Recommendations

Updating built-in security policies and agent pools

Before updating an existing environment to this new version of SES Evolution, you must:

Read this section carefully,
Read the section Explanations on usage carefully,
Carefully read the Known problems section of the KnowledgebaseStormshield (English only - logins identical to those in your MyStormshield client area).

Built-in rule sets provided by Stormshield are automatically updated in the administration console when the solution is updated. However, this is not the case for built-in security policies. Where applicable, you must update your policies manually in the console if the rule sets they contain feature a green arrow, as described in step 4 of the procedure under the table.

The following are the major steps involved in updating policies and the pool to this new version:

1	Updating SES Evolution via the Installation Center
2	Updating security policies to use the latest versions of rule sets
3	Creating a test agent group
4	Selecting pilot agents for the test group and monitoring their behavior for several days
5	Updating all agents to version 2.7.1

We recommend that you follow the detailed procedure below for the update:

If there are unsaved changes in your administration consoles, save them and shut down the consoles.
Follow the SES Evolution solution component update procedure via the Installation center, as indicated in the Installation guide.
Once the update via the Installation Center is complete, open the consoles again to finalize the update. A message will warn you that the security policies are not using the latest version of the rule sets. Policies were not automatically updated in order to prevent compatibility issues with agents in versions lower than version 2.7.1.
Select a console. In the Security > Policies menu of the console, a green up arrow indicates the policies not using the latest version of rule sets.

Duplicate a policy containing a green arrow, such as the default policy, for example.
Select the copy of the policy and click on Edit.
Rename the policy by adding the version number "2.7.1" for example.
Select the latest version available of the rule set for all rule sets containing a green arrow.
Save the policy.
From the Environment > Agents menu, now duplicate one of your groups of production agents to test the deployment to version 2.7.1 with the new updated policy.
In the Policies tab, select the policy created earlier.
Ensure that the software version selected in the Version section of the Settings tab is 2.7.1.
Save the new group.
You will now select one or several agents in your initial group, which will be used as pilot agents. From the Agents tab in the initial group, select the pilot agents and click on Move agents to. Select the new test group.
From the Security > Deployment menu, click on Deploy to deploy the changes to your environment.
After the pilot agents have reconnected to the agent handler, the workstations must be restarted. After restarting, ensure that the agents have indeed switched to software version 2.7.1 and that they are using the new policy.

Test the behavior of the pilot agents for several days. Once you are sure that they are running properly, you can update all the agents in the pool. There are two ways to do so:

Select the new policy and software version 2.7.1 in your production agent groups. If you choose this option, remember to delete the test group.

- or -

Duplicate all your production groups and update them, then delete older groups if necessary.

If there is a need for agents to downgrade to an earlier version after updating to version 2.7.1, the version would no longer be compatible with the policies that contain version 2.7.1 features. We recommend that you then move the affected agents back to their original group.

Implementing security policies

With version 2.7.1, Stormshield provides version 2506a of the security configuration. This default configuration includes policies as well as protection rule sets and shared audit rule sets. You can use these rule sets in your own policies.

You can refer to the release notes regarding version 2506a of the security configuration by going to Downloads in your MyStormshield client area, then SES Evolution Security resources.

To build your policies, you can follow the recommendations mentioned in the release notes on the security configuration relating to the order of sets and the sets to use in your policies.

For more information, refer to the sections Understanding built-in rule sets and Customizing built-in rule sets in the Administration guide. SES Evolution

Updating the operating system on workstations

Before updating the Microsoft operating system on workstations that host SES Evolution agents, ensure that you have the most recent Stormshield rule sets. If this is not the case, download the latest rule sets as described in the Downloading Stormshield updates section, , then update your security policies.