Anti Virus-Anti Malware on Control Systems

We have been using a commercial Enterprise version of Anti-Virus, Anti-Malware, etc. on our Citect control system for four years now, and have no software problems with it. It pushes out the updates to the workstations (13) too from a central Management Server (not one of the Citect servers, but on the same network) The only 'problem' is that the software has four main databases, and since our system is not connected to anything outside the plant, we have to update manually. Not a problem but the AntiVirus software vendor only puts out one of the four components for 'off line' updating. So parts of their system is out of date on our installation.
We are getting ready to install new servers and would like a complete solution that allows all components to be updated off line. We're looking for a software package that is scalable down to our installations, say 6 servers and 15 workstations; is by a reputable firm; and is reasonably priced. Before I hit the Internet and send a bunch of emails to companies asking about off line updating (which they never mention in their web page or specifications) I thought I would ask here first. Anyone have some ideas?

Thanks in advance for the expertise. Allen

and since our system is not connected to anything outside the plant, we have to update manually.

Click to expand...

Smart choice, as NOT connecting to an outside network is the best safeguard. Unfortunately, most of the anti-virus software is geared for maximum profit at minimum effort, which means it is designed to be connected to a network all the time for daily or weekly updates. That is not best for you but most profitable for them.

i agree 10,000 %.

keep process pc's, hmi pc's , programming plc's and such like off the internet and on a separate network if possible.

you won't believe the mess i'm in because of someone saying oops.

regards,
james

Sounds like you need a "twin tail" update server of some sort.

I'm not familiar with the software you are using, but we use a Symantec corporate version, I have never seen it, but I suspect the update server is a twin tailed server class machine of some kind, or possibly a VM, that gets it's updates from the software maker and makes them available to our private networks, including the controls network.

iraiam,

not a big fan of them right now!
seems like every pc that acts up with end point on it, malware bytes finds stuff they pass on or don't even look at.

regards,
james

We use AVG which i find pretty reliable. However, we do have a controlled (i hope, IT manage it!)single machine interface to the corporate network and updates come through from there. Manual updates are possible for the anti-virus part, not sure about any other components as we only use the anti-virus portion.

James Mcquade said:

iraiam,

not a big fan of them right now!
seems like every pc that acts up with end point on it, malware bytes finds stuff they pass on or don't even look at.

regards,
james

Click to expand...

They wouldn't have been my choice, but that is what is supplied to us by IT, I did have a number of low-risk, low impact items that it detected and eradicated when it was first rolled out.

I had intended my post to be more about the update server than the flavor of anti-virus software. I know other anti-virus packages have the ability for deployment over large private networks with automatic updates as well.

Yes we are using Symantec Small Business Edition, which only allows one of the databases to be updated off line. We have considered using a 'update server' to pull the updated from the web, go offline, scan that server, and then join to the SCADA network and push out the updates. That involves joining/unjoining two different domains twice plus changing IP addresses. We certainly don't want to have to add firewalls, routers, DMZ etc. just to update the anti virus files. Also we have four SCADA systems also not connected to the Internet or each other - and a small staff - so we want to keep it as simple as possible.