McAfee ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES... Manual de usuario

1



McAfee®EndpointEncryption

EnterpriseBestPracticesGuide



November2009

2



Nopartofthispublicationmaybereproduced,transmitted,transcribed,storedinaretrievalsystem,or

translatedintoanylanguageinanyformorbyanymeanswithoutthewrittenpermissionofMcAfee,Inc.,or

itssuppliersoraffiliatecompanies.

3



Contents



INTRODUCTION5

PURPOSEOFTHISGUIDE5

RELEVANTPRODUCTS5

SOLUTIONARCHITECTURE6

DESIGNPHILOSOPHY6

SERVERCONFIGURATION7

BASICSERVERREQUIREMENTS7

RECOMMENDEDSERVERHARDWARE7

SERVERREDUNDANCY8

HOTBACKUPDATABASES8

CLUSTERING8

LOADBALANCING8

SERVERANDOBJECTDIRECTORYOPTIMISATION9

ENDPOINTTOSERVERCOMMUNICATION‐NETWORKLOADESTIMATION9

ESTIMATINGTHESIZEOFTHEOBJECTDIRECTORY9

TYPICALGROWTHOF5000USER/MACHINEOBJECTDIRECTORY10

VIRTUALSERVERS10

GLOBALDEPLOYMENTS11

OPTIMISATIONACTIONS11

OPTIMISATIONACTIONSOVERVIEW12

NAMEINDEXING(DBCFG.INI)13

WARNINGS13

DBCFG.INI13

GROUPSIZES14

TCP/IPKEEPALIVETIMEREDUCTION15

LASTACCESSTIMESTAMP(NTFSDISABLELASTACCESSUPDATE)15

WINDOWSSERVERASAFILESERVER15

OBJECTDIRECTORYBACKUPTOOLSETUP16

ANTI‐VIRUSSCANNER16

WINDOWSPERFORMANCE17

MANAGINGAUDITS17

FILECACHEONRAIDHARDDRIVECONTROLLER17

CONNECTIONSPEED17

OBJECTDIRECTORYPHYSICALLOCATION18

OBJECTDIRECTORYACCESS18

SEARCHINGFOROBJECTS18

CLEARINGDELETEDOBJECTS18

SBSERVER.INI18

4



OBJECTDIRECTORYMAINTENANCE19

MAINTENANCEINTRODUCTION19

ENVIRONMENT19

AUDITMAINTENANCE19

EXTRACTINGANDCLEARINGAUDITFROMTHEDATABASE19

CLEARINGTHEAUDIT19

DELETEDITEMSCLEANUP20

CHECKINGFORDATABASECORRUPTION20

WHYDOESTHEDATABASEGETCORRUPTED?20

ORPHANEDOBJECTS21

RESTORECOMMANDS21

CLEANUPCOMMANDS21

DUMPMACHINEDESCRIPTION22

USEROBJECTS‐GENERALPERFORMANCETIPS23

GENERALADVICE24

DEFAULTPRODUCTSETTINGS(FORMAXIMUMCOMPATIBILITY).24

THINGSTOAVOID25

5



Introduction



PurposeofthisGuide

WhenplanningalargerolloutofEndpointEncryptionv5,itisimportanttounderstandtheprocessofscaling

thebackendObjectDirectoryandtheassociatedEndpointEncryptionCommunicationsServerprocessesto

meetrequirements.ThisguideoutlinestheconsiderationsaroundEndpointEncryption5implementationand

suggestspossiblesolutions.



Theguidealsodiscussesconsiderationsonoptimizationandmaintenancebeforeandafteritsimplementation.



Italsoassumesthereaderhassomeknowledgeofenterprisesystems(configurationandmanagement)and

someknowledgeofEndpointEncryptioncomponents(EndpointEncryptionManagerv5.x,EndpointEncryption

forPCv5.xandotherMcAfeeEndpointEncryptioncomponents)thatwillbenefitfromgoodpracticeand

ObjectDirectoryoptimization(seebelow).



ThisguideisacollationoftheprofessionalopinionsofEndpointEncryptioncertifiedengineers,andnotthe

exactscience.Becauseeveryimplementationisunique,itiscriticaltounderstandboththeproductandthe

environmentinwhichitisbeingused,beforearrivingatanydecisiononimplementationstrategy.

Calculationsandfiguresinthisguidearebasedonfieldevidenceandnottheoreticalsystemtestingandare

our“bestadvice”atthetimeofwriting.



WerecommendyoutodiscussyourrequirementswithyourMcAfeerepresentative.McAfeehaswide

experienceindeployingrealworldimplementations.



Thankstoalltheauthorswhohavecontributedtowardsthisguide.



RelevantProducts

Thisguidediscussesconfigurationandmaintenanceofthebackendservercomponents,EndpointEncryption

Managerv5.xanditsObjectDirectorytogether,whichmanageandgovernthefollowingversion5client

componentsofEndpointEncryption:

•EndpointEncryptionforPC(EEPC)

•EndpointEncryptionforFilesandFolders(EEFF)

•EndpointEncryptionforMobile(EEMO)

•EndpointEncryptionforRemovableMedia(EERM)



Othercomponentsthatmaybenefitindirectly:

•EndpointEncryptionScriptingTool

•EndpointEncryptionReportingTool

•EndpointEncryptionObjectDirectoryBackup



However,thevastmajorityoftheguideisconcernedwithEndpointEncryptionforPCasoptimizationsof

theManagerandObjectDirectorywillmakethemostimpactonthiscomponent.



6



SolutionArchitecture



DesignPhilosophy

McAfeeEndpointEncryptionisaclient/serverapplicationdesignedtobeimplementedwithasimple,single

serverarchitecture.ThissingleserverhostsanencrypteddatabaseknownastheObjectDirectory,andruns

servicestoallowconnectionstothedatabasefromboththeEncryptedEndpointsandtheManagementCenter

applications.Communicationwiththedatabaseoccursinasecureway(detaileddescriptionsareprovidedin

theManagementCenterAdministrationGuide).Thissingleservercanhostallcomponentsofthe

ManagementCenter,eveninenterpriseenvironments.



Whileitismostcommontoimplementtheproductwithasingleserver,therearealsootheroptions.The

componentsaremodularandareinstalledinadistributedway.Forexample,theWebHelpdeskcomponent

canbeinstalledonadedicatedwebserverwhiletherestofthecomponentsareonaseparateEndpoint

EncryptionServer.However,themajorityofourimplementationsaredonewithasingleserverbecausethisis

usuallythebestapproach.



NOTE:Thisguidehasallrecommendations,assumingasingleserverapproach.



Whenreadingthefollowingsections‐eventhoughourrecommendationmaybetouseasingleserverwith

DirectAttachedStorage(DAS),avirtualserverwithNASbasedstorageisusableandwillhavesome

advantagesinyourenvironmentforsmallnumbersofendpointsorwithlimitedsynceventsandlimitedusers

perclient.However,weadviseagainstusingsuchimplementationsandrecommendyoudiscussyour

requirementswithMcAfeebeforeimplementation.



IftheperformanceoftheMcAfeesolutionisbelowtheacceptablelimits,migratingtowardsour

recommendationsissuretolendimprovement.



7



ServerConfiguration



BasicServerRequirements

TheEndpointEncryptionCommunicationsServerprocessrunsunderMicrosoftWindows2000/2003.

CurrentlysomecustomersreportthatitworkswellunderWindows2008,howeverMcAfeehasnotofficially

certifiedthis.PleaseseetheMcAfeeKnowledgeBasearticleKB53698forcurrentinformationonsupported

environments.



Theperformancerequireddependsprimarilyuponthenumberofconcurrentconnectionsanenterprisecan

experienceandthenumberofconcurrentobjectcreationevents.Realworldimplementationssuggestthe

followingminimumandrecommendedconfigurations.



Notetheterm“ObjectDirectory”usedthroughoutthisguidereferstothedatabaseorstoreforusers,

endpointsandothersettings,andfilesforEndpointEncryptionmanagement.



RecommendedServerHardware



20‐2000users/systems



Minimumsingleserverconfiguration



•DedicatedServer

•2GHzDualcoreprocessor

•2GBRam

•4GBfreeharddisk,RAID1

•100MbNetwork



VirtualorSharedServercanbeusedforlownumbers.

PleaseseeVirtualServersectioninthisguide.Virtual

hardwarehastobeofhigherspecificationif

resourcesareshared.SeePage11.

2000‐5000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•2.4GHz2Dualor1Quadcoreprocessor

•4GBRam

•4GBfreeharddisk,RAID5

•100MbNetwork



5000‐50,000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•3GHz2Dual/1Quadcoreprocessor

•4GBRAM

•RAID510KRPMDirect‐attachedStorage,100GB

•Gigabitor3x100MbNetwork

50,000‐150,000users/systems



Recommendedsingleserverconfiguration



•DedicatedServer

•3.0GHzorhigher2Quad/4Dualcore(8cores).

•6GBRAM

•RAID5Direct‐attachedStorage.15KRPM.250GB

•Gigabitor4x100MbNetwork



MentionedRAIDreferstohardwareRAID,notsoftware.EnablecachingonRAIDifpossible,butensure

suitableUPSpowerisavailable.

Migratinganenvironmentbetweenhardwareplatformsissimplesoitispossibletostartwithaminimal

configurationandlaterextendittoahigherconfigurationinaccordancewithperformancemonitoringand

capacityplanning.

NOTE:Thesemayvarydependingonotherconfigurationsettings.



8



ServerRedundancy

Itisriskytohaveasinglephysicalserverforyourenterprise,evenifyoutakeregularbackups.Werecommend

youtotakestepstoexpediterecoveryfromanoutageinaccordancewithanestablishedBusinessContinuity

andDisasterRecovery(BCDR)plan.



HotBackupDatabases

IncreasetheredundancyofthesystembyreplicatingtheEndpointEncryptionObjectDirectorytoasecond



physicalserver.Adedicatedreplicationtool“ObjectDirectoryBackup”whichisoptimizedtofollowthe

changelogofanEndpointEncryptionv5ObjectDirectoryissuppliedwiththeproductsuite.



Inthiscasesetuparesilientsystemusingtwophysicalboxes,bothhostingEndpointEncryptionServers–one

hostingthemasterODBandtheotherhavingahotbackup.Incasethemasterserverfails,theEndpoint

EncryptionServeronthesecondbackupboxcanberestartedin“master”mode.Thenrebuildorreplacethe

affectedmachineandcreateanewmaster.



TheODBBackuputilitycanalsobeusedtomakeregularbackupsoftheODB,givingfurtherrecoveryoptions

incaseofadisaster.Thismethodhowever,requiresmanualinteractiontostartthefailover.



AHotBackupdocumentdiscussingthisscenarioisavailable.



Clustering

Fullyautomatedfailoversforapplicationsusuallyemployaclusterserverenvironment.AlthoughtheMcAfee

EndpointEncryptionObjectDirectoryandManagercanrunonacluster,werecommendagainstusing‘shared’

resourceswherepossible.AsperMcAfeeKB53698,WindowsClusterenvironmenthasnotbeenfullytestedat

thistimeinengineering.



LoadBalancing

GiventhebestconfigurationisusuallyasinglehighperformanceserverwithDASthentheleastoptimalwayto

performclusteringistoputtheObjectDirectoryonanetworkshare(NAS)andtheninstalltheManagement

Centerontwoserverswhichaccessthesharesimultaneously.



NOTE:Thelatterwillfunction,butitwillbesignificantlydetrimentaltoserverperformance.



Youshouldnotethatifyouusespecialloadbalancingswitchestosplitnetworkload,youshouldsetthemto

alloweachclientactiveconnectiontooccurwiththesameswitchthroughoutthesyncevent(andnot

split/distributeeachpacketduringasinglesync).



Makingremoteconnectionstothedatabaseisslowerthanlocalconnections,sothisdesignisoftentooslow

toworkeffectively.



IfDASisnotusedandthereareissuessuchasperformance,objectcorruption(especiallyasobjectnumbersin

theMcAfeeEndpointEncryptionObjectDirectoryincrease)McAfeesupportwillrecommendmovingtoDAS

andhighperformancededicatedserver.



IfaSANistheonlyoptionavailable,pleasenoteSANarrayscanprioritizetheconnectionstothephysicalbox

inwhatisknownasTierlevels.Tier1isthehighestpriority,Tier3isthelowest.McAfeeEndpointEncryption

needsoptimaldiskaccesssowouldneedTier1prioritywithdedicatedLUNStoprovidethehighestspeed

connection.Thisisnecessaryforfullandpromptservicesynchronizationrequestsandadministration.This

avoidscorrupteddatabases,objects,clientsandslowadministrationperformance.RunningonSANisnot

recommended,butifitmustbedone,thentheconnectionmustbeTier1.

9



ServerandObjectDirectoryOptimisation



EndpointtoServerCommunication‐NetworkLoadEstimation

EndpointEncryptionnetworktrafficistheeasiesttoconsiderintermsof“synchronizationevents”.Eachtimea

systemstartsittriestoconnecttoadesignatedEEPCdatabasecommunicationserverandupdateitsprofile.It

mayalso(dependinguponconfiguration)trytoconnectperiodically.Inlargedeployments,thefirststepin

estimatingthenetworkloadcausedbyEndpointEncryptionistoestimatethepeaknumberofconcurrent

synchronizationevents.Thisisrelatedtotheuserworkingpractices.Forexample,if2000usersswitchtheir

systemsonat9A.M,the“9A.M.”effectcanbedilutedbysettingoptionalbootsyncdelayandoffsettimesto

spreadtheloadacross,forexampleonehour.



Oncepeakflowisestimated,doubleittogivesomesafety,thenworkonanestimateof7KBperuserpersync

(thisisaveryhighapproximationbasedontotalupdateoftheusereverytwosyncevents).AtypicalWindows

server,inourexperience,canaccept100connectionspersecondperserver,withadefaultmaximumwait

timeof30secondsforpendingconnections.



ThemaximumcapabilityofasingleCommunicationsServer,takingthecapacityofthenetworktobe100

Mbps(1millionbitspersecond)is20synchronizationsofdataasecond.AWindowsserverOScanestablish

connectionsaboutevery10ms,andcanhandleunlimitedconnections(althougheventuallyitwillrunoutof

clockcyclesandmemory).



Onceestablished,aconnectioncantakeanunlimitedamountoftimetofinish,thoughthedefaulttimeouton

establishingaconnectionis30seconds.Iftherearemorethan100attemptedconnectionspersecond,the

queuecannotbelongerthan3,000connections.



ThedefaultsettingsoftheCommunicationServerlimitthequeueto200entries(abalancebetweentaking

connectionsandprocessingconnections).Afterthatpoint,theconnectionsarerefused.Thisisareasonable

“realworld”setting.Aslongastheprofileofthesystemissettoretrytheconnectionafter,forexample,four

hours,thereisnolossoffunction.Settingthequeuelengthtomorethan1500canresultinpoorperformance

fromtheserverasittriestoservicesomanyconnections.



Inrealtermswecansaythatasageneralmaximumcase,theEndpointEncryptionServerislimitedto100

connectionspersecond,withasustainedload.Saturationinourexperienceisreachedwhenthereismore

than1400synchronizationeventsperminute(1200acceptedandprocessed,200queued).Achievingthisload

intherealworldrequiresamassive,badlyplannedandconfiguredpopulationofsystems.Currentcustomers

with40000+installationsrarelyexceedthe200currentconnectionpoints,mostofwhichareadministrators

performingconfigurationchanges.



TheoperatingsystemordiskcontrollercachesmostofEndpointEncryption’sdatabase,soeventuallythe

commonfileswillbesuppliedfromRAMratherthanacrosstheconnectiontothedatabasehost,or,fromdisk.

Usingthecompressedversionofthedatabasecanimproveperformancebyasmallamount,however,itis

usefulwhencorporatebackupsoftwarehasdifficultyarchivingthedatabase.



ThisroughcalculationtellsusthatweneedoneEndpointEncryptionServerper1400eventsaminute

minimum;however,experiencingthesysteminactionwillgivetruefeedback.Itisoftenthecasethatmodern

hardwareoutperformspaperestimations.



EstimatingtheSizeoftheObjectDirectory

ThebasesizeofanEndpointEncryption5.xObjectDirectoryisaround150MB.Becauseyouaddnewusers

andsystems,theODBgrowsaccordingly.Italsogrowsinsizeassystemssynchronizeanduploadaudit

information.



10



AnObjectDirectorywith5000usersand5000systemscouldbeexpectedtogrowasfollows:



TypicalGrowthof5000user/machineObjectDirectory 

DayDataSize ApproxDiskSpaceUsed

183MB143MB

589MB143MB

20204MB403MB

50396MB745MB

100747MB1050 MB

3652455MB 3900 MB



Usersandsystemsarethemostprevalentobjecttypesinalargedatabase.Typically,oncreation,thesetypes

ofobjectstake4000bytes.Aday’sauditaddsaroundanadditional700bytesofdataperobject.Although

thesefiguresareverysmall,becauseofwastedspaceontheObjectDirectoryServer’sharddisk,theactual

disksizeoccupiedbytheObjectDirectorycanbe4xormorelarger.



VirtualServers

McAfeeEndpointEncryptionManagercanberunfromaVirtualServerforlowernumbersofEndpoints.

McAfeerecommendsphysicallydedicatedhardwareforhighnumbersofEndpoints.



Performanceofvirtualsystemsisdependentonmanyfactorsthatcansignificantlyaffecttheoverallproduct

performancewhencomparedtophysicallydedicatedhardware.High‐speedaccesstothedatawithinthe

ObjectDirectoryisrequiredandmustbecarefullyconsideredandevaluatedinaVirtualServerEnvironment.



CurrenttestingofVirtualServersrunningEEPCoperateswithinasetnumbersofdatabaseobjects.McAfee’s

experienceshowsthatperformancesissuearisingfromtheuseofVirtualServersisaresultof:



•Lackofresourcesdedicatedtothevirtualserver.

•Dynamicallyassignedresourcestothevirtualserverwhichstarvesitofthenecessaryperformance

duringpeakperiods.

•Sloworreduceddiskaccess,resultinginasloweraccesstotheObjectDirectory.



McAfeesupportstheuseofVirtualServersrunningtheadministrativefunctionalityofEEPCprovidedthe

appropriateresourcesarefullydedicatedtotheVirtualServeratalltimes.Ifperformanceproblemsare

experienced,theresourcesavailabletotheVirtualServerneedtobeincreased.Pleaserefertothe

recommendedserverspecificationsastheminimumresourcesfullyassignedtotheVirtualServeratalltimes.

Theseresourcesapplytothespecificimage,andnottotheoverallresourcesofthehost.

CustomersneedtofollowtherecommendationsofMcAfeeSupportandraiseasupportticketfortheissues

relatedtoaVirtualServer.Theserecommendationscanvaryfromtweakingofserverandmachinesettingsas

specifiedinthisguideallthewaytomovingtheEEPCmanagementenvironmenttophysicalhardwareasalast

resortifnecessary.



ByengagingMcAfeeprofessionalservices,theywillassistyouinadequatelyscopingyourdeployment

hardwareneedsandcanrecommendabestpracticesapproach.



AsthetechnologyisevolvingandbetterVMfarmsarecomingonline,virtualhardwaresupportforgreater

numbersshouldbepossible.PleaseseeMcAfeeKB65747formoreinformation.



Thiswillbereviewedforthenextmajorrelease(version6.0ePOintegrated).



Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de McAfee

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 RELEA Manual de instrucciones

McAfee

McAfee MIS80E001RAI - Internet Security Suite 2006 Manual de usuario

McAfee

McAfee VIRUSSCAN 5.1 Manual de usuario

McAfee

McAfee Agent 4.0 Manual de instrucciones

McAfee

McAfee VIRUSSCAN 4.5 - Manual de servicio

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 4 - S Manual de instrucciones

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 3 - S... Manual de instrucciones

McAfee

McAfee VLF09E002RAA - VirusScan Professional 2005 Manual de usuario

McAfee

McAfee DR SOLOMON S ANTI-VIRUS 8.5 Manual de servicio

McAfee

McAfee INTERNET SECURITY 2010 Manual de usuario

McAfee

McAfee SMB EDITIONS Manual de usuario

McAfee

McAfee OFFICE 3.1 Manual de usuario

McAfee

McAfee VSF09EMB1RAA - VirusScan Plus 2009 Manual de usuario

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - Manual de usuario

McAfee

McAfee MIS09EMB3RAA - Internet Security 2009 Manual de usuario

McAfee

McAfee INTERNET SECURITY 5.0 Manual de usuario

McAfee

McAfee NAPCKE-AB-AA - VirusScan For NetApp Manual de usuario

McAfee

McAfee VPM80E005RAA - VirusScan Professional 2004 Manual de usuario

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 PATCH 5 - S... Manual de instrucciones

McAfee

McAfee AVDCDE-AA-AA - Active Virus Defense Suite Manual de usuario

McAfee

McAfee VirusScan Manual de usuario

McAfee

McAfee VIRUSSCAN HOME EDITION 7.0 Manual de usuario

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0.2 - Manual de usuario

McAfee

McAfee ANTI-THEFT FILE PROTECTION Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario