RWS200 security checklist - RWS200

To enhance the security of your RWS200, check that you have done applicable tasks from the following table.

RWS200 security checklist
Human layer
Create personal user account for all users, with the correct roles.
Change the default user and admin passwords for the Web UI.
Change the default password for the cellular router.
Change the default passwords for the cameras.
Hardware perimeter layer
Change enclosure locks to locally-sourced ones with unique keys.
Install a door switch to the enclosure and add active monitoring for door opening events.
Prevent unauthorized access to the site.
Network layer
Use APN instead of a public, static IP address.
Separate RWS200 to its own subnet in your private network.
If your RWS200 is in the Internet, allow incoming traffic only from IP addresses in your backend system.
Use push instead of polling in data reporting.
Use secure HTTPS protocol in outgoing connections.
Use unique credentials for each station's connection to the data collection system.
Replace the default self-signed certificate with a signed certificate.
Make sure that the WLAN hotspot is disabled when not in use.
Cellular router
Use a device-lock SIM.
Install the latest cellular router software version and keep it up to date.
Enable firewall in the cellular router.
Block all incoming connections and only open the necessary ports.
Close the SSH port (22).
If you have Digi WR21 or other obsolete cellular router, replace it with IX20 or other supported router.
Process layer
Install the latest station (DMU703) software version and keep it up to date.
Check software updates for the cameras, PMU701, DRI701, and sensors, and keep them up to date.
Agree who is responsible for software updates.