Update Deployment with antivirus updates

The most secure mechanism for deploying updates to antivirus applications, both for engine updates and virus definitions is to manually transfer information downloaded via the corporate network to a deployment server on the SCADA network. This provides the maximum possible level of security and does not require opening any firewall ports. It does require a resource assigned to download and manage file transfers at defined intervals.

If the system has corporate network connectivity and the necessary firewall port(s) allowed, a deployment server within the SCADA network should be configured to pull updates from a server on the corporate network. At no time should a deployment or management server on the SCADA network be allowed to directly access the Internet to obtain updates. Whenever possible, the updates to the management server should originate through a monitored Internet proxy or from an enterprise antivirus management server (if available). Antivirus clients should update only from the management server.