Automated Patch Management Service Data Sheet …

1 Service Data Sheet December 2017. Automated Patch Management Service Establish successful and proactive Patch Management strategy Ensure the availability and business continuity of your DeltaV process control system Reduce manual system administrative activity and delays associated with software updates The Emerson Automated Patch Management Service is a combination of people, technology and best practices designed to automate the routine aspects of manual security software update deployment. Introduction Benefits Every month there are new Microsoft Windows OS security Establish successful and proactive Patch Management updates, McAfee Endpoint Security for DeltaV Systems strategy : Automated Patch Management antivirus updates, Symantec Endpoint Protection antivirus Service automates routine aspects of software update updates and DeltaV DCS hotfixes that need to be acted upon.

2 Deployment for timely dependable implementation, while Emerson's Automated Patch Management Service provides freeing staff to devote more time to your own business. For an effective solution that address the five deployment steps large systems, the savings can add up to hundreds of hours identification of required Emerson-approved updates, per year. Automated Patch Management Service identifies the acquisition of update executables, distribution to appropriate appropriate Microsoft Windows security patches, tests them DeltaV DCS nodes, installation and compliance auditing. on DeltaV DCS and advises the customer on which DeltaV. DCS hardware needs updating with which particular software It is very common for the most critical security, antivirus and patches on an individual system-by-system basis.

3 Application hotfix updates to go uninstalled for extended periods of time, or not be installed at all. Often the reasons are Ensure the availability and business continuity of your due to limited skilled resources and day-to-day judgment calls DeltaV system: Emerson provides approved Microsoft about what is more important; to either address an immediate Windows security updates as well as antivirus signature file need with a measurable business benefit or deploy the current updates on a regular basis. Experience has shown many of batch of system software updates with their unknown and often the disruptive events reported to the Emerson Global Service un-quantified effect on system vulnerability. Center could have been avoided, had the relevant security update or hotfix been applied in a timely fashion.

4 Automated Patch Management Service December 2017. Reduce manual system administrative activity and delays By delegating patching to Emerson's Automated Patch associated with software updates: Maintaining security Management Service , site resources can focus on delivering Patch Management and hotfixes are essential to your system's quality product and bottom-line results; spending less time security and availability. evaluating and deploying patches, and more time focusing on process Management and operations. This Automated Service ensures that critical updates are deployed consistently. ASSESS SOLVE IMPROVE. Cyber Security Periodic Assessments Solutions Audits Cybersecurity Assessments Cybersecurity Solutions Periodic Audits Basic Cybersecurity Assessment Automated /Manual Patch Management Annual or semi-annual follow-up audit & Report services (WSUS & antivirus) Reviews adherence to previous Custom Cybersecurity Assessment Application Whitelisting assessment results/remediation & Report Security Information & Event Reviews cybersecurity real-world Cybersecurity Remediation & Management (SIEM) changes and suggests any remediation Consultation services DeltaV ACN Network Security Monitor necessary to protect from these changes Backup & Recovery Smart Firewalls, Smart Switches and Controller Firewalls Incident Response (IR)

5 services Development services for IR Plans and Policy & Procedures Emerson's Cybersecurity Management Solutions Process and services Portfolio. Cybersecurity Management Solutions System Health Monitoring Applications Whitelisting Automated Patch Management Service is an integral part of Emerson's Cybersecurity Management Solutions portfolio. Network Security Monitor A comprehensive cybersecurity solution consists of many Security Information & Event Management (SIEM). different components; each one specific to reducing risks associated with various process control system entities. System Health Monitoring Emerson's Cybersecurity Management is an integrated Smart firewalls, Smart Switches and Controller Firewalls approach to finding the best cyber solutions to fit your current process control system and existing plant security On-site spare parts Management policies and procedures.

6 Security consultation services Cybersecurity Management solutions cover: Incident Response services Automated /Manual Patch Management services Development services for IR Plan and Site Policies &. (WSUS & antivirus patching) Procedures Review Disaster recovery Reduction of risks associated with the use of these solution Backup and recovery components reduces the time spent on controllable issues and allows focus on other important day-to-day issues. 2. Automated Patch Management Service December 2017. Automated Patch Management Service Prerequisites Service Architecture Automated Patch Management Service prerequisites: Software Service enablers are combined with Emerson's expert DeltaV installed in a domain environment, running consultation and optional on-site commissioning to implement DeltaV software or later.

7 Automated deployment capability for Microsoft Windows . System(s) enrollment in Guardian Support Service . security updates, Symantec antivirus updates and DeltaV. DCS hotfixes. Annual purchase of the Automated Patch Management Subscription Service for each system ID. The software Service enablers include: For McAfee Endpoint Security for DeltaV Systems: Guardian Software Update Delivery Service (GSUDS). Client: an Emerson software application available for systems zzLicenses to use McAfee ePO, Super Agent/Agent Handler enrolled in Guardian Support Service . It solicits system hot and agent clients (all supplied by Emerson). fixes and approval information for Microsoft security updates For Symantec Endpoint Protection: from Emerson via the Internet. It is typically located on a web zzLicense to use Symantec Live Update Administrator (LUA).

8 Facing Upstream Server. (customer's responsibility to procure). Guardian WSUS Interface (GWI): An Emerson software zzLicense to use Symantec Endpoint Protection Manager application that periodically loads new DeltaV hotfixes (SEPM) and clients (customer's responsibility to procure). and the latest approval information for Microsoft security zzSupport Service contract from Symantec is recommended updates, and programmatically injects them into WSUS. (customer's responsibility to procure). It is typically located on the Downstream Server. Support contract from Microsoft for WSUS is recommended Microsoft Windows Server Update Service (WSUS). (customer's responsibility to procure). version 3 or higher: A no-cost add-on to the Microsoft server operating system. Two instances of the WSUS application are Hardware required for McAfee Endpoint Security for required; one on an internet facing server (Upstream Server) DeltaV Systems: to solicit security updates from Microsoft and a second zzMcAfee ePO Server - A server class computer licensed for located on a non-DeltaV DCS server (Downstream Server).

9 Microsoft Windows Server 2008 R2, Windows Server 2008. on the DeltaV side of the firewall, synchronized to move SP2 (x64only) or later, Windows Server 2012 and Windows data to and from on another. WSUS provides distribution, Server 2012 R2. deployment and audit capabilities for Microsoft security zzAn Internet accessible server class computer licensed for updates and DeltaV hot fixes. Microsoft Windows Server 2008 R2, Windows Server 2008. For McAfee Endpoint Security for DeltaV Systems: SP2 (x64only) or later, Windows Server 2012 and Windows Server 2012 to host applications that require zzMcAfee ePolicy Orchestrator Console (McAfee ePO ) . Internet access. A software application that solicits antivirus updates from zzCustomer-managed network infrastructure that allows either Emerson or via the Internet, typically located on a the ePO Super Agent/Agent Handler to securely access the server located on the or L3 network.

10 McAfee ePO console. zzMcAfee Super Agent/Agent Handler - An application platform that deploys the antivirus updates obtained Hardware required for Symantec Endpoint by the ePO console to the agents located on the DeltaV. Protection Solution: ACN nodes. For Symantec Endpoint Protection Solutions: zzA server class computer licensed for Microsoft Server 2008, Windows Server 2008 R2, Windows Server 2012 and zzSymantec Live Update Administrator (LUA) A software Windows Server 2012 R2 to be installed as a non-DeltaV. application that solicits antivirus updates from Symantec DCS node (Downstream Server) on the DeltaV. via the Internet, typically located on the Upstream Server. control network. zzSymantec Endpoint Protection Manager (SEPM) . A software application that deploys antivirus updates obtained by the LUA, located on the Downstream Server.