DB Secure-Access-Portal User Guide for RAS VPN

Transcription

1 DB Secure-Access-Portal User Guide for RAS VPN DB Systel GmbH User Guide for RAS VPN Version 1.38 As at: 6 th of July 2016

2 Contents: 1. Introduction 3 2. Preparing Your Terminal Internet Access Virus Protection Note to configure antivirus software Firewall Pulse Secure Installer Service Java Runtime Environment Configuring the Web Browser Internet Explorer Firefox Safari for Mac 9 3. Using the RAS VPN Solution Logging in to the DB Secure-Access-Portal Accessing Corporate Resources Closing the RAS VPN Session Further Information on the RAS VPN Solution Changing the BKU Password Using Group Drives Support Services of DB Systel Prerequisites Helpdesk DB Systel Contact Information System Requirements Operating Systems and Web Browsers Supported Operating Systems for Host Checker, Cache Cleaner and Network Connect Supported Operating Systems for Pulse Secure Client Requirements for access to Web bookmarks by RAC VPN Virus Protection Software Supported Products Supported Enabled Products without Support 19 DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 2 / 21

3 1. Introduction Deutsche Bahn offers an RAS VPN solution based on SSL technology that enables users to dial into the corporate network from any terminal. The new RAS VPN solution is available in two variants: 1. RAS VPN (Remote Access Service Virtual Private Network) with full access The RAS VPN variant offers secure full access to the corporate network via the Internet. For this purpose, a special VPN client (Network Connect or Junos Pulse) is available, which thus connects the terminal to the corporate network as if it was connected in the local network. 2. RAC VPN (Remote Application Connect Virtual Private Network) The RAC VPN variant offers secure partial access to the corporate network via the Internet. Here, you can use the Web browser to access application systems activated for you as well as other general Web applications such as DB intranet. Restrictions or conditions for the use of Web bookmarks, see section 5.4 on page 18. The functional differences between RAS and RAC VPN are listed in the following table: Function RAS VPN RAC VPN Access to Local Network Drives No Yes Usage with BKU-Client possible Yes Yes Usage with Non-BKU Client possible Yes *) Yes Unrestricted Internet Access Non-BKU: No BKU: Yes Yes Lotus Notes Yes Via DB Mail Local Connected Network Printer No Yes Central Printing (Network Printer DB) Non-BKU: No BKU: Yes No Clientless Access No Yes Admin privileges required Yes No *) A remote access VPN connection can be established by a non-bku client, if the endpoint security check could be carried out successfully. This assumes that on the client a supported operating system (see section 5.2 on page 17) and a supported virus scanner (see section 5.5 on page 19) are installed, the virus scanner is started with the real-time scanning, and the virus and spyware definitions are not older than 5 days. This document is intended, in particular, for users who work with clients not managed by DB Systel. In order to use remote access effectively, you are strongly advised to carry out the preparatory steps for your terminal as described in chapter 2. Administrator rights are required for this purpose. If you do not already have these rights, contact the administrator responsible. To use the new RAS VPN solution, you require: Your activated ActivIdentity token 1 (ActivIdentity Mini Token or SMS Token) and the associated PIN 2 you assigned yourself when you activated the token A computer with an Internet connection and Web browser For every user a bandwidth ranging from 5 up to 10 Mbit/s is available. The usable bandwidth is not guaranteed and may be reduced significantly due to a software distribution on BKU clients. A full utilization of the bandwidth of the domestic DSL / cable connection (e.g. 50 Mbit/s) is not possible for technical reasons. Depending on the type and stability of the network connection, the transmission speed varies, for example in the use of UMTS/LTE or Wi-Fi. 1 You can access the instructions for activating and using tokens at 2 You will not be sent a PIN/password letter for the PIN you assigned yourself. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 3 / 21

4 2. Preparing Your Terminal 2.1 Internet Access Make sure that the terminal you are using is connected to the Internet or is suitably equipped to be able to connect to the Internet as and when required. 2.2 Virus Protection Remote access to the IP network of Deutsche Bahn is only possible if virus protection software (see section 5.5 on page 19) has been installed on the terminal. In addition, all of the following conditions must be fulfilled: 1. Virus scanner is active 2. Realtime scanning is activated 3. Virus and spyware definitions are up to date Make sure that virus protection that fulfils the specified requirements is installed on the terminal. Important: Before you upgrade your virus scanner to a new version (e.g. from 9.x to 10.x), please refer to the latest version of the User Guide to determine whether this version is supported by the DB Secure- Access-Portal Note to configure antivirus software Avira Free Antivirus Avira Free Antivirus is configured by default, that the hosts file is write protected on Windows operating systems. Under certain circumstances it may be necessary to allow such access when client-side components of the DB Secure Access Portal (eg JSAM, Java Secure Access Manager) require this. Avira blocks write attempts to the Windows hosts file and brings an appropriate warning. If you find such behavior in a remote access scenario, you can configure Avira Free Antivirus so that write access to the hosts file is permitted. To do this, open the configuration dialog (point in the toolbar to the Avira icon, right click the mouse button and choose "Configure Avira Free Antivirus") and make sure that the expert mode is enabled. Hook under General-> Security -> System protection the option "Protect Windows hosts files from changes" as follows: Then click OK to confirm the changes. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 4 / 21

5 2.3 Firewall Terminals deployed in corporate networks are usually protected by a central firewall. Access to the DB Secure-Access-Portal ( via port 443 TCP is a minimum requirement. Experience has shown that Internet Web sites protected via SSL are generally activated, which means that no further action is required here. If a personal firewall in installed on the terminal, please check whether this type of communication is permitted. If necessary, the firewall rule set must be modified accordingly. 2.4 Pulse Secure Installer Service The DB Secure-Access-Portal occasionally requires specific client components to be installed for which the user logged in must, in certain cases, have administrator rights. To enable users without administrator rights to use the RAS VPN solution without any complications, you are strongly advised to install the Pulse Secure Installer Service. The Pulse Secure Installer Service enables Pulse Secure Client components to be downloaded, installed and upgraded automatically even if the user does not have administrator rights. Download the Pulse Secure Installer Service (file name: PulseSecureInstallerService.exe) on the DB Secure-Access-Portal login page and install it on your terminal. To do so, log in as administrator. When you double-click the installation file, the installation proceeds without user interaction. After the installation has finished the following dialog box appears: Click the "OK" button. You do not need to restart your computer. The installation procedure was successful if the Pulse Secure Network Service has been installed correctly and is launched. Create the Whitelist.txt text file in the "%ProgramFiles%\Juniper Networks" directory with the following line: vpn.extranet.deutschebahn.com Note: You do not need to install the Network Connect client / Pulse Secure Client / Pulse Secure Installer Service to access individual applications via RAC VPN. You do not, therefore, need administrator rights and are only granted access to those applications permitted in accordance with the security classification. 2.5 Java Runtime Environment If you intend to use the Web browser Mozilla Firefox, which does not support ActiveX as standard, you must install a Java Runtime Environment (JRE). Certain Juniper Client components are downloaded and executed as Java applets if ActiveX is not available. With the following link you can check the currently installed Java version and update if necessary to the newest release: The minimum requirements for the JRE are specified in section 5.1 on page 17. We recommend that you always use the latest version. This was Java Version 7 Update 75 and Java Version 8 Update 91 at the time this document was created. Important Note: On 64-bit operating systems it is strongly recommended that the 32-bit version of the JRE should be installed, because this has been proven in practice to be more reliable. In any case, please make sure that the web browser and JRE support the same processor architecture (32 or 64 bit). Once you have installed the JRE in accordance with the manufacturer's instructions, you have to activate Java support for Mozilla Firefox. Launch the Java Control Panel (Start menu -> Start -> Settings -> Control Panel -> Java) and click the "Security" tab page. Under the setting "Standard Java for browsers", select "Mozilla family" as shown in the screenshot: DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 5 / 21

6 In order to avoid warnings when using mixed code is recommended that the default setting "Enable show warning if needed" is changed as follows: To avoid the unnecessary blocking of Java applets by the DB Secure-Access-Portal with Java version 7 Update 51 and above the website DB Secure-Access-Portal should be added to the exception site list (applies to all supported browsers): Then click the "Apply" and "OK" buttons to confirm the setting. If the following Java Security Warning from the application "Juniper Status Applet" appears, then please check the setting as shown and click "Allow": DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 6 / 21

7 2.6 Configuring the Web Browser Important: The Web browser is normally configured by the RAS VPN user. It is, however, not uncommon for Web browsers to be configured centrally based on Microsoft group policies on managed terminals within corporate networks. In this case, modifications would need to be made centrally. The information in the following sections assumes that the Web browser is configured locally and focuses on Microsoft Internet Explorer, Mozilla Firefox and Safari, the browsers that dominate the market Internet Explorer Trusted Sites Proceed as follows to add the login page of the DB Secure-Access-Portal to the trustworthy sites zone. Open Internet Explorer and choose Tools -> Internet Options. In the dialog box that appears, click the "Security" tab page and select the zone "Trusted sites". Then click the "Sites" button: Fig. 1: Internet Options Security Fig. 2: Trusted sites Enter in the input line and click the "Add" and "OK" buttons to close the dialog boxes Deactivating the Option for Saving Passwords Microsoft Internet Explorer offers a function called AutoComplete, which allows you to save the passwords you enter in form fields on Web sites so that they are defaulted the next time you visit the site. This feature is highly questionable from a security perspective and is also rather restrictive because user authentication takes place by means of a one-time password. It is, therefore, important that you deactivate this function. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 7 / 21

8 Open Internet Explorer and choose Tools -> Internet Options. In the dialog box that appears, click the "Content" tab page. Then click the "Settings button under AutoComplete. Fig. 3: Internet Options Content Fig. 4: Settings for AutoComplete Deselect the options "Forms" and "User names and passwords on forms". Confirm your entry by clicking the "OK" button in both dialog boxes Firefox Popup Blocker Firefox normally blocks unwanted popups on Web sites. If you deactivate this setting, popups will be allowed. When you use the DB Secure-Access-Portal, popups are, however, allowed. In this case, you can allow popups to be opened. To do so, choose Tools -> Options and click the "Content" icon in the "Options" dialog box. Then click "Exceptions" to the right of "Block pop-up windows", enter the address of the DB Secure-Access-Portal vpn.extranet.deutschebahn.com and click "Allow". Fig. 5: Firefox Options - Content Fig. 6: Firefox Allowed Sites Pop-ups DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 8 / 21

9 Saving Passwords Firefox can save passwords that you enter in forms, thereby making it easier for you to log into Web sites. Deactivate this option to prevent Firefox saving passwords. Even if you choose this option, you will still be asked if you want to save your password the first time you visit a Web site: If you choose "Never for This Site", the Web site will be added to a list of exceptions. To access this list, for example, in order to delete entries, choose Tools -> Options. In the dialog box that appears, click the "Security" tab page and the "Exceptions" button: Safari for Mac Save passwords Safari can save passwords that you enter in forms, thereby making it easier for you to log into Web sites. It is generally recommended not to use this option Deactivate this option to prevent Safari saving passwords. Please open Safari browser and click in the Finder menu Safari -> Preferences and in the following window on the icon AutoFill : DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 9 / 21

10 The "User names and passwords" should not be active. If you do not want to miss this convenience function, it is strongly recommended that at the first login to the DB Secure Access Portal to refuse to have the password. Click on the Passwords icon and verify the appropriate setting: Java support For full access it is recommend to enable Java support. Please verify that you have an up to date Java Runtime Environment installed on your Mac. Under Security please select Enable Java and Enable JavaScript : It s also important that Block pop-up windows is deselected! Click on the "Manage Website Settings..." and add the URL of the DB Secure Access Portals, as follows: DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 10 / 21

11 3. Using the RAS VPN Solution 3.1 Logging in to the DB Secure-Access-Portal Start the browser (preferably Internet Explorer) and enter the following link: This calls the login page for the DB Secure-Access-Portal. Log in with your BKU user name, PIN and token code: Note: The label of the second input field is focused on the use of a hardware token. Users with SMS token should follow the instructions in the specific token user manuals. Enter your BKU user name in the "BKU user name" field. Generate a one-time password (token code) by pressing the button on your ActivIdentity token and enter your token PIN, followed by the token code in the relevant field. Then click the "Log in" button. If you are logging in with a token for the first time, the required software component Host Checker and Network Connect are downloaded automatically and installed on your terminal. This takes place once and is only repeated if necessary, for example, if the software components are updated. If you have a slow Internet connection (e.g. via modem, ISDN or GPRS), it may take more than ten minutes to download the software components. For this reason, it is strongly recommended that you use a LAN, DSL or WLAN connection. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 11 / 21

12 Important: Depending on your system configuration, you may be prompted to enter an administrator password. You do not need to do this to gain access to individual applications (RAC VPN). Leave the administrator password field empty and close the window by clicking the relevant button ("No" or "Cancel"). Further messages/warnings/requests may then be displayed that must be confirmed (Digital signature - Run?, Juniper script requests authorization - Allow?, Trust content of initiator vpn.extranet.deutschebahn.com - Yes/No?, Install Cache Cleaner and Host Checker software - Yes/No?). The load operation for the Host Checker is displayed in the browser window: A green dot appears in front of the component name to indicate that the component has been successfully loaded. The security status of your terminal determines whether full access by means of Network Connect is permitted (variant RAS VPN only). The Host Checker verifies whether the following prerequisites are met: Current Service Pack for Windows operating systems (see 5.1 Operating Systems and Web Browsers Supported on page 17) A virus scanner approved by DB Systel is used (see 5.5 Virus Protection Software Supported on page 19) Virus signature not older than 5 days Real-time protection is activated in the virus scanner Important: If you have not connected your terminal to the corporate network for some time, the virus scanner may not fulfil the prerequisites due to an obsolete virus signature. In this case, an appropriate error message is displayed in the browser. Update the virus scanner and make sure that realtime protection is activated. Then click "Try again". DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 12 / 21

13 Users who are authorized for full network access (RAS VPN) can use a VPN client (Network Connect) that connects the terminal to the corporate network as though connected on the local network. The Network Connect client starts automatically when the network is accessed via the Internet: If the Network Connect client launches successfully, the relevant icon is displayed in the info area of the task bar: Before Network Connect can be used, the following conditions must be fulfilled: The RAS VPN variant is used Host Checker and Cache Cleaner were launched successfully The terminal fulfils the security requirements If the Network Connect Client is not launched, you still have restricted access to the applications/systems listed under Web bookmarks in the browser. The corporate resources activated for a particular context are shown as links in the browser window as in the following example: DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 13 / 21

14 3.2 Accessing Corporate Resources Without Network Connect (RAC VPN), you can only access resources displayed in the browser window. When you click the relevant application, this is started in a new browser window. Note that the browser window does not contain toolbars. With Network Connect (RAS VPN), your terminal is connected to the corporate network as though connected on the local network. You can access network resources in the usual way. You can also access the resources shown in the browser window. Do not close the browser window for the DB Secure-Access-Portal until the session is finished. If you close it accidentally, the existing VPN connection is not terminated but you will have to log into the DB Secure- Access-Portal again to access additional Web applications that are only available via this portal. 3.3 Closing the RAS VPN Session To close the RAS VPN session, click "Log out" in the top right of the browser window: Click here You will then be logged out of the DB Secure-Access-Portal: After a few moments, the Network Connect component is also closed (RAS VPN only) and the icon removed from the info area of the task bar. Note that Web applications open at the same time are also closed. If you have established a dial-in connection to the Internet (via modem, ISDN, or UMTS/GPRS) that is no longer required, you are recommended to disconnect from the Internet. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 14 / 21

15 4. Further Information on the RAS VPN Solution 4.1 Changing the BKU Password You must change your BKU password at regular intervals. Unexpected problems that occur logging into certain applications may be due to the fact that your BKU password has expired. The DB Secure-Access-Portal will help you change your password. Proceed as follows to change your BKU password: 1. Access the DB Secure-Access-Portal at 2. Click "Authentication with password" and log in with your BKU user name and password 3. An appropriate message is displayed indicating that your BKU password is due to be changed: Click "Click here to continue" and move on to step 4. The following window appears if your password has already expired: In this case, enter the old and the new password in the appropriate fields and click "Change password". You can cancel the procedure at this point. Otherwise, continue with the next step. 4. Click the "Preferences" button. 5. Click the "General" tab page. The following dialog then appears in which you can change your password. Enter your current password once and your new password twice: DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 15 / 21

16 6. Then click the "Change Password" button. 7. Click "Sign Out" to log out of the DB Secure-Access-Portal. 4.2 Using Group Drives In the case of using group drives it is important to note that when copying files the maximum size of a file is limited: MB for downloads 500 MB for uploads 4.3 Support Services of DB Systel Prerequisites The following requirements must be fulfilled in order to obtain support from the Helpdesk DB Systel for terminals not managed by DB Systel GmbH. If these requirements are not fulfilled, you can request an onsite repair service (subject to a fee) via the customer manager or DB contact person responsible. Prerequisites for utilising support services: 1. The terminal has been prepared in accordance with this User Guide 2. The customer must appoint a contact person with the relevant expertise and administrator rights 3. Operating system platforms supported: Windows Vista and Windows 7, 8, Web browsers supported: Internet Explorer 8.x or higher 5. Virus scanners supported: see section on page Internet connection must be available 7. Connection via remote maintenance software must be supported. Only the solution provided by DB Systel may be used here. If the connection does not function properly, no attempt is made to deploy a different remote maintenance software solution No warranty claims can be asserted against DB Systel if the repair activities are not successful or the terminal no longer functions correctly Helpdesk DB Systel Contact Information If you have any further questions or problems, please contact the Helpdesk DB Systel on +49 (0) You can also contact the Helpdesk DB Systel by at Helpdesk.IT@deutschebahn.com. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 16 / 21

17 5. System Requirements 5.1 Operating Systems and Web Browsers Supported Windows 10* Enterprise/Professional/Home, 64 Bit: Internet Explorer 11 and Firefox 31 (Extended Support Release) Windows 8.1* Enterprise 64 Bit: Internet Explorer 11 and Firefox 31 (Extended Support Release); Oracle JRE 8 Windows 8* Enterprise 32/64 Bit: Internet Explorer 10 and Firefox 31 (Extended Support Release); Oracle JRE 7 Windows 7 SP1 Enterprise 32 bit: Internet Explorer 8, 9, 10, 11 and Firefox 10 (Extended Support Release); Oracle JRE 7 Windows 7 SP1 Enterprise 64 bit: Internet Explorer 9, 10, 11 and Firefox 24 (Extended Support Release); Oracle JRE 7 Windows Vista Enterprise SP2 32/64 bit: Internet Explorer 8, 9, 10, 11 and Firefox 10 (Extended Support Release); Oracle JRE 7 Mac OS X 10.11, 10.10, 10.9, 64 Bit: Safari 9.x, 8.x, 7.x Oracle; JRE Operating Systems for Host Checker, Cache Cleaner and Network Connect Supported Windows 10 all editions on 64 bit Windows 8.x all editions on 32 bit or 64 bit Windows 7 all editions on 32 bit or 64 bit Windows Vista with SP2 all editions on 32 bit or 64 bit 5.3 Operating Systems for Pulse Secure Client Windows 10 all editions on 64 bit Windows 8.x all editions on 32 bit or 64 bit Windows 7 all editions on 32 bit or 64 bit Windows Vista with SP2 all editions on 32 bit or 64 bit (for Pulse Secure Client version 4 only) Mac OS X 10.11, 10.10, 10.9 on 64 Bit *) On Windows 8, 8.1 and 10 platforms the endpoint must use desktop mode and enable plug-ins in the Internet Explorer configuration. DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 17 / 21

18 5.4 Requirements for access to Web bookmarks by RAC VPN For the use of Web bookmarks must be understood that an anti-virus as described in Section 2.2 on page 4 is not required. The popular browsers Internet Explorer, Firefox, and Safari are support (see section 5.1) in principle. However, a web application may require the use of a specific browser, and if necessary, also in conjunction with a specific browser version. For more details, please refer to the user manual of the respective web application. The following table provides information on the requirements for the use of selected Web bookmarks: Web Bookmark Device/Operating System Host Checker required Cache Cleaner required Amsel Windows No Yes Athene any No No BaBetT any No No Bahn Wiki Windows No Yes BCM - Bahn Content Mgmnt. Windows Yes Yes CareNet any No No DAP - Datenaustauschplattform Windows No Yes DB Aufsichtsratsportal Windows Yes Yes DB Intranet any No No DB Mail Windows Yes Yes DB Management Portal Windows Yes Yes DB Notes App Windows Yes Yes DB Umweltservice - AVS LIMS any No No ECM - Enterprise Content Mgmnt. Windows No Yes FIP Flächenmgmnt. für Infrastrukturprojekte Windows Yes Yes Geoviewer DB Netze Fahrweg Windows Yes No HIM - Hafas Information Manager Windows Yes Yes ISK-Viewer Windows Yes No Kids On Tour - Auftragsverwaltung any No No Konzernrevision Windows Yes Yes KVDB - Konzern-Vertragsdatenbank Windows Yes Yes LeiDis-NK Basisversion any No No Mobiles Terminal (MT-Server) Windows Yes Yes OWA - Outlook Web Access Windows Yes Yes Prozesse der DB Projektbau GmbH any No No Serviceportal any No No Software-Depot Windows Yes Yes TMT - Testmanagementtool Windows Yes Yes DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 18 / 21

19 5.5 Virus Protection Software Supported Notes: The Helpdesk DB Systel can only provide support for anti-virus products listed in section DB Systel provides at a cost-effective anti-virus service for client operating systems Windows 7 and Windows Vista that is guaranteed to be compatible with the Secure Access platform and is supported by the Helpdesk DB Systel. The anti-virus service can be ordered via Serviceportal ( To find the product use the ID PROD Anti-virus software for devices outside the DB Network.. The price is annually (1.59 monthly). Antivirus products listed in section are enabled for use with the DB Secure Access Portal, but the compatibility cannot be guaranteed and the Helpdesk DB Systel does not support VPN dial-in issues with these products. In case of VPN dial-in issues it may be an option to try another virus scanner from the list or you may order the DB Systel anti-virus service Products Supported Windows OS: Kaspersky Anti-Virus for Windows Workstations (6.x) Kaspersky Endpoint Security (8.x) Kaspersky Endpoint Security (10.x) Symantec Endpoint Protection (12.1.x) Symantec Endpoint Protection (12.x) Mac OS: Kaspersky Anti-Virus (8.x) Kaspersky Endpoint Security (10.x) Enabled Products without Support Windows OS: AVG Anti-Virus Free Edition (2015.x) AVG Anti-Virus Free Edition (2016.x) AVG AntiVirus (2014.x) AVG AntiVirus (2015.x) AVG AntiVirus (2016.x) AVG Internet Security (2014.x) AVG Internet Security (2015.x) AVG Internet Security (2016.x) AVG Premium Security (2014.x) AVG Premium Security (2015.x) Avira Antivirus Pro (15.x) Avira Antivirus Suite (14.x) Avira Free Antivirus (15.x) Avira Internet Security (14.x) Avira Internet Security Suite (14.x) Avira Professional Security (12.x) DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 19 / 21

20 Avira Professional Security (13.x) Avira Professional Security (14.x) ESET Endpoint Antivirus (5.x) ESET Endpoint Antivirus (6.x) ESET NOD32 Antivirus (7.x) ESET NOD32 Antivirus (8.x) ESET NOD32 Antivirus (9.x) ESET Smart Security (7.x) ESET Smart Security (8.x) ESET Smart Security (9.x) F-Secure Client Security (9.x) F-Secure Client Security (10.x) F-Secure Client Security (11.x) F-Secure Client Security (12.x) G Data AntiVirus (24.x) G Data AntiVirus (25.x) G Data InternetSecurity (24.x) G Data InternetSecurity (25.x) G Data TotalProtection (25.x) G Data TotalSecurity (25.x) Kaspersky Anti-Virus (14.x) Kaspersky Anti-Virus (15.x) Kaspersky Anti-Virus (16.x) Kaspersky Internet Security (14.x) Kaspersky Internet Security (15.x) Kaspersky Internet Security (16.x) McAfee VirusScan (17.x) McAfee VirusScan Enterprise (8.8.x) McAfee VirusScan Enterprise (8.x) Microsoft Forefront Endpoint Protection 2010 (2.x) Microsoft Security Essentials (4.x) Norton 360 (21.x) Norton 360 (22.x) Norton AntiVirus (21.x) Norton AntiVirus (22.x) Norton Internet Security (21.x) Norton Internet Security (22.x) Norton Security (22.x) Norton Security with Backup (22.x) Sophos Anti-Virus (10.x) Sophos Anti-Virus (9.x) DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 20 / 21

21 Symantec AntiVirus (10.x) Symantec AntiVirus Win64 (10.x) Symantec Endpoint Protection (11.x) System Center Endpoint Protection (2.x) System Center Endpoint Protection (4.x) Trend Micro OfficeScan Client (10.x) Trend Micro OfficeScan Client (11.x) Trend Micro Worry Free Business Security Agent (19.x) Windows Defender (4.x) Mac-Betriebssysteme: Avira Mac Security (2.x) Avira Mac Security (3.x) Kaspersky Anti-Virus (13.x) Kaspersky Anti-Virus (14.x) Kaspersky Anti-Virus (15.x) Sophos Anti-Virus (8.x) Sophos Anti-Virus (9.x) Symantec Endpoint Protection (12.0.x) Symantec Endpoint Protection (12.1.x) DB Secure-Access-Portal / Version 1.38 / As at: 6 th of July 2016 Page 21 / 21