Empower Software and Security Software Interactions

Size: px

Start display at page:

Download "Empower Software and Security Software Interactions"

Ashlynn Ward
6 years ago
Views:

1 TECN Rev. 00 Page 1 of 7 Empower Software and Security Software Interactions This Technical Note discusses how Empower software functions and examines potential interactions with anti-virus software as well as other PC-based security software. It also provides recommended actions. It does not discuss the use of appliance-type network security solutions. Except where noted, Empower refers to Empower (Build 1154), Empower 2 (Build 2154), and Empower 3 (Build 3471) software. This Technical Notes does not document interactions between other Waters products such as MassLynx or UNIFI and security software. Empower background Empower is a distributed data acquisition, processing, and control application. It is a scalable solution. This discussion focuses on the Enterprise configuration where application components are distributed among separate physical machines in a network environment. The Empower system consists of the following components: Database server An Oracle database (Versions 9, 10, and 11) generally running on a Windows Server platform. Other solutions include the Solaris UNIX and Linux operating systems. File server A Windows platform designed to host raw data files and serve them to other components of the application. Client A Windows platform designed to allow a user to interact with the Empower application. Acquisition node A Windows platform designed to control and collect data from analytical laboratory instrumentation. A Windows database server generally includes database, file server, and client components as part of a standard installation. UNIX database deployments require the use of a separate Windows file server. In the Personal configuration, all components are present in a single physical machine. Security software background Companies such as Symantec, McAfee, and Sophos provide solutions designed to protect computing resources from network threats. These threats include viruses and denial-of-service attacks. The typical components of a security solution include: File system protection Usually a low-level program designed to intercept disk access before user-mode programs in order to prevent virus infections. Network protection Usually a low-level program designed to intercept network access before user-mode programs in order to prevent virus infections. In most cases these solutions support a set-and-forget approach that operates in the background in addition to a more aggressive interactive approach. The interactive approach is generally a full scan in that processes in memory and examines every file on the computer.

2 TECN Rev. 00 Page 2 of 7 Basic Empower activities Data acquisition Empower data is acquired using one or more of the following communications technologies: Serial o Onboard serial port o Equinox serial card or Avocent Serial hub connected through Ethernet o A card supplied by Waters o USB-to-serial converters Ethernet using additional network card(s) configured into a bridged network, generally referred to as the instrument LAN USB control of instruments not manufactured by Waters IEEE-488 o Control of instruments manufactured by Waters and controlled through a buslac/e card o An Ethernet to IEEE-488 converter Independent of the communications protocol, Empower issues commands to and collects data from instruments in a near real-time fashion. The initial activity is generally performed remotely via the use of COM and DCOM communications protocols. For example, a user sitting at a client PC may instruct a system connected to a remote computer to begin collecting data. Instruments have sufficient memory to buffer data for very short periods of time (1 to 15 seconds) and have similar timeout values. However, if the underlying operating system closes or is instructed to close a connection to an instrument, failure is likely and a message is recorded in the Empower Message Center. Closing a communications connection may occur, for example, during an update of the security software. This activity on the part of the security software is used to prevent an attack from succeeding during an unguarded moment. While this type of vulnerability is mainly Ethernet-based, it may also occur on other communications protocols. Empower has the ability to detect and respond to disconnections between the acquisition level and the database/file server level. Similarly, writing data to the local disk is a significant activity. If a security solution interferes with this process, then one or more of the following conditions may occur: Instrument failure or hanging Loss of data

3 TECN Rev. 00 Page 3 of 7 The typical programs involved in data acquisition include: watersservice.exe instrumentserver.exe wdhcpserversvc.exe quickset.exe quickstart.exe For the Waters ACQUITY product line, there are control applications that run and access the instruments through the Instrument LAN. These include: acquityconsole.exe yyyserver.exe, where yyy designates the type of instrument (such as BSM and QSM for pumps, and FTN and SM for injectors) When the Instrument Control Driver is supplied by a 3rd party, the application file names may vary. The most likely interruptions to data acquisition are: Access to local hard disk to cache collected data Access to remote hard disk during transfer of data Communications with instruments connected to the acquisition node The actual interruption may go unnoticed by the end user because Empower was designed to collect data in the background, often on a remote node where no one is actively logged in. In most cases this prevents immediate and obvious notification that an issue has occurred. An administrator can review logs such as the alert.log, sqlnet.log, recover.log, various OS event logs and others to determine the nature of the issue. Data processing The Empower application processes data via the client component which reads raw data from the file server component. Processed areas, amounts, and other data are then returned to the Empower database on the server. The most likely interruption to data processing is in the area of supplying data. In some cases, when security software has been configured to do so, there may be an interactive alert. In a Citrix environment, the alert message may appear on the console of the server and will not be visible to the user. An administrator can review logs such as the alert.log, sqlnet.log, recover.log, various OS event logs and others to determine the nature of the issue. Another possible behavior related to use of security software and Empower is the inability to launch some Empower applications, particularly when using the Pro Interface. For example, opening a project from Configuration Manager uses the DCOM protocol. If the security software interferes with the transfer of information, the user may receive a failed to launch message. While there are other reasons for this message, the effects of a too aggressive security system need to be eliminated.

4 TECN Rev. 00 Page 4 of 7 Recommendations General Install the Empower application, Waters-supplied instrument drivers, and 3rd party software as an Administrator and with the security software temporarily disabled. For systems using Microsoft products, this would include the Windows Firewall and Defender programs. It is important to remember that some security systems may contain multiple components such as antivirus and intrusion prevention/detection. When changing the configuration during installation or on a routine basis, remember to address all of these security components. If your system is running on Windows 7, you should disable Microsoft User Access Control. Excluding folders and files from scanning If possible, exclude the \Empower folder and all sub directories from real time scanning. If not, then you should exclude the following files from scanning and other activities: Folder \empower\bin Files to exclude *.exe *.ocx *.dll Comments There are language-specific folders for English (en), Japanese (ja), Chinese (zh) and Korean (ka). You should exclude the all.dll files in these directories as well. \empower\html All files Used to display certain user interface elements. \empower\instruments\bin *.exe \empower\instruments\html All files Used to display certain user interface elements. \empower\instruments\settings All files Used to store some instrument settings. \empower\instruments\temp All files Empower may create temporary files here. \empower\instruments\3rd party vendor folder(s) 3rd party drivers may also install into \empower\instruments. Consult the 3rd party vendor for information regarding any files that should be excluded. \empower\logs All files Log files are created during certain activities such as batch backup or batch restore. \empower\oracle \empower\projects and \empower\restore \empower\scripts *,dat *.inf *.cks *.exp *.log *.txt *.sql *.txt *.log *.bat Refer to the section on Oracle files. Accessed when performing specific functions such as upgrading projects and databases.

5 TECN Rev. 00 Page 5 of 7 NOTE: During development and testing, Waters configures Empower nodes by excluding the \empower folder and all subfolders. Waters strongly recommends that customers exclude the folders rather than specific file types for this reason. In addition, you should also exclude directories for Waters-supplied and 3rd party instrument drivers if they installed into directories other than those under the Empower folder. If you are unable to exclude directories, contact the instrument driver vendor for assistance in determining the specific file types to exclude. Excluding Oracle-related files In document ID # , Oracle recommends at a minimum the following files be excluded: Oracle datafiles Control files Redo-log files Archived redo-log files if database is in archive log mode *.ora files Password file *.log files in the ORACLE_HOME folder The Oracle document indicates that these files need to be open all of the time in order for the database to be accessible. Security software may place a temporary lock on the file which would prevent access by Oracle. The effect of this lock may be a database hang, crash, or other unexpected behavior. Program exceptions to the firewall Where possible, configure firewall software to allow, or to allow and log communications access. If firewall software is configured to deny a connection, ensure that the denial is logged to aid in troubleshooting. If possible, eliminate firewall protections on the instrument LAN. Connect only supported instruments on the Instrument LAN. Do not attach printers, computers, or other devices to the instrument LAN. The Empower 3 Installation and Configuration Guide lists the Waters-supplied applications that should be added as exceptions to the firewall. Refer to the Release Notes for Waters supplied software issued after the release of Empower 3. Additional exceptions may be needed if 3rd party drivers are in use. Document the security software and limit changes Security software suites often use a mechanism similar to Active Directory group policies where PCs are grouped into collections. Waters recommends that you configure Empower database servers, file servers, clients. and LAC/E 32 modules into their own collection. Define and document the configuration and whether and how often changes to the configuration are allowed.

6 TECN Rev. 00 Page 6 of 7 Monitor on a frequent basis Encourage users to document their experiences in order to establish a baseline. System administrators should review logs generated by security software on a periodic basis searching for the terms empower" and "waters," as well as other key topics such as the name(s) of a 3rd party instrument vendor whose driver is in use. Troubleshooting and diagnosis When an issue occurs, obtain the following information: Description of the issue 1st occurrence of the issue Last occurrence of typical behavior Any recent changes Logs and other information which may be of a transient nature Operating system event logs Empower message center Empower recover log Service Profile (if system is an ACQUITY) Agilent ICF logs (if system is an Agilent) 3rd party security software logs (if not logged into the OS event logs) which may include: o Ports or programs blocked o Files quarantined o Program updates If behavior occurs with sufficient frequency, consider disabling the security software for a short period of time. If this eliminates the behavior, then you can assume that the security software is contributing to the behavior. Change one component at a time whenever possible. Determine whether the interruption was temporary in nature such as during buffering. Use the instrumentserver recover command while logged in as a domain administrator to upload raw data files to the file server. If manual data recovery works, then the interruption is generally security related. Consider running the watersservice.exe service as a domain user rather than as SYSTEM. In order to do this, the domain user will need full control of the Empower project share directories. Review the collected logs to determine whether an event such as a program update, security scan, or quarantine of one or more files or processes occurred at the time of the behavior. Consider configuring additional exceptions to the security software as indicated by the logs. These could include: Delay of program updates to an idle time Allowing rather than blocking of programs and/or processes

7 TECN Rev. 00 Page 7 of 7 Contact Waters Support through your local subsidiary for assistance as required. Be prepared to supply the logs collected above, any investigation performed, and the results of such investigations. NOTE: When making any changes to a system, you should consider the applicable Standard Operating Procedures (SOPs) and complete the appropriate documentation and validation.

Empower 3 Feature Release 3 Hotfix 1 Release Notes

*716004786* *Rev.A* Empower 3 Feature Release 3 Hotfix 1 Release Notes 716004786 Revision A Copyright Waters Corporation 2016 All rights reserved General information Copyright notice 2016 WATERS CORPORATION.