Scaling Data Security > Adding modules to your deployment

Adding modules to your deployment

Applies to

Data Security v7.6.x

In this topic

Overview

Value of additional policy engines

Overview

If network and security requirements dictate that you need to add new agents or other modules to your deployment, go to the machine where you want to install them and run the Data Security installation wizard.

When you install the module, you are asked to provide the FQDN of the TRITON management server and the credentials for a TRITON administrator with Data Security system modules permissions. When you do, the module is automatically registered with the management server.

If you accept the default configuration, all you have to do is click Deploy in TRITON - Data Security (on the management server) to complete the process. If you want to customize the configurations, go into the System Modules screen and click the module to edit.

Only a management user with system modules permissions can install new network elements.

For information on adding and configuring modules, see Managing System Modules > Adding modules in the TRITON - Data Security Help.

Value of additional policy engines

Policy engines analyze transactions sent from various agents and protectors. The protector monitors network traffic and sends transactions to policy engines for analysis. The CPU load on the protector is much lighter than on a policy engine; therefore, when scaling up, you should add more policy engines (not protectors) and load-balance the analysis between them.

Assessing the need for additional policy engines

Check the number of transactions analyzed by the policy engine by selecting Main > Status > System Health and clicking on a policy engine.

View the "Analysis status" chart for the policy engine.

If there is red on the chart, this indicates a heavy load on the policy engine during the designated period.

If you are in monitoring mode, a few red bars may not be an issue. The system will process these incidents during a less busy period.

If you are in blocking mode, even one hour of red is undesirable. If you see this, you should perform load balancing and/or add a new Data Security server.

Optimizing

Try to avoid analysis of incoming traffic. If incoming is a must, try to limit it to certain domains.

Never scan all networks; establish limits.

Check the top policies and see if there are any false positives or unwanted/not needed policies a week or two after first deployment.

If possible, make sure no spam SMTP mail is undergoing analysis.

Scaling Data Security > Adding modules to your deployment