SMARTVFD SECURITY GUIDE
31-00140—01
4
APPENDIX 4 - SMARTVFD PC
SECURITY INFORMATION
This section contains additional information on
Installation security Issues for SmartVFD.
Software and operating system
security
This section includes information to installing and
configuring non-SmartVFD software and the operating
system.
Virus protection
Although some modern threats can bypass even the best
antivirus checks, antivirus software is still an essential
element of a comprehensive security strategy.
Installing antivirus software
Install antivirus software on every computer in the
network, including the SmartVFD commissioning
software, SmartVFD, and computers used for web browser
access. After installing antivirus software, check the
Windows Event Logs and ensure no errors are reported. If
the system starts experiencing failures, the inability to
read or write files, the logs show deadlock errors, or the
system shows any other unusual behavior, disable the
antivirus software to see if the failures continue. Note that
some antivirus software may need to be completely
uninstalled in order to be disabled.
Ensure frequent updates to
antivirus signature files
It is important to update antivirus signature files
frequently by subscribing to the updates of your antivirus
software vendor(s) and leveraging enterprise antivirus
policies and practices when available. Since new viruses
are released every day, the system will remain vulnerable
to attack if the signature files are not updated at the same
rate. Where it is not practical to perform updates daily,
monitor reputable web sites that publish information
about new virus attacks so that the system can be isolated
if a specific threat appears.
Receipt of new signature files generally requires Internet
access so that the files can be downloaded from the
antivirus software vendor. If possible, set up servers for the
controlled distribution of antivirus signature files.
Configuring active antivirus
scanning
Adopting an active virus scanning strategy as on-access
scanning provides the best real-time protection for your
system. Configure the virus scanner to run on-demand
scans during regular, scheduled maintenance to catch
any malicious files or programs which may be dormant on
the computer.
Configure both on-access and on-demand scanning to:
• Scan the boot sectors of all disks.
• Move infected files to a quarantine directory and notify
the user that an infected file was found.
Allow the user to clean up the infection.
Regularly review virus scan reports as part of the active
scanning strategy.
Tuning antivirus scanning for
system performance
When formulating your virus scanning strategy you must
take into account the potential impact on critical system
resources. For example, if the SmartVFD commissioning
software is experiencing problems due to low system
resources, you may need to:
• Ensure that antivirus software only runs when system
resources on the computer are adequate to meet
system needs.
• Limit system resources that are used by antivirus
software during scanning.
To find the proper balance between browser workstation
performance and virus protection you need to make
configuration choices such as disabling scanning on
reading of files and changing the default process-based
scanning to per-process scanning.
Do not automatically schedule full system scans, as this
can result in severe degradation of performance, which
could impact the ability of operators to respond to an
incident.
Service packs and security updates
An important part of the overall security strategy is to
ensure that the operating system is kept up-to date with
the latest patches and updates. Before turning the system
over to the customer, ensure that you have:
• Installed the latest supported web browser version.
• Updated Windows to the latest service pack supported
by SmartVFD (this information is available on the
SmartVFD web site or by contacting Technical
Support).
• Configured Windows Update to automatically check for
updates.
For the SmartVFD primary workstation, discuss with the
customer about how to automatically or manually apply
updates. The customer may opt to install them manually
in order to control when the SmartVFD primary
workstation gets rebooted. For client workstation
computers, updates should be installed automatically.
