Patch Management SoftwareTechnical Specs 1. Scalable: a. The PMS (Patch Management Software)must be scalable(can grow as network grows). b. The PMSmust be able to support more than 10k nodes from a single management server. 2. Agent: a. The PMS must modularlydeliver product capabilities. b. The PMS must be able to prevent users from disabling security capabilities. c. The PMS must eliminate agent performance load on endpoints and simplify agent version upgrades from server side. 3. Management: a. The PMSmust support domains, user groups, and individual users set up in Active Directory. b. The PMS must support the WOL capability for devices that have been powered down. c. Devices can be commanded to wake up at any given time (support on-demand and scheduled WOL signals). d. The PMSmust enable different users to have distinct views and system access dependent on their role or security level in the company (RBAC feature). e. The PMSmust be able to provide RBAC based on AD user accounts. f. The PMSmust be based on a single, integrated web-based management console. g. The PMSmust ease system administration via a workflowbased navigation and an intuitive management console (all configurations must be via easy-to-use wizards). 1
h. The PMSmust provide full visibility and control of the entire endpoint environment from the centralized management console. i. The PMSmust be able to provide an extensive inventory details covering hardware, network, operating systems, services, and installed software. j. The PMSmust provide tools to scan the environment for endpoints, to provide comprehensive. k. The PMSmust provide built in tools to centrally deploy the client to target endpoints. l. The PMSmust be able to deploy agents to unmanaged systems interactively, automatically or on a scheduled basis. m. The PMSmust enable management of both physical and virtual systems within the same endpoint management solution. n. The PMSmust be able to distinguish between physical and virtual endpoints. o. The PMSmust provide access to remote control tools, such as Microsoft Remote Desktop (RDP), VNC, Putty, as well as diagnostic tools, such as PING and NSLOOKUP, directly from the management console. 4. Patching: a. The PMSmust be able to deploy patches to heterogeneous endpoints to ensure operating system and 3rd party application vulnerabilities are eliminated. b. The PMSmust support both security and non-security patch content. c. The PMSmust support Microsoft operating systems and applications, as well as non-windows OS s like Red Hat, Apple Mac OS, Oracle Linux, HP-UX and more. d. The PMSmust support baseline policies across multiple endpoint groups. 2
e. The PMSmust provide a feature that allows building custom patch lists (custom grouping of selected content). f. The PMSmust support detection, deployment, patching, and remediation of 3rd party and in-house content. g. The PMSmust have an automated mechanism to assess endpoints. h. The PMSmust have a completely secure and trusted patch delivery process to ensure content metadata and binaries are retrieved in a secure manner (including encrypted tunnels and hashing). i. The PMSmust provide mechanisms for flexible remediation at the global level, group level and single endpoint level. 5. Reporting: a. The PMSmust support customizable dashboards providing instant, actionable and customized display of endpoint status. b. The PMSmust provide reports providing centralized visibility of IT assets and the security posture of the endpoint environment. c. The PMSmust be able to export reports in various formats. d. The PMSmust be able to schedule reports. e. The PMSmust support automated email notifications for selected endpoint events or system errors. 6. Antivirus: a. The PMSmust be able to identify and remove all known malware via traditional signature-matching capabilities. b. The PMSmust deliver advanced protection via partial signature matching, hidden malware detection and behavioral analysis techniques. c. The PMSmust provide granular AV policy management with CPU throttling to ensure endpoint performance and user productivity are not impacted by AV scans. 3
4 d. The PMSmust be able to deploy the latest AV definition files and identify those endpoints that are not up to date. e. The PMSmust be able to deploy frequent and small AV updates ensuring faster response to detected threats yet minimal impact on protected endpoints. f. The PMSmust have the ability to delay AV definitions for testing (i.e., deploy new definitions to test endpoint(s) only until it is ensured they have no negative effect then roll them out to remaining endpoints). g. The PMSmust have a smart caching feature, which means that most scanned files will be remembered, and as long as they didn t change those files won't be rescanned again during subsequent scan requests, thus resulting in greatly reduced scan times. h. The PMSmust ensure complete protection against all known malware, including viruses, Trojans, rootkits, spyware and adware. 7. Device Control a. The PMSmust be able to centrally control and enforce security policies regarding use of removable devices (e.g., USB flash drives) and media (e.g., DVDs / CDs) to prevent data loss and theft, thwart malware intrusion, and protect data via encryption. b. The PMSmust provide the FIPS 140-2 validated encryption technology needed to protect data on removable storage devices / media. c. The PMSmust be able to add another layer of protection against malware by blocking USB-borne malware. d. The PMSmust support granular permissions to control access at device class (e.g., all USB flash drives), device group, device model and/or even unique ID levels; for instance, restrict access rights to a specific device of a company-approved model.
e. The PMSmust have ability to control mobile devices in flexible manner for example block access to smart phones but let them charge normally when connected to PC s. f. The PMSmust be able to grant users temporary access to removable devices / media, which can be used to grant access "in the future" for a limited period. g. The PMSmust support permissions/restrictions caching, meaning they remain effective even when endpoint is offline. h. The PMSmust support applying different set of policies depending on whether the endpoint is online or offline (online vs. offline permissions). i. The PMSmust be able to restrict the daily amount of data copied to removable devices (such as USB flash drives) on a per-user basis (e.g., 25MB per user per day). j. The PMSmust be able to log all device usage and data transfer activity. k. The PMS must be able to keep a complete copy (i.e., entire file contents) of all files that are read from and/or written to removable devices (e.g., USB memory drives) and media (e.g., DVDs / CDs) on a per user or user group basis (shadowing feature). l. The PMSmust be able to restrict and manage the types of files that are moved to and from removable devices such as USB sticks, and media such as DVDs/CDs (file type filtering feature). m. The PMSmust provide ability for forced or optional encryption of USB storage devices and CD/DVD discs for added protection. Licenses All Licenses for 500 end point are included. 5
Professional services Installation, configuration and professional services of software on server and deployment on 500 end point should don by manufacture company expert Training On-site Training course of purpose PMS (Patch Management Software) for four persons Min are included. support One year support for The PMS(Patch Management Software)and 500endpoint. 6