Shop Floor Insight Security and Compliance Considerations

Overall compliance remains the responsibility of the customer’s implementation, security configuration, and operational processes.

This article attempts to summarize information and answer security and compliance information from the perspective of someone looking to analyze security implications, it is not intended as a comprehensive how-to guide.

Architecture Overview from a Security Perspective

The following information is summarized to help answer typical questions that IT groups and security auditors tend to ask; an overview of the architecture can be found here https://kb.dmsiworks.com/knowledge-base/before-you-begin-with-shop-floor-insight-2/.

From a security perspective Shop Floor Insight has a barcode scanning interface that runs on web pages.  These web pages are served via a Windows service that runs (typically) on an on-premise Windows Server.  The barcode scanners that communicate to the web page are typically via a tethered or Bluetooth “wedge” style of scanner that effectively act as keyboards to the computer (from the terminals perspective a wedge style of scanner is just a keyboard that sends keystrokes).  The communication app (windows service) that serves these web pages must be behind a walled garden and should not be exposed over the public internet.  This same windows service communicates to Business Central via a service account using OData (for most modern Business Central connections and all Microsoft hosted SaaS system), or for older versions of Business Central/NAV it could use SOAP.   These web service connections are for web services configured and exposed within Business Central itself through the installation of a Shop Floor Insight “app” (extension) that runs within the Business Central stack.
For Microsoft SaaS hosted systems the authentication between the windows service and Business Central is typically done with an S2S Entra account, using a Business Central device license.  Details on how to create and configure a Microsoft Entra application entry can be found here: https://kb.dmsiworks.com/knowledge-base/configure-multiple-oauth-service-to-service-connections-in-shop-floor-insight/

More information on the requirements of the windows server that hosts the communication app for Shop Floor Insight can be found here https://kb.dmsiworks.com/knowledge-base/windows-server-requirements/

On-premise or private hosted SaaS providers may have different authentication methods including windows authentication, and web service access key depending on configuration that the reseller does.

The scanning stations themselves are often low performance devices that simply run a Chrome browser that in turn connects to the communication app (windows service), which in turn connects to Business Central. The web pages use javascript to communicate back to the windows service running on the on-premise windows server which in turn then communicate to Business Central.

Production staff that are using Shop Floor Insight’s barcode scanning interface will have a ‘badge’ that they use to unlock the screen.  The Shop Floor Insight badge information is text that is used to identify the operator, does not contain password information, it’s effectively used to help make sure that the operator is recording their barcode scans to the correct time card.  A shop floor operator is not entering the username nor password through the barcode scanning interface, instead they’re scanning their badge which unlocks time entry. A badge is not a credential, and is not a password.

What Business Central license is used?

For most situations most of the time a device license per scanning device.  “Premium” license for the organization must be enabled to use manufacturing (production orders). More information on Business Central licensing requirements for each app can be found here: https://kb.dmsiworks.com/faq-items/what-licenses-do-i-require-to-use-apps-from-insight-works/.

What Data Does Shop Floor Insight Access?

Shop Floor Insight accesses data stored within Microsoft Dynamics 365 Business Central for the purpose of displaying production information, capturing time entry, capturing consumption, output, quality, and other shop floor related production processes.  These can include:

• Shop Floor Time card, time card details, and other shop floor time related entry information.
• Production Order information, including heads and lines
• Production Order Routing Lines
• Production Order Components ( BOM / Bill of Material )
• Tools
• Work Instructions, notes, comments, item information, and related drawings (when those features are used)
• Item information, including pictures
• Basic employee information (badge, id, Business Central user ID, name, shift details).
• Badge information.
• Projects/Jobs, Project Tasks / Job Tasks
• Resource information
• Machine Center information
• Work Center information
• Inventory information
• Warehouse operations
• Consumption information, including historical data
• Output information, including historical output
• Quality Inspection information
• Other potential manufacturing related information that might be exposed through flowfields.
• Extensions and customizations could expose other data depending on their customization specifications.

The application only accesses information necessary to perform the functions granted to the configured Business Central service account.

In Microsoft Hosted SaaS systems the service account is typically an S2s (Service to Service) account that is granted permissions within Business Central.  Permissions within Business Central are typically configured with the “SFI-SERVICE” account, that is typically associated with a Business Central Device license.  Details on permission sets can be found here (https://kb.dmsiworks.com/knowledge-base/configure-special-permissions-in-shop-floor-insight/), detailed information on which Business Central objects are granted permission in those permission sets can be found by navigating to the permission set in Business Central and reviewing the details.  Higher security environments may want to have custom permission sets that further restrict the data based on their specific intended use of the system and their specific security compliance procedures.

In most environments, and especially high security environments, the Microsoft Entra app registration must be hosted on the customers Azure Entra.

The app registration in Entra allows the Shop Floor Insight “Communication App” (a windows service hosted on a server, typically on-premise) permission to communicate with Business Central via that service user.

Does Shop Floor Insight Process Controlled Unclassified Information (CUI)?

Shop Floor Insight does not classify customer data beyond the capabilities of Business Central.

If Business Central contains information designated as Controlled Unclassified Information (CUI), then Shop Floor Insight may process or display that information as part of normal application operation, subject to the permissions assigned within Business Central.

Shop Floor Insight will process, transmit, and display Controlled Unclassified Information (CUI) as it pertains to manufacturing information that is configured to display on the Shop Floor terminals.

Where Is Customer and Production Data Stored?

Shop Floor Insight stores its operational data within the customer’s Business Central database.

The application does not require a separate application database to store production or ERP information.

The web browser that will show the barcode scanning interface can log information in the browser log, cookie information can also be cached, and browser local storage can also be used to help cache information.

The windows service (communications app) that runs on the windows server will also log information about it’s activity, including authentication information.  When configured with a debug level of information it can also include the same information that gets displayed on the screen, including production related information).  The log files use the log4net library, and the log file location can be configured in the IW.TimeCollectionModule.Service.exe.config file in the log4net settings.

Business Central itself can also log telemetry information to Azure Application Insights.  This telemetry information can be sent both a customer specific application insights instance, however Business Central may also route some telemetry information such as errors and callstack information to Insight Work’s telemetry, often with privacy information removed. More information on how Business Central integrates with Azure Application Insights can be found here (https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/telemetry-overview).

Communication with vendor-hosted or third-party cloud services or other external Services

The primary communication path for Shop Floor Insight is with Microsoft Dynamics 365 Business Central through supported Business Central web services.

Additional external communication to other external services are:

• Microsoft Entra ID for authentication (for S2S communication with OAuth, on Microsoft hosted SaaS environments)
• The Business Central endpoint itself (often https://businesscentral.dynamics.com/ or https://api.businesscentral.dynamics.com/ for Microsoft hosted SaaS)
  • This is from within the communication app/windows service that supplies the barcode scanning web pages to the Business Central app via web services.
• Insight Works registration service (currently https://iw-registration-v04.azurewebsites.net, however the numbers may increase over time)
  • This access is done from within Business Central itself
• Insight Works barcode generation web services (currently https://iw-barcodegen-v05-00.azurewebsites.net and https://iw-barcodegen-v04.azurewebsites.net, however the numbers may increase over time).
  • This access is from within Business Central itself.
• Other Microsoft Azure services explicitly configured by the customer
  • Common examples could be Power Automate integration, or potentially SharePoint integration.

No external vendor-hosted services are required for standard manufacturing data processing beyond the customer’s Business Central deployment and any optional Microsoft services they choose to enable with the exception of the registration service, which is performed periodically or manually to ensure the license is accurate and configured correctly.

Network Connectivity

A typical deployment requires:

• Barcode scanners connected to scanning stations and mobile devices communicating only with the Shop Floor Insight barcode scanning web pages over the customer’s internal network or approved secure network.  The communication app must be in a walled garden.  The scanning stations themselves for Shop Floor Insight typically only need to have access to the windows service that provides the web pages via the communication app, however exceptions could occur if the customer is using features such as record links to display links to information on a CMMS such as SharePoint.
• Shop Floor Insight browser web app running in the browser connecting to the communication app (windows app).
• The Shop Floor Insight communication app (windows service running in an on-premise windows service) communicating with Business Central over HTTPS using supported Business Central web services, where the Shop Floor Insight Business Central “app” has been installed and configured.

Recommended Deployment Practices for Higher Security Environments

General guidelines:

• Ensure the windows server that hosts the windows service used to connect to Business Central exposes HTTP and HTTPS data selectively to the Shop Floor as per the customers network requirements. Often the production facility and operator stations within the production facility will have their own policies and potentially own subnets.
• Ensure the windows service is in a walled garden.
• Use Microsoft Entra ID authentication when possible and ensure the Entra app registration is created on the customer’s tenant. Make sure the Entra ID is unique to the specific purpose of Shop Floor Insight, and do not re-use it for other applications.   Some customers may want to make one Entra ID per scanning station allowing more granular permission assignment within Business Central.
• Grant the Shop Floor Insight service account(s) only the minimum Business Central permissions required, using the SFI-SERVICE permission set as guidelines, but they could be further restricted depending on the customer specific restrictions that are required.
• Restrict network access using firewalls, VPNs, whitelists, or private networks as required by the organization’s security architecture. The communications app (the windows service that serves web pages to the scanning station) should never be exposed to the internet, it should be in a walled garden.
• Enable Business Central auditing and logging to support security monitoring and compliance reporting.
• Follow Microsoft’s published guidance for securing Business Central, Azure Government, and GCC High environments.