Rhino Element Manager

We recommend that you adhere to the principle of least privilege when you grant permissions to user accounts. Least privilege access gives users only the permissions they need to carry out the tasks that they are responsible for. When you grant permissions in compliance with least privilege, you reduce the potential impact that a compromised account can have on your network.

You need to use the default administrator account to log in the first time when you use REM. To ensure system security, change the password and create user accounts with appropriate permissions. For details, see Enter username and password.

REM supports LDAP based authentication, see Appendix G. Using LDAP for authentication for details and setup instructions.

We recommend that you remove user accounts from your system once they are no longer needed, for example after a user retires or leaves their role.

We recommend that passwords/PINs adhere to the following requirements.

We recommend that machine-to-machine passwords and other passwords that users do not enter manually adhere to the following requirements.

REM supports both local and centralized authentication. For local authentication, adhere to these password requirements when you manage local user accounts. If you use centralized authentication with LDAP, implement relevant password policy on the authentication server.

We recommend that all users store their passwords in a secure password manager. Password managers help users keep track of their different passwords and allow for more complex passwords that would be difficult to memorize.

We recommend that you adhere to principles of Zero Trust while designing, commissioning, and modifying your deployment. Zero Trust includes authenticating and authorizing traffic whenever possible, giving the least amount of access required to sessions and entities, and assuming that a security breach could originate from anywhere. A Zero Trust security model helps mitigate the effect of a breach if a device or network is compromised. For more information on Zero Trust principles, see Zero Trust Model - Modern Security Architecture | Microsoft Security.

This documentation uses Transport Layer Security (TLS) certificates to refer to X.509 certificates used with the TLS protocol. Outside of this product’s documentation, you may see TLS certificates referred to as SSL/TLS certificates or just SSL certificates. These terms are often used interchangeably, even though Secure Sockets Layer (SSL) is a distinct protocol from TLS.

Connections between REM and the Rhino TAS server are encrypted with the TLS protocol. For additional security, we recommend that you run REM over HTTPS. For details, see Running REM over HTTPS.

You must establish trust domains around your devices and network and configure security controls on the trust boundaries such as firewalls, network security groups, and rate limiting, even when you control the devices on both sides of the boundary.

We recommend that you replace certificates at least once per year, including removing the old certificates from your system. This is known as rotating certificates. You might need to rotate your certificates more frequently if they expire after less than one year, or if organizational policies require it.