McAfee ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES... Manuel utilisateur

1



McAfee®EndpointEncryption

EnterpriseBestPracticesGuide



November2009

2



Nopartofthispublicationmaybereproduced,transmitted,transcribed,storedinaretrievalsystem,or

translatedintoanylanguageinanyformorbyanymeanswithoutthewrittenpermissionofMcAfee,Inc.,or

itssuppliersoraffiliatecompanies.

3



Contents



INTRODUCTION5

PURPOSEOFTHISGUIDE5

RELEVANTPRODUCTS5

SOLUTIONARCHITECTURE6

DESIGNPHILOSOPHY6

SERVERCONFIGURATION7

BASICSERVERREQUIREMENTS7

RECOMMENDEDSERVERHARDWARE7

SERVERREDUNDANCY8

HOTBACKUPDATABASES8

CLUSTERING8

LOADBALANCING8

SERVERANDOBJECTDIRECTORYOPTIMISATION9

ENDPOINTTOSERVERCOMMUNICATION‐NETWORKLOADESTIMATION9

ESTIMATINGTHESIZEOFTHEOBJECTDIRECTORY9

TYPICALGROWTHOF5000USER/MACHINEOBJECTDIRECTORY10

VIRTUALSERVERS10

GLOBALDEPLOYMENTS11

OPTIMISATIONACTIONS11

OPTIMISATIONACTIONSOVERVIEW12

NAMEINDEXING(DBCFG.INI)13

WARNINGS13

DBCFG.INI13

GROUPSIZES14

TCP/IPKEEPALIVETIMEREDUCTION15

LASTACCESSTIMESTAMP(NTFSDISABLELASTACCESSUPDATE)15

WINDOWSSERVERASAFILESERVER15

OBJECTDIRECTORYBACKUPTOOLSETUP16

ANTI‐VIRUSSCANNER16

WINDOWSPERFORMANCE17

MANAGINGAUDITS17

FILECACHEONRAIDHARDDRIVECONTROLLER17

CONNECTIONSPEED17

OBJECTDIRECTORYPHYSICALLOCATION18

OBJECTDIRECTORYACCESS18

SEARCHINGFOROBJECTS18

CLEARINGDELETEDOBJECTS18

SBSERVER.INI18

4



OBJECTDIRECTORYMAINTENANCE19

MAINTENANCEINTRODUCTION19

ENVIRONMENT19

AUDITMAINTENANCE19

EXTRACTINGANDCLEARINGAUDITFROMTHEDATABASE19

CLEARINGTHEAUDIT19

DELETEDITEMSCLEANUP20

CHECKINGFORDATABASECORRUPTION20

WHYDOESTHEDATABASEGETCORRUPTED?20

ORPHANEDOBJECTS21

RESTORECOMMANDS21

CLEANUPCOMMANDS21

DUMPMACHINEDESCRIPTION22

USEROBJECTS‐GENERALPERFORMANCETIPS23

GENERALADVICE24

DEFAULTPRODUCTSETTINGS(FORMAXIMUMCOMPATIBILITY).24

THINGSTOAVOID25

5



Introduction



PurposeofthisGuide

WhenplanningalargerolloutofEndpointEncryptionv5,itisimportanttounderstandtheprocessofscaling

thebackendObjectDirectoryandtheassociatedEndpointEncryptionCommunicationsServerprocessesto

meetrequirements.ThisguideoutlinestheconsiderationsaroundEndpointEncryption5implementationand

suggestspossiblesolutions.



Theguidealsodiscussesconsiderationsonoptimizationandmaintenancebeforeandafteritsimplementation.



Italsoassumesthereaderhassomeknowledgeofenterprisesystems(configurationandmanagement)and

someknowledgeofEndpointEncryptioncomponents(EndpointEncryptionManagerv5.x,EndpointEncryption

forPCv5.xandotherMcAfeeEndpointEncryptioncomponents)thatwillbenefitfromgoodpracticeand

ObjectDirectoryoptimization(seebelow).



ThisguideisacollationoftheprofessionalopinionsofEndpointEncryptioncertifiedengineers,andnotthe

exactscience.Becauseeveryimplementationisunique,itiscriticaltounderstandboththeproductandthe

environmentinwhichitisbeingused,beforearrivingatanydecisiononimplementationstrategy.

Calculationsandfiguresinthisguidearebasedonfieldevidenceandnottheoreticalsystemtestingandare

our“bestadvice”atthetimeofwriting.



WerecommendyoutodiscussyourrequirementswithyourMcAfeerepresentative.McAfeehaswide

experienceindeployingrealworldimplementations.



Thankstoalltheauthorswhohavecontributedtowardsthisguide.



RelevantProducts

Thisguidediscussesconfigurationandmaintenanceofthebackendservercomponents,EndpointEncryption

Managerv5.xanditsObjectDirectorytogether,whichmanageandgovernthefollowingversion5client

componentsofEndpointEncryption:

•EndpointEncryptionforPC(EEPC)

•EndpointEncryptionforFilesandFolders(EEFF)

•EndpointEncryptionforMobile(EEMO)

•EndpointEncryptionforRemovableMedia(EERM)



Othercomponentsthatmaybenefitindirectly:

•EndpointEncryptionScriptingTool

•EndpointEncryptionReportingTool

•EndpointEncryptionObjectDirectoryBackup



However,thevastmajorityoftheguideisconcernedwithEndpointEncryptionforPCasoptimizationsof

theManagerandObjectDirectorywillmakethemostimpactonthiscomponent.



6



SolutionArchitecture



DesignPhilosophy

McAfeeEndpointEncryptionisaclient/serverapplicationdesignedtobeimplementedwithasimple,single

serverarchitecture.ThissingleserverhostsanencrypteddatabaseknownastheObjectDirectory,andruns

servicestoallowconnectionstothedatabasefromboththeEncryptedEndpointsandtheManagementCenter

applications.Communicationwiththedatabaseoccursinasecureway(detaileddescriptionsareprovidedin

theManagementCenterAdministrationGuide).Thissingleservercanhostallcomponentsofthe

ManagementCenter,eveninenterpriseenvironments.



Whileitismostcommontoimplementtheproductwithasingleserver,therearealsootheroptions.The

componentsaremodularandareinstalledinadistributedway.Forexample,theWebHelpdeskcomponent

canbeinstalledonadedicatedwebserverwhiletherestofthecomponentsareonaseparateEndpoint

EncryptionServer.However,themajorityofourimplementationsaredonewithasingleserverbecausethisis

usuallythebestapproach.



NOTE:Thisguidehasallrecommendations,assumingasingleserverapproach.



Whenreadingthefollowingsections‐eventhoughourrecommendationmaybetouseasingleserverwith

DirectAttachedStorage(DAS),avirtualserverwithNASbasedstorageisusableandwillhavesome

advantagesinyourenvironmentforsmallnumbersofendpointsorwithlimitedsynceventsandlimitedusers

perclient.However,weadviseagainstusingsuchimplementationsandrecommendyoudiscussyour

requirementswithMcAfeebeforeimplementation.



IftheperformanceoftheMcAfeesolutionisbelowtheacceptablelimits,migratingtowardsour

recommendationsissuretolendimprovement.



7



ServerConfiguration



BasicServerRequirements

TheEndpointEncryptionCommunicationsServerprocessrunsunderMicrosoftWindows2000/2003.

CurrentlysomecustomersreportthatitworkswellunderWindows2008,howeverMcAfeehasnotofficially

certifiedthis.PleaseseetheMcAfeeKnowledgeBasearticleKB53698forcurrentinformationonsupported

environments.



Theperformancerequireddependsprimarilyuponthenumberofconcurrentconnectionsanenterprisecan

experienceandthenumberofconcurrentobjectcreationevents.Realworldimplementationssuggestthe

followingminimumandrecommendedconfigurations.



Notetheterm“ObjectDirectory”usedthroughoutthisguidereferstothedatabaseorstoreforusers,

endpointsandothersettings,andfilesforEndpointEncryptionmanagement.



RecommendedServerHardware



20‐2000users/systems



Minimumsingleserverconfiguration



•DedicatedServer

•2GHzDualcoreprocessor

•2GBRam

•4GBfreeharddisk,RAID1

•100MbNetwork



VirtualorSharedServercanbeusedforlownumbers.

PleaseseeVirtualServersectioninthisguide.Virtual

hardwarehastobeofhigherspecificationif

resourcesareshared.SeePage11.

2000‐5000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•2.4GHz2Dualor1Quadcoreprocessor

•4GBRam

•4GBfreeharddisk,RAID5

•100MbNetwork



5000‐50,000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•3GHz2Dual/1Quadcoreprocessor

•4GBRAM

•RAID510KRPMDirect‐attachedStorage,100GB

•Gigabitor3x100MbNetwork

50,000‐150,000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•3.0GHzorhigher2Quad/4Dualcore(8cores).

•6GBRAM

•RAID5Direct‐attachedStorage.15KRPM.250GB

•Gigabitor4x100MbNetwork



MentionedRAIDreferstohardwareRAID,notsoftware.EnablecachingonRAIDifpossible,butensure

suitableUPSpowerisavailable.

Migratinganenvironmentbetweenhardwareplatformsissimplesoitispossibletostartwithaminimal

configurationandlaterextendittoahigherconfigurationinaccordancewithperformancemonitoringand

capacityplanning.

NOTE:Thesemayvarydependingonotherconfigurationsettings.



8



ServerRedundancy

Itisriskytohaveasinglephysicalserverforyourenterprise,evenifyoutakeregularbackups.Werecommend

youtotakestepstoexpediterecoveryfromanoutageinaccordancewithanestablishedBusinessContinuity

andDisasterRecovery(BCDR)plan.



HotBackupDatabases

IncreasetheredundancyofthesystembyreplicatingtheEndpointEncryptionObjectDirectorytoasecond



physicalserver.Adedicatedreplicationtool“ObjectDirectoryBackup”whichisoptimizedtofollowthe

changelogofanEndpointEncryptionv5ObjectDirectoryissuppliedwiththeproductsuite.



Inthiscasesetuparesilientsystemusingtwophysicalboxes,bothhostingEndpointEncryptionServers–one

hostingthemasterODBandtheotherhavingahotbackup.Incasethemasterserverfails,theEndpoint

EncryptionServeronthesecondbackupboxcanberestartedin“master”mode.Thenrebuildorreplacethe

affectedmachineandcreateanewmaster.



TheODBBackuputilitycanalsobeusedtomakeregularbackupsoftheODB,givingfurtherrecoveryoptions

incaseofadisaster.Thismethodhowever,requiresmanualinteractiontostartthefailover.



AHotBackupdocumentdiscussingthisscenarioisavailable.



Clustering

Fullyautomatedfailoversforapplicationsusuallyemployaclusterserverenvironment.AlthoughtheMcAfee

EndpointEncryptionObjectDirectoryandManagercanrunonacluster,werecommendagainstusing‘shared’

resourceswherepossible.AsperMcAfeeKB53698,WindowsClusterenvironmenthasnotbeenfullytestedat

thistimeinengineering.



LoadBalancing

GiventhebestconfigurationisusuallyasinglehighperformanceserverwithDASthentheleastoptimalwayto

performclusteringistoputtheObjectDirectoryonanetworkshare(NAS)andtheninstalltheManagement

Centerontwoserverswhichaccessthesharesimultaneously.



NOTE:Thelatterwillfunction,butitwillbesignificantlydetrimentaltoserverperformance.



Youshouldnotethatifyouusespecialloadbalancingswitchestosplitnetworkload,youshouldsetthemto

alloweachclientactiveconnectiontooccurwiththesameswitchthroughoutthesyncevent(andnot

split/distributeeachpacketduringasinglesync).



Makingremoteconnectionstothedatabaseisslowerthanlocalconnections,sothisdesignisoftentooslow

toworkeffectively.



IfDASisnotusedandthereareissuessuchasperformance,objectcorruption(especiallyasobjectnumbersin

theMcAfeeEndpointEncryptionObjectDirectoryincrease)McAfeesupportwillrecommendmovingtoDAS

andhighperformancededicatedserver.



IfaSANistheonlyoptionavailable,pleasenoteSANarrayscanprioritizetheconnectionstothephysicalbox

inwhatisknownasTierlevels.Tier1isthehighestpriority,Tier3isthelowest.McAfeeEndpointEncryption

needsoptimaldiskaccesssowouldneedTier1prioritywithdedicatedLUNStoprovidethehighestspeed

connection.Thisisnecessaryforfullandpromptservicesynchronizationrequestsandadministration.This

avoidscorrupteddatabases,objects,clientsandslowadministrationperformance.RunningonSANisnot

recommended,butifitmustbedone,thentheconnectionmustbeTier1.

9



ServerandObjectDirectoryOptimisation



EndpointtoServerCommunication‐NetworkLoadEstimation

EndpointEncryptionnetworktrafficistheeasiesttoconsiderintermsof“synchronizationevents”.Eachtimea

systemstartsittriestoconnecttoadesignatedEEPCdatabasecommunicationserverandupdateitsprofile.It

mayalso(dependinguponconfiguration)trytoconnectperiodically.Inlargedeployments,thefirststepin

estimatingthenetworkloadcausedbyEndpointEncryptionistoestimatethepeaknumberofconcurrent

synchronizationevents.Thisisrelatedtotheuserworkingpractices.Forexample,if2000usersswitchtheir

systemsonat9A.M,the“9A.M.”effectcanbedilutedbysettingoptionalbootsyncdelayandoffsettimesto

spreadtheloadacross,forexampleonehour.



Oncepeakflowisestimated,doubleittogivesomesafety,thenworkonanestimateof7KBperuserpersync

(thisisaveryhighapproximationbasedontotalupdateoftheusereverytwosyncevents).AtypicalWindows

server,inourexperience,canaccept100connectionspersecondperserver,withadefaultmaximumwait

timeof30secondsforpendingconnections.



ThemaximumcapabilityofasingleCommunicationsServer,takingthecapacityofthenetworktobe100

Mbps(1millionbitspersecond)is20synchronizationsofdataasecond.AWindowsserverOScanestablish

connectionsaboutevery10ms,andcanhandleunlimitedconnections(althougheventuallyitwillrunoutof

clockcyclesandmemory).



Onceestablished,aconnectioncantakeanunlimitedamountoftimetofinish,thoughthedefaulttimeouton

establishingaconnectionis30seconds.Iftherearemorethan100attemptedconnectionspersecond,the

queuecannotbelongerthan3,000connections.



ThedefaultsettingsoftheCommunicationServerlimitthequeueto200entries(abalancebetweentaking

connectionsandprocessingconnections).Afterthatpoint,theconnectionsarerefused.Thisisareasonable

“realworld”setting.Aslongastheprofileofthesystemissettoretrytheconnectionafter,forexample,four

hours,thereisnolossoffunction.Settingthequeuelengthtomorethan1500canresultinpoorperformance

fromtheserverasittriestoservicesomanyconnections.



Inrealtermswecansaythatasageneralmaximumcase,theEndpointEncryptionServerislimitedto100

connectionspersecond,withasustainedload.Saturationinourexperienceisreachedwhenthereismore

than1400synchronizationeventsperminute(1200acceptedandprocessed,200queued).Achievingthisload

intherealworldrequiresamassive,badlyplannedandconfiguredpopulationofsystems.Currentcustomers

with40000+installationsrarelyexceedthe200currentconnectionpoints,mostofwhichareadministrators

performingconfigurationchanges.



TheoperatingsystemordiskcontrollercachesmostofEndpointEncryption’sdatabase,soeventuallythe

commonfileswillbesuppliedfromRAMratherthanacrosstheconnectiontothedatabasehost,or,fromdisk.

Usingthecompressedversionofthedatabasecanimproveperformancebyasmallamount,however,itis

usefulwhencorporatebackupsoftwarehasdifficultyarchivingthedatabase.



ThisroughcalculationtellsusthatweneedoneEndpointEncryptionServerper1400eventsaminute

minimum;however,experiencingthesysteminactionwillgivetruefeedback.Itisoftenthecasethatmodern

hardwareoutperformspaperestimations.



EstimatingtheSizeoftheObjectDirectory

ThebasesizeofanEndpointEncryption5.xObjectDirectoryisaround150MB.Becauseyouaddnewusers

andsystems,theODBgrowsaccordingly.Italsogrowsinsizeassystemssynchronizeanduploadaudit

information.



10



AnObjectDirectorywith5000usersand5000systemscouldbeexpectedtogrowasfollows:



TypicalGrowthof5000user/machineObjectDirectory 

DayDataSize ApproxDiskSpaceUsed

183MB143MB

589MB143MB

20204MB403MB

50396MB745MB

100747MB1050 MB

3652455MB 3900 MB



Usersandsystemsarethemostprevalentobjecttypesinalargedatabase.Typically,oncreation,thesetypes

ofobjectstake4000bytes.Aday’sauditaddsaroundanadditional700bytesofdataperobject.Although

thesefiguresareverysmall,becauseofwastedspaceontheObjectDirectoryServer’sharddisk,theactual

disksizeoccupiedbytheObjectDirectorycanbe4xormorelarger.



VirtualServers

McAfeeEndpointEncryptionManagercanberunfromaVirtualServerforlowernumbersofEndpoints.

McAfeerecommendsphysicallydedicatedhardwareforhighnumbersofEndpoints.



Performanceofvirtualsystemsisdependentonmanyfactorsthatcansignificantlyaffecttheoverallproduct

performancewhencomparedtophysicallydedicatedhardware.High‐speedaccesstothedatawithinthe

ObjectDirectoryisrequiredandmustbecarefullyconsideredandevaluatedinaVirtualServerEnvironment.



CurrenttestingofVirtualServersrunningEEPCoperateswithinasetnumbersofdatabaseobjects.McAfee’s

experienceshowsthatperformancesissuearisingfromtheuseofVirtualServersisaresultof:



•Lackofresourcesdedicatedtothevirtualserver.

•Dynamicallyassignedresourcestothevirtualserverwhichstarvesitofthenecessaryperformance

duringpeakperiods.

•Sloworreduceddiskaccess,resultinginasloweraccesstotheObjectDirectory.



McAfeesupportstheuseofVirtualServersrunningtheadministrativefunctionalityofEEPCprovidedthe

appropriateresourcesarefullydedicatedtotheVirtualServeratalltimes.Ifperformanceproblemsare

experienced,theresourcesavailabletotheVirtualServerneedtobeincreased.Pleaserefertothe

recommendedserverspecificationsastheminimumresourcesfullyassignedtotheVirtualServeratalltimes.

Theseresourcesapplytothespecificimage,andnottotheoverallresourcesofthehost.

CustomersneedtofollowtherecommendationsofMcAfeeSupportandraiseasupportticketfortheissues

relatedtoaVirtualServer.Theserecommendationscanvaryfromtweakingofserverandmachinesettingsas

specifiedinthisguideallthewaytomovingtheEEPCmanagementenvironmenttophysicalhardwareasalast

resortifnecessary.



ByengagingMcAfeeprofessionalservices,theywillassistyouinadequatelyscopingyourdeployment

hardwareneedsandcanrecommendabestpracticesapproach.



AsthetechnologyisevolvingandbetterVMfarmsarecomingonline,virtualhardwaresupportforgreater

numbersshouldbepossible.PleaseseeMcAfeeKB65747formoreinformation.



Thiswillbereviewedforthenextmajorrelease(version6.0ePOintegrated).



Ce manuel convient aux modèles suivants

Table des matières

Autres manuels McAfee Logiciel

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - Manuel utilisateur

McAfee

McAfee VSF09EMB1RAA - VirusScan Plus 2009 Manuel utilisateur

McAfee

McAfee DTP-1650-MGRA - Network DLP Manager 1650... Manuel utilisateur

McAfee

McAfee TEECDE-AA-AA - Total Protection For Endpoint Manuel utilisateur

McAfee

McAfee INTERNET SECURITY 2010 Manuel utilisateur

McAfee

McAfee VCLCDE-AA-DA - VirusScan Command Line Scanner... Manuel utilisateur

McAfee

McAfee TOTAL PROTECTION 2009 Manuel utilisateur

McAfee

McAfee QUICKCLEAN 1.0 Manuel utilisateur

McAfee

McAfee MFN10EMB3RAA - Family Protection - PC Manuel utilisateur

McAfee

McAfee Agent 4.0 Mode d’emploi

McAfee

McAfee UTILITIES 4.0 Manuel utilisateur

McAfee

McAfee VIRUSSCAN 4.5 - Manuel de service

McAfee

McAfee GSSCDE-AA-DA - GroupShield Security Suite Manuel utilisateur

McAfee

McAfee VIRUSSCAN 5.1 Manuel de service

McAfee

McAfee NAPCKE-AB-AA - VirusScan For NetApp Manuel utilisateur

McAfee

McAfee DFFCDE-AA-DA - Endpoint Encryption For Files Manuel utilisateur

McAfee

McAfee SAV85E - Active VirusScan - PC Manuel du propriétaire

McAfee

McAfee VSMCDE-AA-AA - VirusScan Mobile - PC Manuel utilisateur

McAfee

McAfee EBCACE-AA-HA - E-Business Client - PC Manuel utilisateur

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 3 - S... Mode d’emploi

McAfee

McAfee OFFICE 3.1 Manuel utilisateur

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 PATCH 5 - S... Mode d’emploi

McAfee

McAfee INTERNET GUARD DOG 3.0 Manuel utilisateur

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 2 - S... Mode d’emploi

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur