F-SECURE CLIENT SECURITY 7.00 Owner's manual

F-Secure Client

Security

Administrator’s Guide

"F-Secure" and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure

product names and symbols/logos are either trademarks or registered trademarks of F-Secure

Corporation. All product names referenced herein are trademarks or registered trademarks of their

respective companies. F-Secure Corporation disclaims proprietary interest in the marks and names of

others. Although F-Secure Corporation makes every effort to ensure that this information is accurate,

F-Secure Corporation will not be liable for any errors or omission of facts contained herein. F-Secure

Corporation reserves the right to modify specifications cited in this document without prior notice.

Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of

this document may be reproduced or transmitted in any form or by any means, electronic or

mechanical, for any purpose, without the express written permission of F-Secure Corporation.

This product may be covered by one or more F-Secure patents, including the following:

GB2353372 GB2366691 GB2366692 GB2366693 GB2367933 GB2368233

GB2374260

iii

Contents

About this Guide 10

Overview ............................................................................................................................ 11

Additional Documentation .................................................................................................. 13

Conventions Used in F-Secure Guides.............................................................................. 15

Symbols .................................................................................................................... 15

Chapter 1 Introduction 17

1.1 Overview ....................................................................................................................18

1.2 F-Secure Client Security Components and Features.................................................18

1.2.1 Virus and Spy Protection................................................................................18

1.2.2 Internet Shield ................................................................................................21

1.2.3 Application Management................................................................................22

1.3 Introduction to F-Secure Policy Manager...................................................................23

1.3.1 Main Components of F-Secure Policy Manager.............................................24

1.3.2 F-Secure Policy Manager Features................................................................25

1.4 Basic Terminology......................................................................................................26

Chapter 2 Installing F-Secure Policy Manager 28

2.1 Overview ....................................................................................................................29

2.2 System Requirements................................................................................................30

2.2.1 F-Secure Policy Manager Server ...................................................................30

2.2.2 F-Secure Policy Manager Console.................................................................32

iv

2.3 Installation Steps........................................................................................................33

2.4 Uninstalling F-Secure Policy Manager.......................................................................55

Chapter 3 Introduction to F-Secure Policy Manager Anti-Virus Mode

User Interface 56

3.1 Overview ....................................................................................................................57

3.2 Policy Domains Tab ...................................................................................................58

3.3 Management Tabs .....................................................................................................58

3.3.1 Summary Tab.................................................................................................59

3.3.2 Outbreak Tab..................................................................................................66

3.3.3 Settings Tab ...................................................................................................68

3.3.4 Status Tab ....................................................................................................102

3.3.5 Alerts Tab.....................................................................................................110

3.3.6 Reports Tab..................................................................................................112

3.3.7 Installation Tab.............................................................................................113

3.3.8 Operations Tab.............................................................................................115

3.4 Toolbar.....................................................................................................................116

3.5 Menu Commands.....................................................................................................117

3.6 Settings Inheritance .................................................................................................120

3.6.1 How Settings Inheritance is Displayed on the User Interface.......................122

3.6.2 Locking and Unlocking all Settings on a Page at Once................................123

3.6.3 Settings Inheritance in Tables......................................................................124

Chapter 4 Setting up the Managed Network 125

4.1 Overview ..................................................................................................................126

4.2 Logging in for the First Time ....................................................................................126

4.2.1 Logging In.....................................................................................................127

4.3 Creating the Domain Structure.................................................................................130

4.3.1 Adding Policy Domains and Subdomains.....................................................132

4.4 Adding Hosts............................................................................................................132

4.4.1 Windows Domains........................................................................................133

4.4.2 Autoregistered Hosts....................................................................................133

4.4.3 F-Secure Push Installations..........................................................................138

4.4.4 Policy-Based Installation ..............................................................................147

4.4.5 Local Installation and Updates with Pre-Configured Packages....................151

v

4.5 Local Installation ......................................................................................................156

4.5.1 Local Installation System Requirements ......................................................157

4.5.2 Installation Instructions.................................................................................157

4.6 Installing on an Infected Host...................................................................................158

4.7 How to Check That the Management Connections Work ........................................159

Chapter 5 Configuring Virus and Spyware Protection 160

5.1 Overview: What can Virus and Spyware Protection be Used for?...........................161

5.2 Configuring Automatic Updates ...............................................................................162

5.2.1 How do Automatic Updates Work?...............................................................163

5.2.2 Automatic Updates Configuration Settings...................................................163

5.2.3 Configuring Automatic Updates from Policy Manager Server ......................164

5.2.4 Configuring Policy Manager Proxy...............................................................165

5.3 Configuring Real-Time Scanning .............................................................................166

5.3.1 Real-Time Scanning Configuration Settings.................................................166

5.3.2 Enabling Real-Time Scanning for the Whole Domain..................................169

5.3.3 Forcing all Hosts to Use Real-Time Scanning..............................................169

5.3.4 Excluding Microsoft Outlooks's .pst File from Real-Time Scanning .............170

5.4 Configuring System Control .....................................................................................171

5.4.1 System Control Configuration Settings.........................................................171

5.5 Configuring Rootkit Scanning...................................................................................172

5.5.1 Rootkit Scanning Configuration Settings......................................................172

5.5.2 Launching a Rootkit Scan for the Whole Domain.........................................172

5.6 Configuring E-mail Scanning....................................................................................173

5.6.1 E-mail Scanning Configuration Settings.......................................................173

5.6.2 Enabling E-mail Scanning for Incoming and Outgoing E-mails....................176

5.7 Configuring Web Traffic (HTTP) Scanning...............................................................178

5.7.1 HTTP Scanning Configuration Settings........................................................178

5.7.2 Enabling Web Traffic Scanning for the Whole Domain ................................179

5.7.3 Excluding a Web Site from HTTP Scanning.................................................179

5.8 Configuring Spyware Scanning................................................................................181

5.8.1 Spyware Control Settings.............................................................................181

5.8.2 Setting up Spyware Control for the Whole Domain......................................185

5.8.3 Launching Spyware Scanning in the Whole Domain....................................187

5.8.4 Allowing the Use of a Spyware or Riskware Component.............................188

vi

5.9 Preventing Users from Changing Settings...............................................................189

5.9.1 Setting all Virus Protection Settings Final.....................................................189

5.10 Configuring F-Secure Client Security Alert Sending ................................................190

5.10.1 Setting F-Secure Client Security to Send Virus Alerts to an E-mail Address190

5.10.2 Disabling F-Secure Client Security Alert Pop-ups........................................192

5.11 Monitoring Viruses on the Network ..........................................................................192

5.12 Testing your Antivirus Protection .............................................................................192

Chapter 6 Configuring Internet Shield 194

6.1 Overview: What can Internet Shield be Used for? ...................................................195

6.1.1 Global Firewall Security Levels ....................................................................195

6.1.2 Security Level Design Principles..................................................................197

6.2 Configuring Internet Shield Security Levels and Rules............................................198

6.2.1 Selecting an Active Security Level for a Workstation...................................198

6.2.2 Configuring a Default Security Level for the Managed Hosts.......................199

6.2.3 Adding a New Security Level for a Certain Domain Only.............................200

6.3 Configuring Network Quarantine..............................................................................203

6.3.1 Network Quarantine Settings........................................................................203

6.3.2 Enabling Network Quarantine in the Whole Domain....................................203

6.3.3 Fine-Tuning Network Quarantine .................................................................204

6.4 Configuring Internet Shield Rule Alerts....................................................................205

6.4.1 Adding a New Internet Shield Rule with Alerting..........................................205

6.5 Configuring Application Control................................................................................209

6.5.1 Application Control Configuration Settings...................................................211

6.5.2 Setting up Application Control for the First Time..........................................212

6.5.3 Creating a Rule for an Unknown Application on Root Level.........................214

6.5.4 Editing an Existing Application Control Rule ................................................215

6.5.5 Disabling Application Control Pop-ups.........................................................216

6.6 How to use Alerts for Checking that Internet Shield Works? ...................................217

6.7 Configuring the Intrusion Prevention........................................................................218

6.7.1 Intrusion Prevention Configuration Settings.................................................219

6.7.2 Configuring IDS for Desktops and Laptops..................................................220

vii

Chapter 7 How to Check that the Environment is Protected 222

7.1 Overview ..................................................................................................................223

7.2 How to Check the Protection Status from Outbreak Tab .........................................223

7.3 How to Check that all the Hosts Have the Latest Policy ..........................................223

7.4 How to Check that the Server has the Latest Virus Definitions................................224

7.5 How to Check that the Hosts have the Latest Virus Definitions...............................224

7.6 How to Check that there are no Disconnected Hosts ..............................................225

7.7 Viewing Scanning Reports.......................................................................................225

7.8 Viewing Alerts ..........................................................................................................226

7.9 Creating a Weekly Infection Report .........................................................................227

7.10 Monitoring a Possible Network Attack......................................................................228

Chapter 8 Upgrading Software 229

8.1 Overview: Upgrading Software ................................................................................230

8.1.1 Using the Installation Editor..........................................................................230

Chapter 9 Local Host Operations 234

9.1 Overview ..................................................................................................................235

9.2 Scanning File Viruses Manually...............................................................................235

9.3 Viewing the Latest Scanning Report on a Local Host..............................................236

9.4 Adding a Scheduled Scan from a Local Host...........................................................236

9.5 Logging and Log File Locations on Local Hosts ......................................................237

9.5.1 LogFile.log....................................................................................................237

9.5.2 Packet Logging.............................................................................................238

9.5.3 Other Log Files.............................................................................................241

9.6 Connecting to F-Secure Policy Manager and Importing a Policy File Manually.......241

9.7 Suspending Downloads and Updates......................................................................242

9.8 Allowing Users to Unload F-Secure Products..........................................................242

Chapter 10 Virus Information 244

10.1 Virus Information on F-Secure Web Pages..............................................................245

10.2 Latest Threats..........................................................................................................245

10.2.1 F-Secure Radar............................................................................................245

viii

10.3 Viruses in the Wild ...................................................................................................246

10.4 How to Send a Virus Sample to F-Secure ...............................................................246

10.4.1 How to Package a Virus Sample..................................................................246

10.4.2 What Should Be Sent...................................................................................247

10.4.3 Where to Send the Virus Sample.................................................................249

10.4.4 In What Language........................................................................................250

10.4.5 Response Times...........................................................................................250

10.5 What to Do in Case of a Virus Outbreak?................................................................250

Chapter 11 Setting Up Cisco NAC Support 253

11.1 Introduction ..............................................................................................................254

11.2 Installing Cisco NAC Support...................................................................................254

11.2.1 Importing Posture Validation Attribute Definitions ........................................255

11.3 Attributes to be Used for Application Posture Token ...............................................255

Chapter 12 Advanced Features: Virus and Spyware Protection 257

12.1 Overview ..................................................................................................................258

12.2 Configuring Scheduled Scanning.............................................................................258

12.3 Configuring Policy Manager Proxy...........................................................................260

12.4 Configuring Automatic Updates on Hosts from Policy Manager Proxy....................261

12.5 Configuring a Host for SNMP Management.............................................................262

Chapter 13 Advanced Features: Internet Shield 263

13.1 Overview ..................................................................................................................264

13.2 Managing Internet Shield Properties Remotely........................................................264

13.2.1 Packet Logging.............................................................................................264

13.2.2 Trusted Interface ..........................................................................................265

13.2.3 Packet Filtering.............................................................................................266

13.3 Configuring Security Level Autoselection.................................................................266

13.4 Troubleshooting Connection Problems....................................................................268

13.5 Adding New Services...............................................................................................269

13.5.1 Creating a New Internet Service based on the Default HTTP......................270

ix

AppendixA Modifying PRODSETT.INI 278

A.1 Overview................................................................................................................. 279

A.2 Configurable Prodsett.ini Settings............................................................................279

AppendixB E-mail Scanning Alert and Error Messages 292

B.1 Overview................................................................................................................. 293

Glossary 297

Technical Support 311

Overview .......................................................................................................................... 312

Web Club .........................................................................................................................312

Virus Descriptions on the Web ................................................................................312

Advanced Technical Support ...........................................................................................312

F-Secure Technical Product Training ...............................................................................313

Training Program ....................................................................................................313

Contact Information .................................................................................................314

About F-Secure Corporation

10

ABOUT THIS GUIDE

Overview..................................................................................... 11

Additional Documentation.......................................................... 13

11

Overview

This manual covers the configuration and operations that you can do with

the F-Secure Policy Manager Anti-Virus Mode user interface and provides

the information you need to get started with managing F-Secure Client

Security applications centrally.

The F-Secure Client Security Administrator’s Guide is divided into the

following chapters.

Chapter 1. Introduction. Describes the basic components of F-Secure

Client Security and the main features of F-Secure Policy Manager.

Chapter 2. Installing F-Secure Policy Manager. Instructions on how to

install F-Secure Policy Manager Server and Console.

Chapter 3. Introduction to F-Secure Policy Manager Anti-Virus Mode

User Interface. Describes the F-Secure Policy Manager Anti-Virus Mode

user interface components.

Chapter 4. Setting up the Managed Network. Describes how to plan and

create the centrally managed network.

Chapter 5. Configuring Virus and Spyware Protection. Describes how to

configure Virus Definition Updates, Real-Time Scanning and E-Mail

Scanning.

Chapter 6. Configuring Internet Shield. Describes how to configure the

security levels and rules, Application Control and Intrusion Detection

System (IDS).

Chapter 7. How to Check that the Environment is Protected. Provides a

checklist for monitoring the domain and for making sure that the network

is protected.

Chapter 8. Upgrading Software. Contains instructions on how to upgrade

software with F-Secure Policy Manager.

Chapter 9. Local Host Operations. Provides information on

administration tasks, such as scheduling a scan locally and collecting

information from local log files.

12

Chapter 10. Virus Information. Describes where you can get more

information about viruses and how you can send a virus sample to

F-Secure.

Chapter 11. Setting Up Cisco NAC Support. Describes how to install and

set up Cisco network Access Control (NAC) Support.

Chapter 12. Advanced Features: Virus and Spyware Protection. Covers

the advanced virus protection features, such as scheduled scanning, the

use of Anti-Virus Proxy and using SNMP-based management.

Chapter 13. Advanced Features: Internet Shield. Covers the advanced

Internet Shield features, such as using port and IP checking with

Application Control, adding new services and troubleshooting connection

problems.

Appendix A. Modifying PRODSETT.INI. Contains information about

modifying PRODSETT.INI, a file that informs the Setup program which

software modules to install on workstations.

Appendix B. E-mail Scanning Alert and Error Messages. Describes the

alert and error messages that E-mail Scanning can generate.

Glossary — Explanation of terms

Technical Support — Web Club and contact information for assistance.

About F-Secure Corporation — Company background and products.

13

Additional Documentation

F-Secure Policy Manager Online Help

The F-Secure Policy Manager Online Help contains information on both

the Anti-Virus Mode as well as the Advanced Mode user interfaces. The

online help is accessible from the Help menu by selecting Help Contents,

or by pressing F1.

Information concerning the F-Secure Policy Manager Anti-Virus Mode

user interface can be found under F-Secure Client Security

Administration in the navigation tree.

Information concerning F-Secure Policy Manager Advanced Mode user

interface and other advanced operations can be found under F-Secure

Policy Manager in the navigation tree.

F-Secure Client Security Online Help

The F-Secure Client Security local user interface comes with a

context-sensitive online help. The online help is accessible from the main

user interface and from the advanced dialogs by either clicking the Help

button or pressing F1.

The online help always opens to a page that holds information about your

current location in the F-Secure Client Security user interface. In the left

pane of the online help, you can browse through the help using the

contents tree and access a full search function.

14

F-Secure Policy Manager Administrator’s Guide

For more information on administering other F-Secure software products

with F-Secure Policy Manager, see F-Secure Policy Manager

Administrator’s Guide. It contains information on the Advanced Mode

user interface and instructions on how you can configure and manage

other F-Secure products. It also includes information on F-Secure

Management Agent, F-Secure Policy Manager Web Reporting and

F-Secure Anti-Virus Proxy.

F-Secure Policy Manager Reporting Option Administrator’s Guide

describes how you can generate reports of, for example, virus infection

rates or virus definition database updates in the managed domain. It also

describes the report templates for the most commonly used report types

and how the reports can be customized.

15

Conventions Used in F-Secure Guides

This section describes the symbols, fonts, and terminology used in this

manual.

Symbols

⇒ An arrow indicates a one-step procedure.

Fonts

Arial bold (blue) is used to refer to menu names and commands, to

buttons and other items in a dialog box.

Arial Italics (blue) is used to refer to other chapters in the manual, book

titles, and titles of other manuals.

Arial Italics (black) is used for file and folder names, for figure and table

captions, and for directory tree names.

Courier New is used for messages on your computer screen.

WARNING: The warning symbol indicates a situation with a

risk of irreversible destruction to data.

IMPORTANT: An exclamation mark provides important

information that you need to consider.

REFERENCE - A book refers you to related information on the

topic available in another document.

l

NOTE - A note provides additional information that you should

consider.

TIP - A tip provides information that can help you perform a task

more quickly or easily.

16

Courier New bold is used for information that you must type.

SMALL CAPS (BLACK) is used for a key or key combination on your

keyboard.

Arial underlined (blue)

is used for user interface links.

Arial italics is used for window and dialog box names.

PDF Document

This manual is provided in PDF (Portable Document Format). The PDF

document can be used for online viewing and printing using Adobe®

Acrobat® Reader. When printing the manual, please print the entire

manual, including the copyright and disclaimer statements.

For More Information

Visit F-Secure at http://www.f-secure.com for documentation, training

courses, downloads, and service and support contacts.

In our constant attempts to improve our documentation, we would

welcome your feedback. If you have any questions, comments, or

suggestions about this or any other F-Secure document, please contact

us at documentation@f-secure.com

.

17

1

INTRODUCTION

Overview..................................................................................... 18

F-Secure Client Security Components and Features................. 18

Introduction to F-Secure Policy Manager................................... 23

Basic Terminology...................................................................... 26

18

1.1 Overview

This section describes the main components of F-Secure Client Security

and F-Secure Policy Manager and provides an introduction to policy

based management.

1.2 F-Secure Client Security Components and

Features

F-Secure Client Security is used for protecting the computer against

viruses, worms, spyware, rootkits and other malware, and against

unauthorized access from the network. F-Secure Client Security consists

of Virus Protection, Internet Shield, and Application Management. When

installing F-Secure Client Security, you can select which of these

components are installed.

1.2.1 Virus and Spy Protection

Virus and Spy Protection includes several scanning methods: Real-Time

Scanning, E-mail Scanning, Web Traffic Scanning, Rootkit Scanning, and

Manual Scanning. It also includes System Control, Automatic Updates,

the F-Secure Automatic Update Agent and the Virus News service.

Real-Time Scanning

The Real-Time Scanning feature gives you continuous protection against

viruses and spyware as files are opened, copied, moved, renamed and

downloaded from the Web.

Real-Time Scanning functions transparently in the background, looking

for viruses whenever you access files on the hard disk, diskettes, or

network drives. If you try to access an infected file, Real-Time Scanning

will automatically stop the virus from executing. It will then either remove it

from the file or display a warning, as specified in the security policy. For

more information, see “Configuring Real-Time Scanning”, 166.

CHAPTER 1 19

E-mail Scanning

E-mail Scanning can be used for scanning both incoming and outgoing

e-mail messages and attachments. It prevents viruses from getting inside

the company network and it also prevents you from accidentally sending

infected attachments outside. E-mail Scanning can be configured to drop

infected attachments from incoming e-mails. When it has found an

infection in an outgoing e-mail, it can block the outgoing e-mail traffic until

the problem has been solved. For more information, see “Configuring

E-mail Scanning”, 173.

Web Traffic (HTTP) Scanning

Web Traffic Scanning protects computers against viruses in HTTP traffic.

It scans HTML files, image files, downloaded applications and executable

files, and removes viruses automatically. For more information, see

“Configuring Web Traffic (HTTP) Scanning”, 178.

Rootkit Scanning

If you want to ensure there are no suspicious hidden files, hidden

processes, hidden applications or hidden drives in your computer, you

can scan the system manually for rootkits. For more information, see

“Configuring Rootkit Scanning”, 172.

Manual Scanning

You can use Manual Scanning, for example, after you have installed

F-Secure Client Security, if you suspect that there might be a virus or

spyware on the computer, or if a virus has been found in the local area

network. You can select whether all files or only a certain types of files are

scanned. You can also decide what action to take with an infected file, the

Disinfection Wizard will guide you through the process. You can also use

the Scheduled Scanning feature to scan your computer automatically

and regularly, for example weekly or 1-2 times a month.

20

System Control

System Control is a new, host-based intrusion prevention system that

analyzes the behavior of files and programs. It provides an extra-layer of

protection by blocking undiscovered viruses, worms, and other malicious

code that try to perform harmful actions on your computer. For more

information, see “Configuring System Control”, 171.

Automatic Updates

The Automatic Updates feature keeps the virus and spyware definitions

always up-to-date. The virus definitions updates are signed by F-Secure

Anti-Virus Research Team. The signature is based on strong encryption

and the packet cannot be altered in transit.

In case of complex viruses the virus definitions updates include removal

tools that are executable binaries. The integrity of the delivered

executable code is very important, and F-Secure scanning engines check

that all update code is signed by F-Secure Anti-Virus Research. If the

integrity is compromised, the code will not be executed. For more

information, see “Configuring Automatic Updates”, 162.

F-Secure Automatic Update Agent

With F-Secure Automatic Update Agent, you are able to receive virus

definition updates and informational content without interrupting your

work to wait for files to download from the Web. F-Secure Automatic

Update Agent downloads files automatically in the background using

bandwidth not being used by other Internet applications, so you can

always be sure they will have the latest updates without having to search

the Web.

If the F-Secure Automatic Update Agent is always connected to the

Internet, it will automatically receive new virus definition updates after

they have been published by F-Secure.

When the F-Secure Automatic Update Agent service is started, it

connects to F-Secure’s Automatic Update Server. The agent will keep

polling the server regularly to see whether there is new content available.

The agent downloads only the parts of virus definitions that have changed

Page is loading ...

F-SECURE CLIENT SECURITY 7.00 Owner's manual

This manual is also suitable for

F-SECURE CLIENT SECURITY 7.00 Owner's manual

Related papers

Other documents