Antivirus best practices for AVEVA Enterprise SCADA systems

When configuring any antivirus product for use on AVEVA Enterprise SCADA systems, there are a number of best practices which should always be followed:

Understand the features employed by the specific antivirus product:

• Reviewing and understanding the features enabled in the antivirus suite helps identify features and configuration aspects that will require additional testing or modification. Antivirus vendors continuously adapt protection strategies by adding or modifying features to improve effectiveness and efficiency.

• Default installation settings must be reviewed as well as configuration guidance documents provided by the antivirus vendor. Antivirus vendors typically provide best practice documentation to help achieve a good balance of security and reliability/performance.

• Disable any features that will not be used. They can impose extra resource requirements and in extreme cases will impact system performance.

Determine the effects of disabling Internet access for the antivirus application:

• Internet access is usually assumed on systems running antivirus applications. This provides antivirus definition updates, and many antivirus applications now have the ability to proactively verify suspicious files by contacting globally accessible servers maintained/updated in real time by the antivirus vendor.

• Globally accessible servers can provide access to the most up-to-date information available providing more accurate detections. It may require additional network bandwidth and must comply with the customer’s connectivity restrictions. Some network architectures may allow indirect access through corporate antivirus management systems.

  Note: It is not acceptable to assume the SCADA system, servers, or workstations will have any Internet access when deployed on site. Careful planning is necessary to determine what level of connectivity (if any) will be allowed, and to which computers.

Updates – maintain current definitions:

• The latest definition updates should be tested on a non-critical test system(s) prior to applying them on critical servers/workstations. If updates are automated, configure a minimum of 24-48 hour delay between the test system and critical hosts. Do not schedule updates for Hot/Standby servers simultaneously. Definition updates are disk and network input/output (I/O) intensive operations. Specify at least 1-hour separation through schedules for Hot/Standby (for example, 9:15 AM/10:15 AM). Randomization settings may also help (1-2 hour window between clients).

• Configure antivirus engine updates to prompt first if application restart is necessary. Unexpected restarts may cause system instabilities.

• Where possible, configure settings to minimize performance impact caused by scheduled update and scan tasks. Most antivirus applications include configurable settings to limit resource usage required for scanning capabilities.

• It is important to understand the update process. Definition updates commonly invoke some form of scan against the system after the update completes. AVEVA recommends disabling the post-update scan due to the performance impact it can create.

Restrict local user access to configuration

• Centralized control or Administrator-restricted access is preferred. This ensures settings are consistent across all hosts but will require planning to group hosts according to required settings (that is, servers, workstations, and non-SCADA hosts may require different settings).

• For non-centralized control, enable password restrictions on each local installation for all configurable settings.

Monitor the system under heavy load for performance issues

• After the antivirus software is installed, monitor performance during scheduled scanning and update tasks. Adjust schedules as necessary if there is any conflict with other scheduled tasks (for example, database backups, top/bottom of period calculations).

• Identify busy or slow applications. For example, scanning exclusions may need to be adjusted to compensate for third-party product logs or non-baseline components.

• Additional third-party applications can be installed over the lifetime of the system and these applications may also impact the system performance. Remember to always review performance after the installation of additional third-party software (that is, backup application).