Anti Virus Recommendations

1
Anti Virus Recommendations
2
Anti-Virus Overview

• Anti-Virus software is one element of a
  comprehensive process control security strategy
• Anti-Virus software alone is insufficient
• Anti-Virus software will prevent some viruses not
  all
• For the remainder, AV software will alert you to
  the fact that a virus has already infected the
  system. AV software can help you cure the virus
• Important to have more proactive security
  measures in place (e.g., security patch
  management)
• Out of date Anti-Virus software is only
  marginally better then no anti-virus software at
  all. - Microsoft
• Can be a false sense of security

3
Where to Install Anti-Virus Protections

• TPS
• GUS Nodes
• APP Nodes
• Experion
• Experion Station (Console/Flex) / Experion
  Station TPS
• Experion Server / Experion Server TPS
• ACE Node
• Other
• PHD
• Advanced Control Nodes
• Honeywell and 3rd Party Applicaton Nodes
• Subsystem Interface Nodes (e.g., Tank Gauging)
  that are based on an open systems operating
  system (e.g., Windows)

Install Anti-Virus Software on Every Windows Node
in the Process Control Environment
4
Anti Virus Software Selection

• TPS Qualified Packages
• McAfee
• Norton
• Experion Qualified Packages
• McAfee
• Uniformance PHD Qualified Packages
• McAfee
• Norton
• Other Options
• Honeywell services has an offering to qualify
  third party packages

5
Anti Virus Configuration Recommendation

• Full System Scans Do NOT automatically schedule
  full system scans
• Severe Performance Degradation
• Could impact operators ability to respond to a
  situation
• Could result in execution cycle overruns on an
  Application Control Node
• Perform full system scans only on demand when
  its safe to do so
• Some AV scanners allow you to set max CPU usage
• On Access Scans Enable scanning of files on
  access
• When reading or writing files
• Move infected files to a quarantine directory
• Provide a message to the user that an infected
  file was found.
• Allow user to clean
• Scan boot sectors of all floppies
• Regularly review virus scan reports

6
Anti Virus Configuration Recommendation

• PHD Server
• Anti Virus software be configured to do a full
  scan at system start up
• Perform full system scans on demand when safe
  to do so, otherwise data collection from DCS may
  be impacted with possible loss of data
• Scan, Manual, or Character archive classes
  should be excluded from virus scanning
• System scans of the Oracle database can be highly
  impactive and should be performed as per the
  sites DBA/Oracle guidelines. In general, the DB
  is recommended to be excluded from virus
  scanning.

7
Anti Virus Signature File Deployment

• Update signature files regularly
• Subscribe for AV vendor updates
• Leverage enterprise AV policies and practices
• Test Anti-Virus signature files offline before
  deploying
• Ensure that the signature file doesnt break the
  AV software or cause problems on the PC (e.g.,
  stage on a test system)
• Have a node or two to test signature files
• Automatic Deployment of Signature files
• Stagger automatic deployment to eliminate
  potential for common cause failure
• Example Deploy to three of four nodes per hour
• Follow recommendations of AV supplier for
  distribution server / services
• Stage distribution on test system