[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71BJKFMWV08XPHS3MTCKY8K":3,"skill-same:01M71BJKFMWV08XPHS3MTCKY8K":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":80},"01M71BJKFMWV08XPHS3MTCKY8K","cyber-securing-historian-server-in-ot-environment",null,"This skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses network placement across Purdue levels, access control for historian interfaces, data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection prevention in historian queries, and integrity protection of process data use","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-securing-historian-server-in-ot-environment\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"server","environment","securing historian server in ot environment","cyber securing historian server in ot environment","historian","Access Control","environments","prevention","addresses","integrity","injection","data","network","Safety","dmz","sql","across","access","false","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cyber-securing-historian-server-in-ot-environment\ndescription: \"This skill covers hardening and securing process historian servers (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses network placement across Purdue levels, access control for historian interfaces, data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection prevention in historian queries, and integrity protection of process data use\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: securing-historian-server-in-ot-environment | description: 'This skill covers hardening and securing process historian servers (OSIsoft |   PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses |   network placement across Purdue levels, access control for historian interfaces, |   data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection |   prevention in historian queries, and integrity protection of process data used for |   safety a\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Securing Historian Server in OT Environment\n\n## When to Use\n\n- When deploying a new historian server in an OT environment and configuring it securely from the start\n- When hardening an existing historian after a security assessment identified it as a high-risk target\n- When designing historian data replication architecture through a DMZ for IT access to process data\n- When implementing access controls to prevent unauthorized modification of historical process data\n- When investigating suspected historian compromise or data integrity issues\n\n**Do not use** for IT-only database security without OT data (see general database hardening), for real-time SCADA data transmission security (see detecting-attacks-on-scada-systems), or for historian selection and sizing decisions.\n\n## Prerequisites\n\n- Historian platform (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) installed and operational\n- Network segmentation with historian placed in Level 3 (Site Operations) per Purdue Model\n- Understanding of data flows: field devices -> PLCs -> OPC servers -> historian\n- Access to historian administration credentials\n- DMZ infrastructure for IT-facing data replication\n\n## Workflow\n\n### Step 1: Audit Current Historian Security Configuration\n\nEvaluate the current security posture of the historian server including network exposure, authentication, and access controls.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Historian Security Audit Tool.\n\nEvaluates the security configuration of process historian servers\nincluding network exposure, authentication, access controls,\nand data integrity protections.\n\"\"\"\n\nimport json\nimport socket\nimport ssl\nimport subprocess\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass AuditFinding:\n    finding_id: str\n    severity: str\n    category: str\n    title: str\n    detail: str\n    remediation: str\n\n\nclass HistorianSecurityAudit:\n    \"\"\"Security audit for OT historian servers.\"\"\"\n\n    def __init__(self, historian_ip, historian_type=\"PI\"):\n        self.ip = historian_ip\n        self.type = historian_type\n        self.findings = []\n        self.counter = 1\n\n    def check_network_exposure(self):\n        \"\"\"Check which network services are exposed by the historian.\"\"\"\n        print(f\"[*] Checking network exposure: {self.ip}\")\n\n        # Common historian ports\n        ports_to_check = {\n            5450: (\"PI Data Archive\", \"PI SDK\u002FAPI connections\"),\n            5457: (\"PI AF Server\", \"PI Asset Framework\"),\n            5459: (\"PI Notifications\", \"PI Notification Service\"),\n            443: (\"HTTPS\", \"PI Vision \u002F Web API\"),\n            80: (\"HTTP\", \"Unsecured web interface\"),\n            1433: (\"MS SQL Server\", \"Direct database access\"),\n            5432: (\"PostgreSQL\", \"Direct database access\"),\n            3389: (\"RDP\", \"Remote Desktop\"),\n            135: (\"RPC\", \"Windows RPC\"),\n            445: (\"SMB\", \"Windows File Sharing\"),\n            8080: (\"HTTP Alt\", \"Alternative web interface\"),\n        }\n\n        exposed = []\n        for port, (service, desc) in ports_to_check.items():\n            try:\n                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n                sock.settimeout(3)\n                result = sock.connect_ex((self.ip, port))\n                sock.close()\n                if result == 0:\n                    exposed.append({\"port\": port, \"service\": service, \"description\": desc})\n            except Exception:\n                pass\n\n        # Flag unnecessary exposed services\n        for svc in exposed:\n            if svc[\"port\"] in (80, 135, 445, 3389):\n                self.findings.append(AuditFinding(\n                    finding_id=f\"HIST-{self.counter:03d}\",\n                    severity=\"high\",\n                    category=\"Network Exposure\",\n                    title=f\"Unnecessary service exposed: {svc['service']} (port {svc['port']})\",\n                    detail=f\"Port {svc['port']} ({svc['description']}) is accessible on historian\",\n                    remediation=f\"Disable {svc['service']} or restrict via host firewall\",\n                ))\n                self.counter += 1\n\n        if any(s[\"port\"] == 80 for s in exposed):\n            self.findings.append(AuditFinding(\n                finding_id=f\"HIST-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Encryption\",\n                title=\"Historian web interface on unencrypted HTTP\",\n                detail=\"Port 80 (HTTP) is open, exposing credentials and data in cleartext\",\n                remediation=\"Redirect HTTP to HTTPS; disable port 80\",\n            ))\n            self.counter += 1\n\n        return exposed\n\n    def check_authentication(self):\n        \"\"\"Check historian authentication configuration.\"\"\"\n        print(f\"[*] Checking authentication configuration\")\n\n        # Check if PI Trust authentication is still enabled (legacy, insecure)\n        # PI Trust allows IP-based authentication without credentials\n        checks = [\n            {\n                \"check\": \"PI Trust Authentication\",\n                \"risk\": \"PI Trust allows connections based on IP address alone without credentials\",\n                \"severity\": \"critical\",\n                \"remediation\": \"Migrate all PI Trust connections to Windows Integrated Security\",\n            },\n            {\n                \"check\": \"Default piadmin account\",\n                \"risk\": \"Default PI administrator account may have default or weak password\",\n                \"severity\": \"critical\",\n                \"remediation\": \"Disable piadmin; use named Windows accounts with PI mappings\",\n            },\n            {\n                \"check\": \"PI SDK anonymous access\",\n                \"risk\": \"Anonymous PI SDK connections may be permitted\",\n                \"severity\": \"high\",\n                \"remediation\": \"Require authentication for all PI SDK connections\",\n            },\n        ]\n\n        for check in checks:\n            self.findings.append(AuditFinding(\n                finding_id=f\"HIST-{self.counter:03d}\",\n                severity=check[\"severity\"],\n                category=\"Authentication\",\n                title=f\"Check: {check['check']}\",\n                detail=check[\"risk\"],\n                remediation=check[\"remediation\"],\n            ))\n            self.counter += 1\n\n    def check_data_integrity(self):\n        \"\"\"Check data integrity protections.\"\"\"\n        print(f\"[*] Checking data integrity protections\")\n\n        integrity_checks = [\n            AuditFinding(\n                finding_id=f\"HIST-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Data Integrity\",\n                title=\"Verify historical data modification audit trail\",\n                detail=\"Modifications to historical process data should be logged with before\u002Fafter values\",\n                remediation=\"Enable PI audit trail for all data modifications; restrict edit permissions\",\n            ),\n            AuditFinding(\n                finding_id=f\"HIST-{self.counter + 1:03d}\",\n                severity=\"medium\",\n                category=\"Data Integrity\",\n                title=\"Verify backup integrity and recovery testing\",\n                detail=\"Historian backups should be tested regularly for recovery capability\",\n                remediation=\"Implement automated backup verification with quarterly recovery testing\",\n            ),\n        ]\n        self.findings.extend(integrity_checks)\n        self.counter += len(integrity_checks)\n\n    def generate_report(self):\n        \"\"\"Generate historian security audit report.\"\"\"\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"HISTORIAN SECURITY AUDIT REPORT\")\n        report.append(f\"Target: {self.ip} ({self.type})\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            findings = [f for f in self.findings if f.severity == sev]\n            if findings:\n                report.append(f\"\\n--- {sev.upper()} ({len(findings)}) ---\")\n                for f in findings:\n                    report.append(f\"  [{f.finding_id}] {f.title}\")\n                    report.append(f\"    {f.detail}\")\n                    report.append(f\"    Fix: {f.remediation}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    target = sys.argv[1] if len(sys.argv) > 1 else \"10.30.1.50\"\n    audit = HistorianSecurityAudit(target, \"PI\")\n    audit.check_network_exposure()\n    audit.check_authentication()\n    audit.check_data_integrity()\n    print(audit.generate_report())\n```\n\n### Step 2: Harden Historian Server\n\nApply security hardening based on vendor security guides and IEC 62443 requirements.\n\n```powershell\n# OSIsoft PI Server Hardening Script (Windows)\n# Based on OSIsoft Security Best Practices Guide\n\n# 1. Disable PI Trust authentication - migrate to Windows Integrated Security\n# In PI SMT (System Management Tools):\n# Security > Mappings & Trusts > Delete all Trust entries\n# Create PI Mappings for Windows groups instead\n\n# 2. Disable the default piadmin account\n# In PI SMT: Security > Identities, Users & Groups\n# Set piadmin account to disabled\n\n# 3. Configure Windows Firewall for PI Server\nNew-NetFirewallRule -DisplayName \"PI Data Archive\" -Direction Inbound `\n    -Protocol TCP -LocalPort 5450 -Action Allow `\n    -RemoteAddress \"10.30.0.0\u002F16\",\"10.20.0.0\u002F16\" `\n    -Description \"Allow PI SDK connections from OT zones only\"\n\nNew-NetFirewallRule -DisplayName \"PI AF Server\" -Direction Inbound `\n    -Protocol TCP -LocalPort 5457 -Action Allow `\n    -RemoteAddress \"10.30.0.0\u002F16\" `\n    -Description \"Allow PI AF connections from Operations zone\"\n\nNew-NetFirewallRule -DisplayName \"PI Vision HTTPS\" -Direction Inbound `\n    -Protocol TCP -LocalPort 443 -Action Allow `\n    -RemoteAddress \"172.16.0.0\u002F16\" `\n    -Description \"Allow PI Vision HTTPS from DMZ only\"\n\n# Block HTTP (force HTTPS)\nNew-NetFirewallRule -DisplayName \"Block HTTP\" -Direction Inbound `\n    -Protocol TCP -LocalPort 80 -Action Block\n\n# Block RDP from non-authorized sources\nNew-NetFirewallRule -DisplayName \"RDP Restrict\" -Direction Inbound `\n    -Protocol TCP -LocalPort 3389 -Action Allow `\n    -RemoteAddress \"10.30.1.100\" `\n    -Description \"Allow RDP from admin jump server only\"\n\n# 4. Enable Windows audit policies for CIP-007 compliance\nauditpol \u002Fset \u002Fsubcategory:\"Logon\" \u002Fsuccess:enable \u002Ffailure:enable\nauditpol \u002Fset \u002Fsubcategory:\"Account Lockout\" \u002Fsuccess:enable \u002Ffailure:enable\nauditpol \u002Fset \u002Fsubcategory:\"File System\" \u002Fsuccess:enable \u002Ffailure:enable\nauditpol \u002Fset \u002Fsubcategory:\"Registry\" \u002Fsuccess:enable \u002Ffailure:enable\n\n# 5. Configure PI audit trail for data integrity\n# In PI SMT: Audit > Enable auditing for security changes\n# Enable auditing for: point creation\u002Fdeletion, data edits, security changes\n```\n\n### Step 3: Implement Secure Data Replication to DMZ\n\nConfigure historian data replication through the DMZ using PI-to-PI interfaces or data diodes to provide IT access to process data without exposing the OT historian.\n\n```yaml\n# Historian DMZ Replication Architecture\n#\n# OT Historian (Level 3) --> Data Diode --> DMZ Historian (Level 3.5) \u003C-- Enterprise (Level 4)\n#\n# Key principle: Enterprise users NEVER connect directly to the OT historian.\n# Data flows unidirectionally from OT to DMZ.\n\narchitecture:\n  ot_historian:\n    location: \"Level 3 - Site Operations\"\n    server: \"PI-OT-01 (10.30.1.50)\"\n    role: \"Primary data collection from OPC servers and PLCs\"\n    access: \"OT operators and engineers only\"\n\n  data_diode:\n    location: \"Between Level 3 and Level 3.5\"\n    device: \"Waterfall Security Unidirectional Gateway\"\n    direction: \"OT -> DMZ (physically enforced one-way)\"\n    protocol: \"PI-to-PI replication protocol\"\n\n  dmz_historian:\n    location: \"Level 3.5 - DMZ\"\n    server: \"PI-DMZ-01 (172.16.1.50)\"\n    role: \"Read-only mirror of OT historian for enterprise access\"\n    access: \"Enterprise users via PI Vision (HTTPS)\"\n    data_delay: \"Near real-time (typically 5-30 second delay)\"\n\n  enterprise_access:\n    method: \"PI Vision web application on DMZ historian\"\n    authentication: \"Windows Integrated Security with MFA\"\n    protocol: \"HTTPS (TLS 1.2+)\"\n    restrictions:\n      - \"Read-only access to process data\"\n      - \"No write-back capability to OT historian\"\n      - \"No direct database queries - PI Vision API only\"\n      - \"Session timeout after 30 minutes of inactivity\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Process Historian | Server that collects, stores, and serves time-series process data from industrial control systems at high frequency (sub-second to seconds) |\n| PI Trust | Legacy OSIsoft PI authentication method based on IP address\u002Fhostname; insecure and should be migrated to Windows Integrated Security |\n| Data Diode | Hardware-enforced unidirectional gateway ensuring historian data flows only from OT to DMZ, preventing reverse access |\n| PI-to-PI Interface | OSIsoft replication mechanism that synchronizes PI data between servers, used for DMZ data mirroring |\n| Audit Trail | Historian feature logging all modifications to historical data with before\u002Fafter values, user identity, and timestamp |\n| Tag Security | Per-tag access control in PI determining which users\u002Fapplications can read or write specific process data points |\n\n## Tools & Systems\n\n- **OSIsoft PI Server**: Industry-leading process historian by AVEVA (formerly OSIsoft) used in 90%+ of large industrial facilities\n- **AVEVA Historian**: Time-series database for process data with SQL-like query interface\n- **Waterfall Security**: Hardware data diode for unidirectional historian replication\n- **PI Vision**: Web-based visualization tool for PI data, deployed in DMZ for enterprise access\n\n## Output Format\n\n```\nHistorian Security Assessment Report\n=====================================\nHistorian: [Type and Version]\nServer: [Hostname\u002FIP]\nNetwork Zone: [Purdue Level]\n\nAUTHENTICATION:\n  PI Trust entries: [N] (should be 0)\n  Default accounts: [enabled\u002Fdisabled]\n  Windows auth: [enabled\u002Fdisabled]\n\nNETWORK EXPOSURE:\n  Open ports: [list]\n  Unnecessary services: [list]\n\nDATA INTEGRITY:\n  Audit trail: [enabled\u002Fdisabled]\n  Backup tested: [date]\n\nDMZ REPLICATION:\n  Method: [PI-to-PI \u002F Data Diode \u002F VPN]\n  Direction: [Unidirectional \u002F Bidirectional]\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Securing Historian Server in OT Environment\n\n## When to Use\n\n- When deploying a new historian server in an OT environment and configuring it securely from the start\n- When hardening an existing historian after a security assessment identified it as a high-risk target\n- When designing historian data replication architecture through a DMZ for IT access to process data\n- When implementing access controls to prevent unauthorized modification of historical process data\n- When investigating suspected historian compromise or data integrity issues\n\n**Do not use** for IT-only database security without OT data (see general database hardening), for real-time SCADA data transmission security (see detecting-attacks-on-scada-systems), or for historian selection and sizing decisions.\n\n## Prerequisites\n\n- Historian platform (OSIsoft PI, Honeywell PHD, GE Proficy, AVEVA Historian) installed and operational\n- Network segmentation with historian placed in Level 3 (Site Operations) per Purdue Model\n- Understanding of data flows: field devices -> PLCs -> OPC servers -> historian\n- Access to historian administration credentials\n- DMZ infrastructure for IT-facing data replication\n\n## Workflow\n\n### Step 1: Audit Current Historian Security Configuration\n\nEvaluate the current security posture of the historian server including network exposure, authentication, and access controls.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Historian Security Audit Tool.\n\nEvaluates the security configuration of process historian servers\nincluding network exposure, authentication, access controls,\nand data integrity protections.\n\"\"\"\n\nimport json\nimport socket\nimport ssl\nimport subprocess\nimport sys\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime\n\n\n@dataclass\nclass AuditFinding:\n    finding_id: str\n    severity: str\n    category: str\n    title: str\n    detail: str\n    remediation: str\n\n\nclass HistorianSecurityAudit:\n    \"\"\"Security audit for OT historian servers.\"\"\"\n\n    def __init__(self, historian_ip, historian_type=\"PI\"):\n        self.ip = historian_ip\n        self.type = historian_type\n        self.findings = []\n        self.counter = 1\n\n    def check_network_exposure(self):\n        \"\"\"Check which network services are exposed by the historian.\"\"\"\n        print(f\"[*] Checking network exposure: {self.ip}\")\n\n        # Common historian ports\n        ports_to_check = {\n            5450: (\"PI Data Archive\", \"PI SDK\u002FAPI connections\"),\n            5457: (\"PI AF Server\", \"PI Asset Framework\"),\n            5459: (\"PI Notifications\", \"PI Notification Service\"),\n            443: (\"HTTPS\", \"PI Vision \u002F Web API\"),\n            80: (\"HTTP\", \"Unsecured web interface\"),\n            1433: (\"MS SQL Server\", \"Direct database access\"),\n            5432: (\"PostgreSQL\", \"Direct database access\"),\n            3389: (\"RDP\", \"Remote Desktop\"),\n            135: (\"RPC\", \"Windows RPC\"),\n            445: (\"SMB\", \"Windows File Sharing\"),\n            8080: (\"HTTP Alt\", \"Alternative web interface\"),\n        }\n\n        exposed = []\n        for port, (service, desc) in ports_to_check.items():\n            try:\n                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n                sock.settimeout(3)\n                result = sock.connect_ex((self.ip, port))\n                sock.close()\n                if result == 0:\n                    exposed.append({\"port\": port, \"service\": service, \"description\": desc})\n            except Exception:\n                pass\n\n        # Flag unnecessary exposed services\n        for svc in exposed:\n            if svc[\"port\"] in (80, 135, 445, 3389):\n                self.findings.append(AuditFinding(\n                    finding_id=f\"HIST-{self.counter:03d}\",\n                    severity=\"high\",\n                    category=\"Network Exposure\",\n                    title=f\"Unnecessary service exposed: {svc['service']} (port {svc['port']})\",\n                    detail=f\"Port {svc['port']} ({svc['description']}) is accessible on historian\",\n                    remediation=f\"Disable {svc['service']} or restrict via host firewall\",\n                ))\n                self.counter += 1\n\n        if any(s[\"port\"] == 80 for s in exposed):\n            self.findings.append(AuditFinding(\n                finding_id=f\"HIST-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Encryption\",\n                title=\"Historian web interface on unencrypted HTTP\",\n                detail=\"Port 80 (HTTP) is open, exposing credentials and data in cleartext\",\n                remediation=\"Redirect HTTP to HTTPS; disable port 80\",\n            ))\n            self.counter += 1\n\n        return exposed\n\n    def check_authentication(self):\n        \"\"\"Check historian authentication configuration.\"\"\"\n        print(f\"[*] Checking authentication configuration\")\n\n        # Check if PI Trust authentication is still enabled (legacy, insecure)\n        # PI Trust allows IP-based authentication without credentials\n        checks = [\n            {\n                \"check\": \"PI Trust Authentication\",\n                \"risk\": \"PI Trust allows connections based on IP address alone without credentials\",\n                \"severity\": \"critical\",\n                \"remediation\": \"Migrate all PI Trust connections to Windows Integrated Security\",\n            },\n            {\n                \"check\": \"Default piadmin account\",\n                \"risk\": \"Default PI administrator account may have default or weak password\",\n                \"severity\": \"critical\",\n                \"remediation\": \"Disable piadmin; use named Windows accounts with PI mappings\",\n            },\n            {\n                \"check\": \"PI SDK anonymous access\",\n                \"risk\": \"Anonymous PI SDK connections may be permitted\",\n                \"severity\": \"high\",\n                \"remediation\": \"Require authentication for all PI SDK connections\",\n            },\n        ]\n\n        for check in checks:\n            self.findings.append(AuditFinding(\n                finding_id=f\"HIST-{self.counter:03d}\",\n                severity=check[\"severity\"],\n                category=\"Authentication\",\n                title=f\"Check: {check['check']}\",\n                detail=check[\"risk\"],\n                remediation=check[\"remediation\"],\n            ))\n            self.counter += 1\n\n    def check_data_integrity(self):\n        \"\"\"Check data integrity protections.\"\"\"\n        print(f\"[*] Checking data integrity protections\")\n\n        integrity_checks = [\n            AuditFinding(\n                finding_id=f\"HIST-{self.counter:03d}\",\n                severity=\"high\",\n                category=\"Data Integrity\",\n                title=\"Verify historical data modification audit trail\",\n                detail=\"Modifications to historical process data should be logged with before\u002Fafter values\",\n                remediation=\"Enable PI audit trail for all data modifications; restrict edit permissions\",\n            ),\n            AuditFinding(\n                finding_id=f\"HIST-{self.counter + 1:03d}\",\n                severity=\"medium\",\n                category=\"Data Integrity\",\n                title=\"Verify backup integrity and recovery testing\",\n                detail=\"Historian backups should be tested regularly for recovery capability\",\n                remediation=\"Implement automated backup verification with quarterly recovery testing\",\n            ),\n        ]\n        self.findings.extend(integrity_checks)\n        self.counter += len(integrity_checks)\n\n    def generate_report(self):\n        \"\"\"Generate historian security audit report.\"\"\"\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"HISTORIAN SECURITY AUDIT REPORT\")\n        report.append(f\"Target: {self.ip} ({self.type})\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        for sev in [\"critical\", \"high\", \"medium\", \"low\"]:\n            findings = [f for f in self.findings if f.severity == sev]\n            if findings:\n                report.append(f\"\\n--- {sev.upper()} ({len(findings)}) ---\")\n                for f in findings:\n                    report.append(f\"  [{f.finding_id}] {f.title}\")\n                    report.append(f\"    {f.detail}\")\n                    report.append(f\"    Fix: {f.remediation}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    target = sys.argv[1] if len(sys.argv) > 1 else \"10.30.1.50\"\n    audit = HistorianSecurityAudit(target, \"PI\")\n    audit.check_network_exposure()\n    audit.check_authentication()\n    audit.check_data_integrity()\n    print(audit.generate_report())\n```\n\n### Step 2: Harden Historian Server\n\nApply security hardening based on vendor security guides and IEC 62443 requirements.\n\n```powershell\n# OSIsoft PI Server Hardening Script (Windows)\n# Based on OSIsoft Security Best Practices Guide\n\n# 1. Disable PI Trust authentication - migrate to Windows Integrated Security\n# In PI SMT (System Management Tools):\n# Security > Mappings & Trusts > Delete all Trust entries\n# Create PI Mappings for Windows groups instead\n\n# 2. Disable the default piadmin account\n# In PI SMT: Security > Identities, Users & Groups\n# Set piadmin account to disabled\n\n# 3. Configure Windows Firewall for PI Server\nNew-NetFirewallRule -DisplayName \"PI Data Archive\" -Direction Inbound `\n    -Protocol TCP -LocalPort 5450 -Action Allow `\n    -RemoteAddress \"10.30.0.0\u002F16\",\"10.20.0.0\u002F16\" `\n    -Description \"Allow PI SDK connections from OT zones only\"\n\nNew-NetFirewallRule -DisplayName \"PI AF Server\" -Direction Inbound `\n    -Protocol TCP -LocalPort 5457 -Action Allow `\n    -RemoteAddress \"10.30.0.0\u002F16\" `\n    -Description \"Allow PI AF connections from Operations zone\"\n\nNew-NetFirewallRule -DisplayName \"PI Vision HTTPS\" -Direction Inbound `\n    -Protocol TCP -LocalPort 443 -Action Allow `\n    -RemoteAddress \"172.16.0.0\u002F16\" `\n    -Description \"Allow PI Vision HTTPS from DMZ only\"\n\n# Block HTTP (force HTTPS)\nNew-NetFirewallRule -DisplayName \"Block HTTP\" -Direction Inbound `\n    -Protocol TCP -LocalPort 80 -Action Block\n\n# Block RDP from non-authorized sources\nNew-NetFirewallRule -DisplayName \"RDP Restrict\" -Direction Inbound `\n    -Protocol TCP -LocalPort 3389 -Action Allow `\n    -RemoteAddress \"10.30.1.100\" `\n    -Description \"Allow RDP from admin jump server only\"\n\n# 4. Enable Windows audit policies for CIP-007 compliance\nauditpol \u002Fset \u002Fsubcategory:\"Logon\" \u002Fsuccess:enable \u002Ffailure:enable\nauditpol \u002Fset \u002Fsubcategory:\"Account Lockout\" \u002Fsuccess:enable \u002Ffailure:enable\nauditpol \u002Fset \u002Fsubcategory:\"File System\" \u002Fsuccess:enable \u002Ffailure:enable\nauditpol \u002Fset \u002Fsubcategory:\"Registry\" \u002Fsuccess:enable \u002Ffailure:enable\n\n# 5. Configure PI audit trail for data integrity\n# In PI SMT: Audit > Enable auditing for security changes\n# Enable auditing for: point creation\u002Fdeletion, data edits, security changes\n```\n\n### Step 3: Implement Secure Data Replication to DMZ\n\nConfigure historian data replication through the DMZ using PI-to-PI interfaces or data diodes to provide IT access to process data without exposing the OT historian.\n\n```yaml\n# Historian DMZ Replication Architecture\n#\n# OT Historian (Level 3) --> Data Diode --> DMZ Historian (Level 3.5) \u003C-- Enterprise (Level 4)\n#\n# Key principle: Enterprise users NEVER connect directly to the OT historian.\n# Data flows unidirectionally from OT to DMZ.\n\narchitecture:\n  ot_historian:\n    location: \"Level 3 - Site Operations\"\n    server: \"PI-OT-01 (10.30.1.50)\"\n    role: \"Primary data collection from OPC servers and PLCs\"\n    access: \"OT operators and engineers only\"\n\n  data_diode:\n    location: \"Between Level 3 and Level 3.5\"\n    device: \"Waterfall Security Unidirectional Gateway\"\n    direction: \"OT -> DMZ (physically enforced one-way)\"\n    protocol: \"PI-to-PI replication protocol\"\n\n  dmz_historian:\n    location: \"Level 3.5 - DMZ\"\n    server: \"PI-DMZ-01 (172.16.1.50)\"\n    role: \"Read-only mirror of OT historian for enterprise access\"\n    access: \"Enterprise users via PI Vision (HTTPS)\"\n    data_delay: \"Near real-time (typically 5-30 second delay)\"\n\n  enterprise_access:\n    method: \"PI Vision web application on DMZ historian\"\n    authentication: \"Windows Integrated Security with MFA\"\n    protocol: \"HTTPS (TLS 1.2+)\"\n    restrictions:\n      - \"Read-only access to process data\"\n      - \"No write-back capability to OT historian\"\n      - \"No direct database queries - PI Vision API only\"\n      - \"Session timeout after 30 minutes of inactivity\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Process Historian | Server that collects, stores, and serves time-series process data from industrial control systems at high frequency (sub-second to seconds) |\n| PI Trust | Legacy OSIsoft PI authentication method based on IP address\u002Fhostname; insecure and should be migrated to Windows Integrated Security |\n| Data Diode | Hardware-enforced unidirectional gateway ensuring historian data flows only from OT to DMZ, preventing reverse access |\n| PI-to-PI Interface | OSIsoft replication mechanism that synchronizes PI data between servers, used for DMZ data mirroring |\n| Audit Trail | Historian feature logging all modifications to historical data with before\u002Fafter values, user identity, and timestamp |\n| Tag Security | Per-tag access control in PI determining which users\u002Fapplications can read or write specific process data points |\n\n## Tools & Systems\n\n- **OSIsoft PI Server**: Industry-leading process historian by AVEVA (formerly OSIsoft) used in 90%+ of large industrial facilities\n- **AVEVA Historian**: Time-series database for process data with SQL-like query interface\n- **Waterfall Security**: Hardware data diode for unidirectional historian replication\n- **PI Vision**: Web-based visualization tool for PI data, deployed in DMZ for enterprise access\n\n## Output Format\n\n```\nHistorian Security Assessment Report\n=====================================\nHistorian: [Type and Version]\nServer: [Hostname\u002FIP]\nNetwork Zone: [Purdue Level]\n\nAUTHENTICATION:\n  PI Trust entries: [N] (should be 0)\n  Default accounts: [enabled\u002Fdisabled]\n  Windows auth: [enabled\u002Fdisabled]\n\nNETWORK EXPOSURE:\n  Open ports: [list]\n  Unnecessary services: [list]\n\nDATA INTEGRITY:\n  Audit trail: [enabled\u002Fdisabled]\n  Backup tested: [date]\n\nDMZ REPLICATION:\n  Method: [PI-to-PI \u002F Data Diode \u002F VPN]\n  Direction: [Unidirectional \u002F Bidirectional]\n```\n",{"hide":57,"name":5,"source":58,"license":15,"description":7,"authorized_lab":53,"origin_frontmatter":59},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: securing-historian-server-in-ot-environment | description: 'This skill covers hardening and securing process historian servers (OSIsoft |   PI, Honeywell PHD, GE Proficy, AVEVA Historian) in OT environments. It addresses |   network placement across Purdue levels, access control for historian interfaces, |   data replication through DMZ using data diodes or PI-to-PI connectors, SQL injection |   prevention in historian queries, and integrity protection of process data used for |   safety a","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-securing-historian-server-in-ot-environment",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-14 03:05:17",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":57},[70,73,76],{"tool":71,"command":72},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-securing-historian-server-in-ot-environment",{"tool":74,"command":75},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-securing-historian-server-in-ot-environment",{"tool":77,"command":78},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-securing-historian-server-in-ot-environment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-securing-historian-server-in-ot-environment\u002FSKILL.md",[],[82,106,130,158,185,204],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":52},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":52},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[113,114,93,115,116,117,118,119,120,121,122,99,123,101,124,125,126,127,128,129],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":139,"publishedAt":52},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[140,141,142,143,144,145,146,147,148,101,149,150,151,152,153,154,155,117,156,157],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":170,"publishedAt":52},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":168,"categoryName":169,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师",[171,103,172,140,93,173,174,175,117,176,177,178,179,180,181,182,183,184,99,101],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":52},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[192,193,194,195,196,197,198,199,200,101,201,124,202,203],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":86,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":220,"publishedAt":52},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[210,213,216,217],{"categoryNo":211,"categoryName":212,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":218,"categoryName":219,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[221,222,223,101,124,224,93,225,118,99,226],"writing","writing skills","new","work","editing","Existing"]