granted access to the object in question.
• Access Mask
• Access Token provides the login credentials for a session, including the identity of the user,
the user's group (if any) and the privileges granted to the user.
• Global Group
• Group
• Group Memberships
• Group Policy
• Group Policy Object (GPO)
• Local Group
• Organizational Units (OU)
• Permission
• Privilege
• Universal Group
• User Account
• User Account Control
• User Rights

WIN-PAK Security Guide 5

2 Securing access to the Windows operating system
2.1 Scope
An essential component of any security strategy for a Security System Network is to secure access to the
operating system and to ensure that:
• Only authorized users have access to the system
• User access to files, systems, and services is limited to those necessary for the performance of
their duties

2.1.1 Windows user accounts and passwords

Access is gained to the Windows operating system by logging onto the system using a user account name
and password. This is true for both local and remote terminal services access. Because user accounts may
be well known or easily guessed within an organization, the password becomes the prime vehicle for
authentication. User account and password policies are therefore important security measures.

2.1.2 Password policies and settings

The most popular technique for breaking into a system is to guess usernames and passwords.
Consequently, it is essential that passwords are difficult to guess and that they are changed often.

Password settings
You can apply system-wide control of passwords by means of Group Policy. Alternatively, you can apply
individual control to each account.
The following settings are suggested.

Note
If any changes on the password to account which is used by the windows services, that service needs to
be updated with the right password and restarted.

Parameter Setting Comment

Maximum 45 to 90 Forces the choice of a new password after this time.
password Days The setting for the Administrator account should be
age shorter. A maximum of 30 is recommended.
Minimum 1 to 5 Prevents too rapid a cycling of passwords.
password Days
age
Minimum 11 Improves encryption and makes guessing harder.
password Characters
length
Password 8 to 13 old Prevents reuse of the same password too quickly.
uniqueness Passwords
Account 10 Prevents continual password guessing by disabling
lockout Attempts account after the specified number of attempts.
Consider disabling account lockout for operator (or
other user) accounts where denial of service or loss
of view would be detrimental to safety or the
continued operation.
Lockout 30 Specifies the period during which a user will not be
duration Minutes able to log on following an account lockout. (Note
that the administrator can re-enable the account
before the expiration of the specified lockout period.)
Lockout 29 The time before the account lockout is reset to zero.
counter minutes For example, with the account lockout set at 10, and

WIN-PAK Security Guide 6

 Parameter Setting Comment
the lockout counter set at 29 minutes, lockout will
occur if there are 10 invalid logon attempts within 29
minutes. Note that the lockout counter must be less
than the lockout duration.

2.1.2.1 Strong passwords

Please refer Strong Password policy section

2.1.2.2 Account lockout

The lockout values are those suggested by Microsoft and are discussed in their white paper “Account
Lockout Best Practices”

Account lockout policy must be used with caution. Although it will slow down an attempted password
guessing attack; it will not prevent a determined attacker, who will capture logon packets and use
cryptographic tools to break the password offline. It may also lead to a Denial of Service, where authorized
users find themselves unable to log on. It is generally better to rely on strong passwords and system audit
log monitoring to prevent and detect password cracking attempts.
• Recommended to use password polices for SQL server users.
• Recommended to restrict system admin as part of SQL server database admin group.
• Recommending customer to upgrade the SQL server patches, whenever a new patch is released
for SQL server 2019.

Information
Account Lockout Best Practices.doc is available from:
http://www.microsoft.com/downloads/details.aspx?FamilyID=8c8e0d90-a13b-4977-a4fc-3e2b67e3748e

2.1.3 User account policies and settings

It is suggested, administrator should:

• Review user accounts on a regular basis.

• Disable or delete all unused accounts.
• Disable all guest accounts.

2.1.3.1 Windows security settings

Windows Security Settings are used to control the working environment of user accounts and computer
accounts in the Microsoft windows OS. It provides configuration and central management for OS,
applications and user security settings.

For more information, please refer the latest CIS benchmark for further information about the settings
https://www.cisecurity.org/cis-benchmarks/

2.1.3.2 Web application firewall

A Web Application Firewall (WAF) is a firewall for IIS that monitors, filters and blocks data packets as they
travel to and from a website or web application. A WAF can be either network-based, host-based or
cloud-based and is often deployed through a reverse proxy and placed in front of one or more websites or
applications.

WIN-PAK Security Guide 7

For more information, please refer the below link

https://owasp.org/www-community/Web_Application_Firewall

Refer to the following links to install Web Firewall

1. PrivacyWare https://www.privacyware.com/threatsentry.html
2. WebKnight https://geekflare.com/webknight-iis-waf/

Mod Security https://www.modsecurity.org/

WIN-PAK Security Guide 8

3 WIN-PAK Security Features
3.1 Secure Architecture for Domain Environment

WIN-PAK Security Guide 9

3.2 Securely Installing and Configuring WIN-PAK

3.2.1 Receiving WIN-PAK Software

WIN-PAK is received as DVD format to the end customers, they need to ensure that DVD should be
tampered free. If it is compromised contact Technical Support for more help.

Also, WIN-PAK installer is signed with Honeywell’s digital signature to ensure installer is not tampered.

Note: Keep the Technical Support contact details as easily accessible like paste in your desk or sticky
notes

3.2.2 Installation

3.2.2.1 Things to remember for secure installation of WIN-PAK

• WIN-PAK asks for passwords for several modules (SQL password, master key password, etc.), user
needs to secure their password and maintain complex password. User needs to make sure password
should not be shoulder surfed.

Below are the installation time system permission requirements.

Component Requirements Comments

Web Center Component IIS Required for Web Clients
WIN-PAK You need at least Standard User
rights to install all these
components.

You need SQL server admin

credentials to run SQL scripts
during installation and create
two SQL accounts used by WIN-
PAK to access WIN-PAK and
Reports WIN-PAK databases

WIN-PAK installer automatically updates firewall inbound & outbound rules for the default port number
such as 5555 (for WIN-PAK database server), etc.
If additional firewall inbound & outbound rules to be set for custom port number, then user needs to
enable them manually.

3.2.3 Authentication Mechanism

WIN-PAK supports different types of user authentication based on the configuration of the system

Type of Authentication Description

SQL Authentication & Windows Integrated Used by WIN-PAK components to connect to the
Authentication in SQL Server SQL Server.
Application level authentication User can choose anyone of the below two options
for all the WIN-PAK Components.
i. WIN-PAK authentication: User is
explicitly asked a username and
password to login into WIN-PAK
components

WIN-PAK Security Guide 10

 ii. Windows Integrated authentication:
Logged In user credentials
automatically taken and used for
authentication.
For Web Application, there is one more option
iii. LDAP based authentication – LDAP
credentials required for this
authentication

Passwords
The WIN-PAK application passwords can be managed by Administrator component.

3.2.3.1 Strong passwords

Not all passwords are equally effective. Ensuring that users are choosing good, strong passwords is
essential to securing WIN-PAK System.

When creating a password, the following guidelines can help generate stronger passwords:

• A random string of characters, including letters, numbers and uppercase, lowercase and special
characters, (e.g., s13pj96t!cD) is typically a strong password. However, these can be hard to
remember.
• A long, nonsensical sentence (e.g. “I happily tarnished under 21 waterlogged potatoes, which
meet up on Sundays”) can be used as is. For systems that restrict password length, it can be
contracted to include only the first character of each word (e.g., “Ihtu21wp,wmuoS”).These are
difficult for attackers to guess, but are typically easy (albeit silly) for users to remember. This pass
phrase-based approach is highly recommended.

Note: When picking a sentence as a passphrase, it is best to avoid well-known phrases and sentences,
as these may be included in dictionary attacks (e.g., “Luke, I am your father”).

A string of random words (e.g., “coffee Strange@ Halberd 11 tortoise!”) provides a much longer
password that are single word or a random string of characters. However, password crackers are
becoming more aware of this technique. Therefore, including a few random numbers and symbols
can make your password harder to crack.

Remember, a good password is easy for a user to remember, but difficult for an attacker to guess.

3.2.4 TLS & Certification Management

Transport Layer Security (TLS) provides communication security over a network by encrypting the
communication at a lower level than the actual data being communicated. This allows secure
transmission of unencrypted sensitive data over an encrypted connection.

Using TLS protects data from anyone who might be eavesdropping and watching network traffic. It also
provides proof of identity, so that an attacker cannot impersonate the server to acquire sensitive data.
When possible, always use TLS.

WIN-PAK supports communication over TLS on various components/services.

WIN-PAK Security Guide 11

3.2.4.1 Setup Certificates
WIN-PAK uses HTTPS for many of its services, which requires a certificate. There are several options
that can be used to address the need for a certificate:

• Purchase a certificate from an accredited certification authority.

• Use a certificate from the site's IT department, if there is a certificate authority infrastructure in
place.

If you use a purchased certificate or a local certificate generated by the IT department, it must be installed
according to the instructions provided. By using these types of certificates, you automatically establish a
trust relationship.

Refer the Installing CA Certificate section for more details

3.2.5 Application Whitelisting

Application whitelisting is a security practice used to prevent malicious or untrusted applications from
running on a system. AppLocker is a Microsoft application whitelisting technology that enables
administrators to define rules that control what applications can run on a system and which users can run
them. Any application that is not defined in the list of allowable applications is not permitted to run.

Please use the following link to configure App Locker in Windows

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-
control/applocker/applocker-policies-deployment-guide

3.2.6 Third-party Applications

Honeywell does not recommend the installation and use of any unsupported Third-party Applications on
any WIN-PAK computers. This includes the WIN-PAK Web Servers, WIN-PAK Database Server and
WIN-PAK Clients. 3rd party applications may affect the performance of these computers and perhaps
even result in a loss of view of the building security.

3.3 Securely Maintaining WIN-PAK

3.3.1 Scope
An important part of the overall security strategy is to set up a system for ensuring that the operating system
& WIN-PAK software is kept up to date.

At the same time, remember that frequent updates to critical Security System can be error prone and may
over time, destabilize your system.

Therefore, such updates should be undertaken judiciously and with care.

3.3.2 Microsoft Security Updates

Microsoft releases a range of security and software updates such as SQL Server and .NET framework.

Timely information on security updates can be obtained by subscribing to the Microsoft Security Bulletin
Summary at:
http://www.microsoft.com/technet/security/bulletin/notify.mspx

Please check the below link to get the Microsoft latest available patches/updates

https://portal.msrc.microsoft.com/en-us/security-guidance

WIN-PAK Security Guide 12

Attention
Prior to installing any critical updates or making any system changes, ALWAYS back up the system or take
a snapshot. This will provide a safe and efficient recovery, if the update fails.

3.3.3 Microsoft Service Packs

A service pack is a tested, cumulative set of all security and other updates. Service packs may also contain
additional fixes for problems that have been found internally since the release of the product, and a limited
number of customer-requested design changes or features. Ensure that your system is always updated
with latest Microsoft Windows service packs.

Please check the below link to get the Microsoft latest available patches/updates

https://portal.msrc.microsoft.com/en-us/security-guidance

Attention
Before installing any critical updates or making any system changes, ALWAYS back up the system or
take snapshot. This will provide a safe and efficient recovery path if the update fails.

3.3.4 WIN-PAK Updates

WIN-PAK updates are done via Tech Support team, if any new updates available for WIN-PAK then Tech
Support team will inform end user and provide the patches to update.

If customer needs to update latest patches for WIN-PAK, they will reach out to Tech support team. Tech
support will help them to update latest patch available at that time.

3.4 GDPR

3.4.1 Deleting the user information

In WIN-PAK Scheduler operator can configure the purge history option to delete the history records of a
user from the database by specifying threshold time period.

3.4.2 Exporting the user information

WIN-PAK has different types of reports for exporting user information according to the operator
permission.

WIN-PAK Security Guide 13

4 System Monitoring
4.1 Overview
It is suggested to follow the recommended steps in this document to make the system more secure.

4.1.1 Security Audit Logs

It is recommended that you enable the auditing of your file system and registry access. If there is a
suspicion that the system is being misused, then Windows auditing provides a useful tool to track who
has done what and when. Once auditing is enabled, the audit logs should be reviewed frequently by an
accountable person, who can act if unexpected activity is identified.

4.1.1.1 Considerations
The default action is to halt the system if the security log becomes full. This is to prevent activity occurring
without any traceability. However, it also provides an opportunity for a Denial of Service (DOS) attack.

To prevent this, either increase the log file size and review the log before it fills up or set one of the
overwrite options (for example, “Overwrite events as needed”), and check the log frequently enough to
prevent loss of events.

To view the log settings, launch the Event Viewer tool, select Log → Security and then select Log →
Log Settings. Then change either the Maximum Log Size, or the Event Log Wrapping options.

You should ensure that the audit log is regularly inspected and cleared, or else disable the security option
“Audit: shut down system immediately if unable to log security audits”.

Configuring the log settings to overwrite will ensure that the system never stops when the log is full, but
this can also be used to hide events of interest by falsely filling the log with other events. This highlights
the need for regular monitoring.

To enable auditing:
Either:
• Set the appropriate Group policy,
or
• Log on as the Local Administrator and
o Launch the User Manager tool.
o Select Policies → Audit and enable options of interest.
The most useful options are likely to be:
o Logon and Logoff - success and failure
o Process Tracking - success and failure
o Object access - success and failure
This enables the auditing of file system and registry access. It is then necessary to select the objects of
interest and the user (or groups) whose actions are to be audited. Since it is necessary to specify an
identity to audit (and, it is not known who the intruder is), you should specify the group “Everyone”.

To configure the auditing of file access:

1. Go to Windows Explorer and select the directory or file of interest.

2. Select Properties → Security → Advanced → Auditing.
3. Then add a user, for example, “Everyone” and the access to be audited; for example, “Open
failure”.

WIN-PAK Security Guide 14

To configure the auditing of registry keys:

1. Run regedt32.
2. Select the key for which you want to set up auditing.
3. Select Permissions → Advanced → Auditing and add users as explained in the previous
section.

4.1.2 Securing HTTP Headers - IIS

IIS will expose its version in the HTTP responses.
Microsoft provides URLScan, which can be used for removing server information from HTTP responses
sent by IIS. URLScan requires IIS6 Metabase compatibility to work. Additionally, the configuration made
to IIS is global. If you want to setup this configuration on a site-by-site basis, please follow the below
steps.
1. Enable Metabase Compatibility. Find out how to enable Metabase compatibility.
2. Install URLScan
3. Open the URLScan.ini file with a text editor. The file is usually located in
the %WINDIR%System32InetsrvURLscandirectory.
4. Search for the key RemoveServerHeader, which by default is set to 0. Set the value to 1 in order
to remove the Server header.

4.1.3 Controlled Trusted Secure Network

Honeywell recommends having WIN-PAK system in isolated and secure network environment to prevent
sniffing/intercepting of data. Firewall should be implemented for any internet connection to control
inbound and outbound traffic. Thick client should be allowed to connect only Vector cloud and any other
connection should be declined by firewall.

4.2 Video Management System Security Manual

Refer the security manual of MAXPRO VMS & NVR Software that is integrated with WIN-PAK in the
below link.
https://mywebtech.honeywell.com/Systems/DownloadCenterProd?id=23

4.3 Recommended Environment

Honeywell recommends client and server machines to be configured in domain environment.

WIN-PAK Security Guide 15

5 Installing CA Certificate
Honeywell recommends using a valid certificate from a Certificate Authority that would ensure robust
security along with integrity and authenticity, instead of using self-signed certificate. Find the steps for
installing CA certificate as the below.

5.1 Procuring and Installing CA Certificate

Note: Honeywell recommends you using a valid certificate from a Certificate Authority that would ensure
robust security along with integrity and authenticity, instead of using self-signed certificate.

5.1.1 Installing the Certificate

To install your newly acquired SSL certificate in IIS, first copy the file somewhere on the server and then
follow these instructions:

Note: You need to have a certificate acquired from CA authority or generate an SSL certificate before
starting this procedure.

Honeywell recommends, using a valid certificate from a Certificate Authority that would ensure robust
security along with integrity and authenticity, instead of using a self-signed certificate.

To install the certificate, perform the following steps:

1. Click Start → Administrative Tools → Internet Information Services (IIS) Manager.

2. Click the name of the server in the Connections column on the left.
3. Double-click the Server Certificates.

WIN-PAK Security Guide 16

4. In the Actions column on the right, click the Complete Certificate Request...as shown below.

5. Click the button with the three dots and select the server certificate that you received from the
certificate authority. If the certificate doesn't have a .cer file extension, then view all types. Enter any
friendly name you want so you can keep track of the certificate on this server. Click OK.

WIN-PAK Security Guide 17

6. If successful, you will see the newly installed certificate in the list. If you receive an error stating that
the request or private key cannot be found, ensure you are using the correct certificate and that you
are installing it to the same server that you generated the CSR. If you are sure of those two things,
you may just need to create a new Certificate Request and reissue/replace the certificate. Contact
your certificate authority if you have problems with this.

WIN-PAK Security Guide 18

5.1.2 Bind the Certificate to a website
1. In the Internet Information Services Manager (IIS) window, expand the server node under
Connections pane.

2. Navigate to Sites > Default Web Site.

3. Click Bindings in the right-most pane. The Site Bindings dialog appears.

4. Click the Add...button

5. Change the Type to https and then select the SSL certificate that you just installed. Click OK.

6. You will now see the binding for Port 443 listed. Click Close.

WIN-PAK Security Guide 19

Install any Intermediate Certificates
Most SSL providers issue an Intermediate server certificate, which you
will need to install to the server. Else, your visitors will receive a Certificate Not Trusted Error.
You can install each Intermediate certificate (sometimes there is more than one) as follows:

1. Download the intermediate certificate to a folder on the server.

2. Double click the certificate to open the certificate details.
3. At the lower portion of the General tab, click the Install Certificate to start the
certificate import wizard.
4. Click Next.

5. Select Place all certificates in the following store and click Browse.

6. Check the Show physical stores check box, then expand the Intermediate
Certification Authorities folder select the Local Computer folder beneath it.
Click OK.

WIN-PAK Security Guide 20

7. Click Next, then click Finish to complete the installation of the intermediate certificate.

5.2 Uninstallation
WIN-PAK can be uninstalled from windows control panel.

Start → Windows Control Panel → Programs → Programs and Features→ Select WIN-PAK →
Uninstall.

Uninstalling WIN-PAK will clean up the files, data and PII.

Remote SQL utility is a standalone exe which must be deleted manually after usage.

6 Suprema Panel Integration Recommendations

• Honeywell recommends Suprema panel connecting to WIN-PAK in a Secure Private Network.

• Honeywell recommends storing the certificate created for suprema panel for SSL connection
should be in a secure folder to avoid unauthorized access.

7 Enabling the Security Audit logs in IIS in Event Viewer

Honeywell recommends to enable the security logs in IIS to logs the operations in the IIS. Please follow
the below steps to enable a security audit logs in Windows event viewer.

Step 1: use keyboard shortcut Windows Key+R to open the Run dialog enter command ‘eventvwr’.
Step 2: In Windows Event Viewer, navigate to Application and Service Logs-> Microsoft->
Windows-> IIS-Configuration.
Step 3: Right click on the ‘Operational’ in IIS-Configuration and select ‘Enable Log’.

WIN-PAK Security Guide 21

WIN-PAK Security Guide 22
8 Network firewall restrictions and IP whitelisting

Honeywell recommends enabling the network firewall restrictions in ports and secure network
segmentation on deploying the WIN-PAK applications. IP whitelisting in windows firewall is
recommended.

Port Type Used for

135 TCP DCOM components
1433, 1434 ,2383, 2380 TCP MSSQL
1434 UDP MSSQL
5544 TCP WIN-PAK API Server
80 HTTP Web application
445 TCP Microsoft-ds (Active directory authentication check)
5555 TCP WIN-PAK Database Server
5556 TCP WIN-PAK Archive Server
5500 TCP WIN-PAK Muster Server
5577 TCP WIN-PAK Guard tour Server
5599 TCP WIN-PAK Command file Server
5588 TCP WIN-PAK Schedule Server
3001, 2101,51212 TCP WIN-PAK Panel communication
5566 TCP WIN-PAK Communication server
443 HTTPS Web application
6000 - 6200 TCP RPC Random ports
20007,26026,20010 TCP VMS Services

WIN-PAK Security Guide 23