Deploying Behavior Monitoring in Worry-Free Business Security (WFBS)

For a smooth transition to WFBS with Behavior Monitoring and Device Control:

1. Set up and deploy a pilot environment that matches the production environment as closely as possible.
    

   The pilot environment is where testers ensure that all applications work as expected in network and security conditions that match the conditions of the production environment.
2. Ensure that the following are included in the pilot environment:
   • Business applications
   • Custom developed applications
   • Critical applications used by groups or individuals (such as Payroll, Inventory, Accounting and Database applications)
3. Deploy the Client/Server Security Agents into the pilot environment with the features that you intend to enable. For example, the Behavior Monitoring and Device Control features may both be enabled.
4. Allow the pilot environment to run for a reasonable amount of time (a "soak time") with the standard applications running and with an average daily use.
5. Identify system-intensive applications.

   Trend Micro provides a standalone performance tuning tool to help identify applications that could potentially cause a performance impact during deployment. Trend Micro recommends running the TMPerfTool tool, available from Trend Micro Technical Support, on their standard workstation image and/or a few target workstations during the pilot process to determine any potential software or driver conflicts that may cause disruptions during the final deployment of the Behavioral Monitoring and Device Control features.

    

   TMPerfTool is for 32-bit platforms only. A tool for 64-bit platforms is still being tested.
   1. Unzip the TMPerfTool_2_90_1131.zip file.
   2. Place the TMPerfTool.exe file in the BM folder under the Client Security Agent directory (%ProgramDir%/Trend Micro/BM).
   3. Double-click TMPerfTool.exe.
   4. Click Analyzewhen the system or applications start to slow down.
      When a red highlighted row appears, it means that the TMPerfTool found the resource-intensive process.
   5. Select the highlighted row and click Exclude.
   6. After excluding the process, verify if the system or application performance improves, then do one of the following:
      • If the performance improves, select the process row again and click Include.
      • If the performance drops again, it means you found the root cause.
   7. Note the name of the application.
   8. Click Stop.
   9. Click Report and save the .XML file in your specified folder.
   10. Review the applications that have been identified as conflicting, and add the applications to the Behavior Monitoring Exception List:
       1. Open the WFBS console.
       2. Go to Security Settings > Select a group > Configure > Behavior Monitoring.
       3. Under Exceptions section, add the applications.