McAfee ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES... Manuel utilisateur

1



McAfee®EndpointEncryption

EnterpriseBestPracticesGuide



November2009

2



Nopartofthispublicationmaybereproduced,transmitted,transcribed,storedinaretrievalsystem,or

translatedintoanylanguageinanyformorbyanymeanswithoutthewrittenpermissionofMcAfee,Inc.,or

itssuppliersoraffiliatecompanies.

3



Contents



INTRODUCTION5

PURPOSEOFTHISGUIDE5

RELEVANTPRODUCTS5

SOLUTIONARCHITECTURE6

DESIGNPHILOSOPHY6

SERVERCONFIGURATION7

BASICSERVERREQUIREMENTS7

RECOMMENDEDSERVERHARDWARE7

SERVERREDUNDANCY8

HOTBACKUPDATABASES8

CLUSTERING8

LOADBALANCING8

SERVERANDOBJECTDIRECTORYOPTIMISATION9

ENDPOINTTOSERVERCOMMUNICATION‐NETWORKLOADESTIMATION9

ESTIMATINGTHESIZEOFTHEOBJECTDIRECTORY9

TYPICALGROWTHOF5000USER/MACHINEOBJECTDIRECTORY10

VIRTUALSERVERS10

GLOBALDEPLOYMENTS11

OPTIMISATIONACTIONS11

OPTIMISATIONACTIONSOVERVIEW12

NAMEINDEXING(DBCFG.INI)13

WARNINGS13

DBCFG.INI13

GROUPSIZES14

TCP/IPKEEPALIVETIMEREDUCTION15

LASTACCESSTIMESTAMP(NTFSDISABLELASTACCESSUPDATE)15

WINDOWSSERVERASAFILESERVER15

OBJECTDIRECTORYBACKUPTOOLSETUP16

ANTI‐VIRUSSCANNER16

WINDOWSPERFORMANCE17

MANAGINGAUDITS17

FILECACHEONRAIDHARDDRIVECONTROLLER17

CONNECTIONSPEED17

OBJECTDIRECTORYPHYSICALLOCATION18

OBJECTDIRECTORYACCESS18

SEARCHINGFOROBJECTS18

CLEARINGDELETEDOBJECTS18

SBSERVER.INI18

4



OBJECTDIRECTORYMAINTENANCE19

MAINTENANCEINTRODUCTION19

ENVIRONMENT19

AUDITMAINTENANCE19

EXTRACTINGANDCLEARINGAUDITFROMTHEDATABASE19

CLEARINGTHEAUDIT19

DELETEDITEMSCLEANUP20

CHECKINGFORDATABASECORRUPTION20

WHYDOESTHEDATABASEGETCORRUPTED?20

ORPHANEDOBJECTS21

RESTORECOMMANDS21

CLEANUPCOMMANDS21

DUMPMACHINEDESCRIPTION22

USEROBJECTS‐GENERALPERFORMANCETIPS23

GENERALADVICE24

DEFAULTPRODUCTSETTINGS(FORMAXIMUMCOMPATIBILITY).24

THINGSTOAVOID25

5



Introduction



PurposeofthisGuide

WhenplanningalargerolloutofEndpointEncryptionv5,itisimportanttounderstandtheprocessofscaling

thebackendObjectDirectoryandtheassociatedEndpointEncryptionCommunicationsServerprocessesto

meetrequirements.ThisguideoutlinestheconsiderationsaroundEndpointEncryption5implementationand

suggestspossiblesolutions.



Theguidealsodiscussesconsiderationsonoptimizationandmaintenancebeforeandafteritsimplementation.



Italsoassumesthereaderhassomeknowledgeofenterprisesystems(configurationandmanagement)and

someknowledgeofEndpointEncryptioncomponents(EndpointEncryptionManagerv5.x,EndpointEncryption

forPCv5.xandotherMcAfeeEndpointEncryptioncomponents)thatwillbenefitfromgoodpracticeand

ObjectDirectoryoptimization(seebelow).



ThisguideisacollationoftheprofessionalopinionsofEndpointEncryptioncertifiedengineers,andnotthe

exactscience.Becauseeveryimplementationisunique,itiscriticaltounderstandboththeproductandthe

environmentinwhichitisbeingused,beforearrivingatanydecisiononimplementationstrategy.

Calculationsandfiguresinthisguidearebasedonfieldevidenceandnottheoreticalsystemtestingandare

our“bestadvice”atthetimeofwriting.



WerecommendyoutodiscussyourrequirementswithyourMcAfeerepresentative.McAfeehaswide

experienceindeployingrealworldimplementations.



Thankstoalltheauthorswhohavecontributedtowardsthisguide.



RelevantProducts

Thisguidediscussesconfigurationandmaintenanceofthebackendservercomponents,EndpointEncryption

Managerv5.xanditsObjectDirectorytogether,whichmanageandgovernthefollowingversion5client

componentsofEndpointEncryption:

•EndpointEncryptionforPC(EEPC)

•EndpointEncryptionforFilesandFolders(EEFF)

•EndpointEncryptionforMobile(EEMO)

•EndpointEncryptionforRemovableMedia(EERM)



Othercomponentsthatmaybenefitindirectly:

•EndpointEncryptionScriptingTool

•EndpointEncryptionReportingTool

•EndpointEncryptionObjectDirectoryBackup



However,thevastmajorityoftheguideisconcernedwithEndpointEncryptionforPCasoptimizationsof

theManagerandObjectDirectorywillmakethemostimpactonthiscomponent.



6



SolutionArchitecture



DesignPhilosophy

McAfeeEndpointEncryptionisaclient/serverapplicationdesignedtobeimplementedwithasimple,single

serverarchitecture.ThissingleserverhostsanencrypteddatabaseknownastheObjectDirectory,andruns

servicestoallowconnectionstothedatabasefromboththeEncryptedEndpointsandtheManagementCenter

applications.Communicationwiththedatabaseoccursinasecureway(detaileddescriptionsareprovidedin

theManagementCenterAdministrationGuide).Thissingleservercanhostallcomponentsofthe

ManagementCenter,eveninenterpriseenvironments.



Whileitismostcommontoimplementtheproductwithasingleserver,therearealsootheroptions.The

componentsaremodularandareinstalledinadistributedway.Forexample,theWebHelpdeskcomponent

canbeinstalledonadedicatedwebserverwhiletherestofthecomponentsareonaseparateEndpoint

EncryptionServer.However,themajorityofourimplementationsaredonewithasingleserverbecausethisis

usuallythebestapproach.



NOTE:Thisguidehasallrecommendations,assumingasingleserverapproach.



Whenreadingthefollowingsections‐eventhoughourrecommendationmaybetouseasingleserverwith

DirectAttachedStorage(DAS),avirtualserverwithNASbasedstorageisusableandwillhavesome

advantagesinyourenvironmentforsmallnumbersofendpointsorwithlimitedsynceventsandlimitedusers

perclient.However,weadviseagainstusingsuchimplementationsandrecommendyoudiscussyour

requirementswithMcAfeebeforeimplementation.



IftheperformanceoftheMcAfeesolutionisbelowtheacceptablelimits,migratingtowardsour

recommendationsissuretolendimprovement.



7



ServerConfiguration



BasicServerRequirements

TheEndpointEncryptionCommunicationsServerprocessrunsunderMicrosoftWindows2000/2003.

CurrentlysomecustomersreportthatitworkswellunderWindows2008,howeverMcAfeehasnotofficially

certifiedthis.PleaseseetheMcAfeeKnowledgeBasearticleKB53698forcurrentinformationonsupported

environments.



Theperformancerequireddependsprimarilyuponthenumberofconcurrentconnectionsanenterprisecan

experienceandthenumberofconcurrentobjectcreationevents.Realworldimplementationssuggestthe

followingminimumandrecommendedconfigurations.



Notetheterm“ObjectDirectory”usedthroughoutthisguidereferstothedatabaseorstoreforusers,

endpointsandothersettings,andfilesforEndpointEncryptionmanagement.



RecommendedServerHardware



20‐2000users/systems



Minimumsingleserverconfiguration



•DedicatedServer

•2GHzDualcoreprocessor

•2GBRam

•4GBfreeharddisk,RAID1

•100MbNetwork



VirtualorSharedServercanbeusedforlownumbers.

PleaseseeVirtualServersectioninthisguide.Virtual

hardwarehastobeofhigherspecificationif

resourcesareshared.SeePage11.

2000‐5000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•2.4GHz2Dualor1Quadcoreprocessor

•4GBRam

•4GBfreeharddisk,RAID5

•100MbNetwork



5000‐50,000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•3GHz2Dual/1Quadcoreprocessor

•4GBRAM

•RAID510KRPMDirect‐attachedStorage,100GB

•Gigabitor3x100MbNetwork

50,000‐150,000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•3.0GHzorhigher2Quad/4Dualcore(8cores).

•6GBRAM

•RAID5Direct‐attachedStorage.15KRPM.250GB

•Gigabitor4x100MbNetwork



MentionedRAIDreferstohardwareRAID,notsoftware.EnablecachingonRAIDifpossible,butensure

suitableUPSpowerisavailable.

Migratinganenvironmentbetweenhardwareplatformsissimplesoitispossibletostartwithaminimal

configurationandlaterextendittoahigherconfigurationinaccordancewithperformancemonitoringand

capacityplanning.

NOTE:Thesemayvarydependingonotherconfigurationsettings.



8



ServerRedundancy

Itisriskytohaveasinglephysicalserverforyourenterprise,evenifyoutakeregularbackups.Werecommend

youtotakestepstoexpediterecoveryfromanoutageinaccordancewithanestablishedBusinessContinuity

andDisasterRecovery(BCDR)plan.



HotBackupDatabases

IncreasetheredundancyofthesystembyreplicatingtheEndpointEncryptionObjectDirectorytoasecond



physicalserver.Adedicatedreplicationtool“ObjectDirectoryBackup”whichisoptimizedtofollowthe

changelogofanEndpointEncryptionv5ObjectDirectoryissuppliedwiththeproductsuite.



Inthiscasesetuparesilientsystemusingtwophysicalboxes,bothhostingEndpointEncryptionServers–one

hostingthemasterODBandtheotherhavingahotbackup.Incasethemasterserverfails,theEndpoint

EncryptionServeronthesecondbackupboxcanberestartedin“master”mode.Thenrebuildorreplacethe

affectedmachineandcreateanewmaster.



TheODBBackuputilitycanalsobeusedtomakeregularbackupsoftheODB,givingfurtherrecoveryoptions

incaseofadisaster.Thismethodhowever,requiresmanualinteractiontostartthefailover.



AHotBackupdocumentdiscussingthisscenarioisavailable.



Clustering

Fullyautomatedfailoversforapplicationsusuallyemployaclusterserverenvironment.AlthoughtheMcAfee

EndpointEncryptionObjectDirectoryandManagercanrunonacluster,werecommendagainstusing‘shared’

resourceswherepossible.AsperMcAfeeKB53698,WindowsClusterenvironmenthasnotbeenfullytestedat

thistimeinengineering.



LoadBalancing

GiventhebestconfigurationisusuallyasinglehighperformanceserverwithDASthentheleastoptimalwayto

performclusteringistoputtheObjectDirectoryonanetworkshare(NAS)andtheninstalltheManagement

Centerontwoserverswhichaccessthesharesimultaneously.



NOTE:Thelatterwillfunction,butitwillbesignificantlydetrimentaltoserverperformance.



Youshouldnotethatifyouusespecialloadbalancingswitchestosplitnetworkload,youshouldsetthemto

alloweachclientactiveconnectiontooccurwiththesameswitchthroughoutthesyncevent(andnot

split/distributeeachpacketduringasinglesync).



Makingremoteconnectionstothedatabaseisslowerthanlocalconnections,sothisdesignisoftentooslow

toworkeffectively.



IfDASisnotusedandthereareissuessuchasperformance,objectcorruption(especiallyasobjectnumbersin

theMcAfeeEndpointEncryptionObjectDirectoryincrease)McAfeesupportwillrecommendmovingtoDAS

andhighperformancededicatedserver.



IfaSANistheonlyoptionavailable,pleasenoteSANarrayscanprioritizetheconnectionstothephysicalbox

inwhatisknownasTierlevels.Tier1isthehighestpriority,Tier3isthelowest.McAfeeEndpointEncryption

needsoptimaldiskaccesssowouldneedTier1prioritywithdedicatedLUNStoprovidethehighestspeed

connection.Thisisnecessaryforfullandpromptservicesynchronizationrequestsandadministration.This

avoidscorrupteddatabases,objects,clientsandslowadministrationperformance.RunningonSANisnot

recommended,butifitmustbedone,thentheconnectionmustbeTier1.

9



ServerandObjectDirectoryOptimisation



EndpointtoServerCommunication‐NetworkLoadEstimation

EndpointEncryptionnetworktrafficistheeasiesttoconsiderintermsof“synchronizationevents”.Eachtimea

systemstartsittriestoconnecttoadesignatedEEPCdatabasecommunicationserverandupdateitsprofile.It

mayalso(dependinguponconfiguration)trytoconnectperiodically.Inlargedeployments,thefirststepin

estimatingthenetworkloadcausedbyEndpointEncryptionistoestimatethepeaknumberofconcurrent

synchronizationevents.Thisisrelatedtotheuserworkingpractices.Forexample,if2000usersswitchtheir

systemsonat9A.M,the“9A.M.”effectcanbedilutedbysettingoptionalbootsyncdelayandoffsettimesto

spreadtheloadacross,forexampleonehour.



Oncepeakflowisestimated,doubleittogivesomesafety,thenworkonanestimateof7KBperuserpersync

(thisisaveryhighapproximationbasedontotalupdateoftheusereverytwosyncevents).AtypicalWindows

server,inourexperience,canaccept100connectionspersecondperserver,withadefaultmaximumwait

timeof30secondsforpendingconnections.



ThemaximumcapabilityofasingleCommunicationsServer,takingthecapacityofthenetworktobe100

Mbps(1millionbitspersecond)is20synchronizationsofdataasecond.AWindowsserverOScanestablish

connectionsaboutevery10ms,andcanhandleunlimitedconnections(althougheventuallyitwillrunoutof

clockcyclesandmemory).



Onceestablished,aconnectioncantakeanunlimitedamountoftimetofinish,thoughthedefaulttimeouton

establishingaconnectionis30seconds.Iftherearemorethan100attemptedconnectionspersecond,the

queuecannotbelongerthan3,000connections.



ThedefaultsettingsoftheCommunicationServerlimitthequeueto200entries(abalancebetweentaking

connectionsandprocessingconnections).Afterthatpoint,theconnectionsarerefused.Thisisareasonable

“realworld”setting.Aslongastheprofileofthesystemissettoretrytheconnectionafter,forexample,four

hours,thereisnolossoffunction.Settingthequeuelengthtomorethan1500canresultinpoorperformance

fromtheserverasittriestoservicesomanyconnections.



Inrealtermswecansaythatasageneralmaximumcase,theEndpointEncryptionServerislimitedto100

connectionspersecond,withasustainedload.Saturationinourexperienceisreachedwhenthereismore

than1400synchronizationeventsperminute(1200acceptedandprocessed,200queued).Achievingthisload

intherealworldrequiresamassive,badlyplannedandconfiguredpopulationofsystems.Currentcustomers

with40000+installationsrarelyexceedthe200currentconnectionpoints,mostofwhichareadministrators

performingconfigurationchanges.



TheoperatingsystemordiskcontrollercachesmostofEndpointEncryption’sdatabase,soeventuallythe

commonfileswillbesuppliedfromRAMratherthanacrosstheconnectiontothedatabasehost,or,fromdisk.

Usingthecompressedversionofthedatabasecanimproveperformancebyasmallamount,however,itis

usefulwhencorporatebackupsoftwarehasdifficultyarchivingthedatabase.



ThisroughcalculationtellsusthatweneedoneEndpointEncryptionServerper1400eventsaminute

minimum;however,experiencingthesysteminactionwillgivetruefeedback.Itisoftenthecasethatmodern

hardwareoutperformspaperestimations.



EstimatingtheSizeoftheObjectDirectory

ThebasesizeofanEndpointEncryption5.xObjectDirectoryisaround150MB.Becauseyouaddnewusers

andsystems,theODBgrowsaccordingly.Italsogrowsinsizeassystemssynchronizeanduploadaudit

information.



10



AnObjectDirectorywith5000usersand5000systemscouldbeexpectedtogrowasfollows:



TypicalGrowthof5000user/machineObjectDirectory 

DayDataSize ApproxDiskSpaceUsed

183MB143MB

589MB143MB

20204MB403MB

50396MB745MB

100747MB1050 MB

3652455MB 3900 MB



Usersandsystemsarethemostprevalentobjecttypesinalargedatabase.Typically,oncreation,thesetypes

ofobjectstake4000bytes.Aday’sauditaddsaroundanadditional700bytesofdataperobject.Although

thesefiguresareverysmall,becauseofwastedspaceontheObjectDirectoryServer’sharddisk,theactual

disksizeoccupiedbytheObjectDirectorycanbe4xormorelarger.



VirtualServers

McAfeeEndpointEncryptionManagercanberunfromaVirtualServerforlowernumbersofEndpoints.

McAfeerecommendsphysicallydedicatedhardwareforhighnumbersofEndpoints.



Performanceofvirtualsystemsisdependentonmanyfactorsthatcansignificantlyaffecttheoverallproduct

performancewhencomparedtophysicallydedicatedhardware.High‐speedaccesstothedatawithinthe

ObjectDirectoryisrequiredandmustbecarefullyconsideredandevaluatedinaVirtualServerEnvironment.



CurrenttestingofVirtualServersrunningEEPCoperateswithinasetnumbersofdatabaseobjects.McAfee’s

experienceshowsthatperformancesissuearisingfromtheuseofVirtualServersisaresultof:



•Lackofresourcesdedicatedtothevirtualserver.

•Dynamicallyassignedresourcestothevirtualserverwhichstarvesitofthenecessaryperformance

duringpeakperiods.

•Sloworreduceddiskaccess,resultinginasloweraccesstotheObjectDirectory.



McAfeesupportstheuseofVirtualServersrunningtheadministrativefunctionalityofEEPCprovidedthe

appropriateresourcesarefullydedicatedtotheVirtualServeratalltimes.Ifperformanceproblemsare

experienced,theresourcesavailabletotheVirtualServerneedtobeincreased.Pleaserefertothe

recommendedserverspecificationsastheminimumresourcesfullyassignedtotheVirtualServeratalltimes.

Theseresourcesapplytothespecificimage,andnottotheoverallresourcesofthehost.

CustomersneedtofollowtherecommendationsofMcAfeeSupportandraiseasupportticketfortheissues

relatedtoaVirtualServer.Theserecommendationscanvaryfromtweakingofserverandmachinesettingsas

specifiedinthisguideallthewaytomovingtheEEPCmanagementenvironmenttophysicalhardwareasalast

resortifnecessary.



ByengagingMcAfeeprofessionalservices,theywillassistyouinadequatelyscopingyourdeployment

hardwareneedsandcanrecommendabestpracticesapproach.



AsthetechnologyisevolvingandbetterVMfarmsarecomingonline,virtualhardwaresupportforgreater

numbersshouldbepossible.PleaseseeMcAfeeKB65747formoreinformation.



Thiswillbereviewedforthenextmajorrelease(version6.0ePOintegrated).



Ce manuel convient aux modèles suivants

Table des matières

Autres manuels McAfee Logiciel

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 PATCH 5 - S... Mode d’emploi

McAfee

McAfee QUICKCLEAN 1.0 Manuel utilisateur

McAfee

McAfee STUDENT SURVIVAL KIT 1.0-GETTING STARTED Manuel utilisateur

McAfee

McAfee UTILITIES 4.0 Manuel utilisateur

McAfee

McAfee SMB EDITIONS Manuel utilisateur

McAfee

McAfee MANAGEMENT EDITION 2.5 Manuel de service

McAfee

McAfee AVM85M - VirusScan For Mac Manuel utilisateur

McAfee

McAfee VPM80E005RAA - VirusScan Professional 2004 Manuel utilisateur

McAfee

McAfee FIREWALL 2.1-GETTING STARTED Manuel utilisateur

McAfee

McAfee QUICKCLEAN 3.0 Manuel utilisateur

McAfee

McAfee MTP09EMB1RAA - Total Protection 2009 Manuel utilisateur

McAfee

McAfee WEBSHIELD SMTP Manuel utilisateur

McAfee

McAfee VirusScan Manuel utilisateur

McAfee

McAfee INTERNET SECURITY 2008 Manuel utilisateur

McAfee

McAfee GSSCDE-AA-DA - GroupShield Security Suite Manuel utilisateur

McAfee

McAfee DR SOLOMON S ANTI-VIRUS 8.5 Manuel de service

McAfee

McAfee VCLCDE-AA-DA - VirusScan Command Line Scanner... Manuel utilisateur

McAfee

McAfee VIRUSSCAN HOME EDITION 7.0 Manuel utilisateur

McAfee

McAfee VIRUSSCAN ENTERPRISE Manuel utilisateur

McAfee

McAfee INTERNET SECURITY 2009 Manuel utilisateur

McAfee

McAfee Agent 4.0 Mode d’emploi

McAfee

McAfee AVDCDE-AA-AA - Active Virus Defense Suite Manuel utilisateur

McAfee

McAfee INTERNET SECURITY 2010 Manuel utilisateur

McAfee

McAfee MIS80E001RAI - Internet Security Suite 2006 Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur