What are the security best practices for PI System?

Securing your PI System involves network architecture, authentication, authorization, and monitoring.

Network Architecture

PI System Security Zones

AVEVA recommends a layered architecture:

1. Level 0-2: Field devices and control networks (PLCs, DCS)
2. Level 3: PI Data Archive, PI Interfaces (DMZ between OT and IT)
3. Level 4: PI Vision, PI Web API, AF Server (enterprise network)
4. Level 5: Cloud and external access

Use firewalls between each level with only required ports open:

• PI Data Archive: TCP 5450
• PI AF: TCP 5457-5459
• PI Web API: TCP 443 (HTTPS)

Authentication

Windows Integrated Authentication

• Use Kerberos for all PI client connections
• Avoid PI trusts based on IP address — use domain accounts
• Configure service accounts with least-privilege principles

PI Web API

• Enable HTTPS only — never expose PI Web API over HTTP
• Use OIDC/OAuth for modern authentication flows
• Configure CORS policies to restrict allowed origins

Authorization

PI Point Security

• Assign read/write permissions per tag or tag group
• Use security groups rather than individual accounts
• Restrict write access to interface service accounts only

AF Security

• Set security at the AF database and element level
• Use AF security templates for consistent permissions
• Limit who can create/modify analytics and event frames

PI Mappings & Trusts

• Prefer PI Mappings (Windows identity-based) over PI Trusts
• Remove default PIWorld mapping or restrict it to read-only
• Audit and remove unused trusts regularly

Monitoring

• Enable PI Audit Trail to log configuration changes
• Monitor failed authentication attempts in Windows Event Log
• Review PI Message Logs for security-related events
• Use PI Vision to create security dashboards tracking access patterns

Common Mistakes

• Leaving PIWorld with write access
• Using the piadmin account for application connections
• Not encrypting PI Web API traffic
• Skipping security hardening on secondary collective members