BITDEFENDER SECURITY FOR AMAZON WEB SERVICES Beta Version Testing Guide
Bitdefender Security for Amazon Web Services Beta Version Testing Guide Publication date 2015.03.04 Copyright 2015 Bitdefender Legal Notice All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without written permission from an authorized representative of Bitdefender. The inclusion of brief quotations in reviews may be possible only with the mention of the quoted source. The content can not be modified in any way. Warning and Disclaimer. This product and its documentation are protected by copyright. The information in this document is provided on an as is basis, without warranty. Although every precaution has been taken in the preparation of this document, the authors will not have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. This book contains links to third-party Websites that are not under the control of Bitdefender, therefore Bitdefender is not responsible for the content of any linked site. If you access a third-party website listed in this document, you will do so at your own risk. Bitdefender provides these links only as a convenience, and the inclusion of the link does not imply that Bitdefender endorses or accepts any responsibility for the content of the third-party site. Trademarks. Trademark names may appear in this book. All registered and unregistered trademarks in this document are the sole property of their respective owners, and are respectfully acknowledged.
89504E470D0A1A0A0000000D494844520000002000000020010300000049 B4E8B7000000017352474200AECE1CE900000006504C5445FFFFFF000000 55C2D37E0000009A4944415408D76370FB7BCF85E1BDE2321706DE847DDF 185A5B5858189454BBAA18EAFFEFBFCF90FFF7DF3F0630F8CCA42DC9A0C0 14A7CC30E58C763FC3751EAFC50C0C4E40C5F5F54075E5E7ECE743D4ED0A 4ECC62B831977D06C365F5E3090C13AE262932743330CE60F80F52575DBF FC3644DDEB695EDB19AC4D2EB533342D5BB198C1E5E9AA030C960C01EC40 75FFFF31FC2FFFF51DAC0C00A09339A3914312FC0000000049454E44AE42 60827A3431793A70666765303133406F316771337333617133652E70307A
Table of Contents 1. Introduction....................................................................... 1 1.1. About GravityZone................................................................ 1 1.2. New integration with Amazon Elastic Compute Cloud (EC2)............................ 1 1.3. New Bitdefender Endpoint Security Tools (BEST)..................................... 2 2. Testing Guidelines................................................................ 3 2.1. Functionality Testing.............................................................. 3 2.2. Performance Testing.............................................................. 4 3. Getting Help....................................................................... 6 iv
1. Introduction 1.1. About GravityZone Bitdefender has applied over a decade of security expertise and innovation for creating a highly scalable and integrated security management platform based on its new Gravity Architecture. The solution provides full visibility into organization s overall security posture, global security threats, and control over its security services that protect Amazon EC2 servers together with virtual and physical machines. All Bitdefender s security solutions are managed within GravityZone and a single console that provides control, reporting, and alerting services for various roles within the organization. 1.2. New integration with Amazon Elastic Compute Cloud (EC2) From the hosted, web-based management component called GravityZone Control Center, administrators are enabled to integrate with the Amazon Elastic Compute Cloud (EC2) service and centrally deploy, administer and monitor Bitdefender security on their instance inventory. Proprietary scanning servers are hosted by Bitdefender in the AWS Cloud to ensure an optimal footprint on the protected instances and to eliminate the scanning overhead occurring with traditional security software. In addition to Amazon EC2 instances, Bitdefender GravityZone is also designed to secure: Physical Environments: protects unobtrusively any number of physical computers by using number-one-ranked antimalware technology combined with firewall, intrusion detection, web access control and filtering, sensitive data protection and application control. Security for Endpoints offers protection for physical computers and laptops running on Windows and Mac OS X operating systems and Windows servers. Employee productivity is ensured with low resource consumption, optimized system scanning and automated security that requires no end-user interaction. Virtualized Environments: protects virtualized servers and desktops on Windows and Linux systems. Powered by cutting edge security technologies from Bitdefender, Security for Virtualized Environments has been specifically architected to meet the unique requirements of dynamic virtualized datacenters today. Introduction 1
1.3. New Bitdefender Endpoint Security Tools (BEST) While keeping all the above-mentioned features and components, the new Beta version GravityZone makes a step forward to the management of heterogeneous networks by bringing the Next-Generation Agent Bitdefender Endpoint Security Tools(BEST), able to protect both physical and virtual endpoints. Compatible with Windows, Mac OS X and also Linux systems, Bitdefender Endpoint Security Tools brings the benefits of both Bitdefender Tools and Endpoint Security v.5.x under the same umbrella. Administrators can deploy the new client on any machine, either virtual or physical, having the possibility to opt between different scanning technologies (Local with full engines, Private with Security Server and Public with the Bitdefender Cloud). Important security features such as Active Virus Control, Firewall and Content Control are now available for virtual desktops as well. Moreover, the physical endpoint clients can be configured to offload the heavy part of the scanning process to a dedicated virtual machine (Bitdefender Antimalware Cloud). Along with Bitdefender Endpoint Security Tools, the new Beta version of GravityZone also brings several improvements, including one single policy template for physical and virtual endpoints, a new deployment installation wizard and single network view for physical and virtual endpoints. Introduction 2
2. Testing Guidelines Please follow the guidelines below to test the Amazon EC2 integration with GravityZone beta. 2.1. Functionality Testing 1. Test the integration with your Amazon EC2 inventory as described in the Installation Guide. a. Enter a valid key set of AWS credentials and perform the integration. Depending on the size of the inventory to be imported, the synchronization will take anywhere between 15 seconds and a few minutes. b. Enter an invalid key set of credentials and check if you receive an error. 2. Once you have setup the integration, go to the Network area and check if you have the Amazon EC2 node within Custom Groups. Verify if your AWS regions and Availability Zones are correctly displayed. By default, Control Center will import only the regions and Availability Zones where you have at least one running instance. 3. Test the AWS-specific filters in the Network area: a. Filter by EC2 instances in the Type tab. b. Filter by the instance state in the Power tab. c. Filter by the AWS tag attached to an instance or group of instances in the Tag tab. The tag attribute and value will have to match the identifiers you have previously defined in your AWS account. 4. View the instance properties by clicking an entry in the Network grid. 5. Create a deployment package with the Relay role activated and the Automatic scan mode selected. Deploy this package on a Windows-based instance that will run permanently throughout the testing period. Note At least 6 GB free disk space is required for entities with Bitdefender Endpoint Security Tools Relay role, as they will store all updates and installation packages. 6. After deploying the Relay agent, run a remote deployment task on Windows-based instances and check if they install successfully. Testing Guidelines 3
7. Test the local deployment on Linux-based instances as described in the Installation guide. 8. From the Policies menu, create a security policy and assign it on the protected instances. This will override the default policy assignation on the target machines. Check the policy assignation status in the Policies view. 9. Access your Amazon Web Services console and terminate one of the Managed instances that is protected with Bitdefender Endpoint Security Tools. Wait until the instance gets terminated in the AWS console and then look it up in your Amazon EC2 inventory from Control Center, in the Terminated Managed Instances folder. If you cannot locate the terminated instance, force the synchronization with Amazon EC2 by clicking the Sync button from the right side of the Network page. 10. Test the Quarantine functionality. a. Go to Policies and create or edit a policy template. b. In the policy settings, go to Antimalware > On-Access > Settings > General and set the default action for infected file as Move to quarantine. c. Check that the new policy is received by the endpoint. d. Try to download an EICAR test file. e. Check if the file was removed from the original location. f. Check the file in the quarantine section and delete / restore / download the file. 11. Generate on-demand and scheduled reports from the Reports menu. If you have chosen to create an instant report, it will be displayed immediately after clicking Generate. If you have chosen to create a scheduled report, it will be displayed in the list on the Reports page. Once the report has been created, you can view it by clicking its corresponding link in the View report column on the Reports page. Verify that the generated reports contain the expected information. 2.2. Performance Testing The following steps should be done for each scan engine type and for all features that are available in Bitdefender Endpoint Security Tools. 1. Open the Bitdefender Endpoint Security Tools interface by double-clicking the Notification Area (SysTray) icon and observe the following: a. Main Status: once the client installation is done, the status shows that the computer is secured. Testing Guidelines 4
b. General section: contains an event informing that a policy has been received. 2. Click the button at the right side of the Main Status to expand the Tasks action bar. Click Quick Scan, then run also a Custom Scan. a. Verify that all scans run locally successfully without any issues regardless of the used engine type. b. What do you think about the scan speed? c. What is the overall scan experience in relation to the old client? 3. Right-click the Notification Area (SysTray) icon, select About and observe the following: a. Update is checked and performed. b. Verify the displayed information. 4. With Bitdefender Endpoint Security Tools installed, please use your system as before and tell us about the product impact on your computer for each of the 3 engines use: a. CPU and Memory consumption b. Slowdowns or application crashes c. Slow Internet access Testing Guidelines 5
3. Getting Help To find additional help resources or to get help from Bitdefender: Click the Help and Support link in the lower-right corner of Control Center. Go to our online Support Center. To open a support ticket, go here and fill in the form. Getting Help 6