External Media Scan and DAT Files

[Jselph17]

Hello, all. 

I work for the Air Force and I help manage the ePO. I work in an environment where we have an internal network that is not at all connected to the public internet. I have to update the McAfee ePO's DAT files manually by going to the Department of Defense's repository, burning the DAT file to a disc, inserting it into a computer that is connected to our local domain, and updated the DAT files that way. I said all this to give whoever reads this a picture of my work environment. I have a couple questions:

Due to the coronavirus, several people at my workplace are now teleworking. Since we work on an internal network there is no way for user's to remote into their PC's to work. That's resulted in user's taking their PC's home. When they do bring them back, they are scanned before putting them back on domain. 

Here are my questions: 

1. We need to know if someone inserts a CD or an external device to their PC that may potentially have a virus on it will McAfee catch it immediately or could there be a potential that the virus could infect the machine before McAfee can find the virus.  

2. Basically the longer the employee stays home the more out of date the McAfee definitions on the equipment becomes.  Since this quarantine may go on for a while, what are your thoughts on a way to update the computers?

                     -In relation to question 2, since these computers can't reconnect to the domain (where the ePO can push DAT file updates) without first being scanned, how can I update the DAT files on a single computer? I know how to upload DAT files to the ePO, but I'm not sure how to manually update the DAT files on a single computer that can't be connected to the ePO. Is there a way to do this? I'm all ears for any ideas. 

[alaskar · Accepted solution]

Hi @Jselph17 

Here are the answers to both of your customer:

1. We need to know if someone inserts a CD or an external device to their PC that may potentially have a virus on it will McAfee catch it immediately or could there be a potential that the virus could infect the machine before McAfee can find the virus.  

Ans: depends on the type of the Malware. If McAfee have got it covered with DAT/Artemis, it will be detected. Ny experience with handling malware, says most of the time we detect them. mcafee DLP scans external media, but when any IO operation from that media happens onto the local machine and if found malicious and covered we should be able to detect and delete them

2. Basically the longer the employee stays home the more out of date the McAfee definitions on the equipment becomes.  Since this quarantine may go on for a while, what are your thoughts on a way to update the computers?

                     -In relation to question 2, since these computers can't reconnect to the domain (where the ePO can push DAT file updates) without first being scanned, how can I update the DAT files on a single computer? I know how to upload DAT files to the ePO, but I'm not sure how to manually update the DAT files on a single computer that can't be connected to the ePO. Is there a way to do this? I'm all ears for any ideas.

Ans:  The best and simplest approach would be to download the DAT manually every day and run them on individual systems. daily DATS can be downloaded from https://www.mcafee.com/enterprise/en-us/downloads/security-updates.html

Hope this helps!

[cdinet]

If the users are connected to the internet, they may also be able to set up a local update task to run daily in ENS.

[Jselph17]

The users are not supposed to connect their computers to the internet.

[alaskar]

Hi @Jselph17 ,

Well, in case the systems are not supposed to connect to the internet, that leaves us with only one option and with certain limitations as well:

Procedure:

1. find out a system that can connect to the internet or your EPO and create a mirror task. This is will create a local repository on that system

2. next map that folder as the shared drive to the remaining systems

3. users can either manually download it from that share or can create a local update task mapped to that shared repo

Limitations:

1. all systems should be in the same network and the shared folder should be accessible.

Alternate way:

- users would need to download the daily dat/amcore on their personal computers/phones and then move it to their work machines and run the update.

Hope this helps!

[Jselph17]

Your previous reply answered my question. I gave them the link you sent me and they can burn the files to a disc and update their work computers. Thanks!