General antivirus configuration for all systems

File quarantine and clean actions should never occur automatically. All antivirus applications must be configured to notify an Administrator when malicious activity is detected. No immediate repair or quarantine response can be allowed. If a critical system or SCADA application file is mistakenly detected with this configuration, the file could be corrupted or removed, introducing immediate instability. Notification allows an Administrator to intervene and determine if a file is a legitimate threat or a false positive.

Disable file system scanning for any common active folders/files. This applies to both active scanning and scheduled scan tasks. These files and directories will encounter frequent activity. In some situations, the antivirus scanning may lock the files, making them inaccessible to SCADA applications. While the applications will generally recover, performance can be impacted significantly and, in extreme cases, process failures may result.

1. Disable file system scanning of directories containing Microsoft SQL Server, OSISoft PI, Skelta or other databases. The frequent access requirements of these structures may introduce locking contention similar to that discussed in the previous point, relating to shared memory. Special considerations may exist for databases that exist on clustered storage and Storage Area Networks (SANs). For example, some antivirus applications will not accept drive letters for network storage exclusions.

2. Custom applications and third-party tools will require additional file or folder exclusions. Work with your project team to identify all applications that make use of directories or files actively during system operation.

Review scheduled tasks and adjust as necessary for an optimal schedule. Antivirus software will typically update itself with new definitions once daily by default. Care must be taken to ensure that this processing- and resource-intensive process does not occur during a period of peak operations.

1. It is important to consider any other scheduled daily tasks that may be impacted, including system backups, SCADA archive operations, and shift changes.

2. Ensure schedules on Hot/Standby servers are at least 60 minutes apart. It is critical that Hot and Standby servers are not updated simultaneously, as it can create a single point of failure by making both servers too busy to respond.

3. Another way to mitigate server performance issues is to configure settings in the antivirus software to constrain scheduled scans and updates to minimize the impact on server performance. Each antivirus suite has different settings capable of minimizing the performance impact of scheduled scans or updates.

The following aspects should also be considered for antivirus updates:

1. Perform phased update rollouts. Do not deploy a new virus definition file or engine update to all SCADA hosts simultaneously. In rare cases, corrupt or incompletely tested definition files have been published resulting in instability or loss of access to the systems to which they are deployed. The risk is relatively low, but it is generally good practice to phase in the updates over a period of 2-3 days. Another important aspect is that there are usually roll-back strategies available from the vendor within a short timeframe. Still, it is usually best to err on the side of caution and build the compensating mechanisms into the update process.

2. At no time should an update be deployed to both partners in a Hot/Standby pair simultaneously. Since system performance can be significantly impacted during antivirus updates, AVEVA recommends splitting operational servers into a minimum of two groups (Production 1/ Production 2).

3. Antivirus definition or engine updates should never be deployed to all HMI workstations in an installation simultaneously. Doing so is potentially just as risky as applying updates to all servers. Separate workstations into different groups (Production 1/ Production 2).

4. Review all available update packages. There may be many types of updates, but the most important are antivirus definition and antivirus engine updates. Engine updates are typically much less frequent. To minimize network bandwidth usage, only update components that are running on the system.

Review all other third-party applications deployed to the system. Look for I/O intensive applications and consult antivirus vendor documentation/support forums for specific guidance. In many cases, the antivirus vendor includes configuration settings that can improve the performance of many third-party IT tools such as backup/recovery and system maintenance.

For SCADA systems, some general exclusion requirements are listed in the next section for AVEVA Enterprise SCADA products. Review specific guidelines provided by the antivirus applications vendor. Most antivirus vendors support a method to minimize exclusions to only the files necessary, such as the use of wildcard characters in exclusion statements (for example, ?, #).

Some features of the AVEVA Enterprise SCADA product suite may include third-party software. These dependent third-party applications and services may require additional antivirus configuration and specific exclusions. Refer to the third-party user documentation for specific information.