How To: Follow Antivirus and Patch Management Best Practices on a SecureAuth Appliance

Version Affected: All

 

Overview

SecureAuth appliances play a central role in an organization's security infrastructure, so ongoing maintenance of these appliances is an important part of overall security posture. This article covers SecureAuth's recommended best practices for two areas of on-premises appliance maintenance: Windows Server patch management and antivirus/malware protection. The antivirus guidance also covers servers that run the SecureAuth Connector. Contact your Sales Engineer or SecureAuth Support with any questions about these recommendations.

• See Windows Server Patch Management Best Practices for guidance on when and how to apply Microsoft security updates.
• See Antivirus and Malware Best Practices for guidance on antivirus software and scan exclusions.
   

In this article

• Windows Server Patch Management Best Practices
• Antivirus and Malware Best Practices

Windows Server Patch Management Best Practices

Microsoft releases security updates and patches for Windows on "Patch Tuesday," the second Tuesday of each month (North America time). SecureAuth tests the latest Microsoft patches within 24 hours of their Patch Tuesday release. If an issue is found during that testing, a notice is posted to the SecureAuth Service Status page.

1. Develop a patch process that updates the appliance once a month, preferably 48 hours after Patch Tuesday. This gives SecureAuth's engineering team time to test the new updates for compatibility issues first.
2. Check the SecureAuth Service Status page for any compatibility notices for that month's patches before applying them.
3. Do not configure Windows Update to Download and install updates automatically on a SecureAuth appliance. Automatic installation can reboot the appliance at random times, introducing unexpected downtime. If an automated patching solution is needed, use a third-party patch management solution instead, scheduled for a controlled maintenance window.

Antivirus and Malware Best Practices

SecureAuth does not have access to a customer's SecureAuth appliances, so maintaining the appliances' antivirus software is the customer's responsibility.

1. Install your organization's standard antivirus solution on the SecureAuth appliance as soon as possible after deployment, so the solution's updates can be managed and monitored under your organization's normal IT security policies.
2. If you are on an older appliance that shipped with the OEM VIPRE Antivirus trial, either replace it with your organization's standard antivirus solution (recommended), or renew the VIPRE license directly with the publisher at vipreantivirus.com/renew if you prefer to keep using it. Never run VIPRE alongside another antivirus product on the same appliance — running two antivirus products at once causes performance issues.
3. If antivirus scanning noticeably degrades the appliance's performance, exclude the D:\SecureAuth directory from scans.
4. On a server that runs the SecureAuth Connector, exclude the Connector folder, C:\Program Files\SecureAuth Corporation\SecureAuth Connector, from both scheduled scans and on-access scans. Antivirus software that holds the Connector's configuration file open while the Connector is saving a datastore change can stop the change from being saved.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.