System Recommendations for Dalet Products

Recommendations for Dalet Solutions

Confidentiality Notice

The information provided in this document contains proprietary and confidential information that is the property of Dalet.
Distribution of any information contained in this document to third parties including, but not limited to contractors, system integrators, and other vendors is strictly prohibited without prior written consent of Dalet.

Product specifications and availability are subject to change without notice. Dalet is a registered trademark owned by Dalet. All other brands and trademarks are those of their respective owners.

Long Term Support Plan, Dalet Solutions Release History and Versions

• Long Term Support Plan (LTSP) and Release History
• Dalet Supported Operating Systems
• Permissible MSSQL Versions Per Dalet Solution, Version, Revision
• Microsoft Licensing: Operating System and SQL Server (internal)

Security Recommendations 

Dalet Galaxy

Rights, Services and Folders

There are two services requiring a network user: the DIS Installer Service and the Dalet Service. 

These users have the following privileges in the network, and should be part of local admin group of every host: 

DIS Installer Service 

• Can install service
• Can run service
• Can access Program Files\Dalet (Read & Execute)
• ProgramData\Dalet (read\write\delete) 
• Can register OCXs 
• Can create System DSN
• Can create UNC Shares 
• Registry read\write (HKLM\Software\Dalet) 
• Access to %temp% 

Dalet Service 

• Can run service 
• Can access registry 
• Can access Program Files\Dalet (Read & Execute) 
• ProgramData\Dalet (read\write\delete) 
• Can access all Storage Units (read\write\delete) 
• Registry read\write (HKLM\Software\Dalet) - for Dalet Galaxy versions using the registry

Folders used by the Dalet Service and Dalet Installer users:

• C:\ProgramData\DaletLogs
• C:\ProgramData\DaletPlusData (and all sub-directories)
• C:\Program Files\Dalet (and all sub-directories)

Dalet Galaxy AV Security Recommendations

To ensure optimal performance, the Galaxy system requires certain media file types to be excluded from real-time antivirus scans. Such scans can introduce latency or cause access failures in some cases. The specific file extensions to be excluded may vary depending on the customer's workflow and the video formats they use.

Commonly recommended media file extensions for exclusion include: MXF, MOV, M2V, MPD, M4A, M4V, M4S, WAV, MP4, MP2, MP3, M3U8, IDX, VOL, TCD, IXF, ITI, TGA, PNG, EDL, SRT, and HEP.

Additionally, for each of these extensions, a parallel extension with the suffix "WREC" should also be excluded (e.g., MXFWREC for MXF). This additional extension is used during "While Operations."

Dalet does not have specific requirements for antivirus and SQL Server configurations. Instead, we recommend following the guidelines provided by Microsoft, which can be found at the following link: Configure antivirus software to work with SQL Server - SQL Server.

Here is an example of PowerShell code to apply the recommended file extension exclusions in
Windows Defender:

```powershell
$x = Get-MpPreference
if ($x.ExclusionExtension -ne $NULL) {foreach ($i in $x.ExclusionExtension) {Remove-MpPreference -ExclusionExtension $i}}
$fileExtensions = @("mxf", "mov", "m2v", "mpd", "m4a", "m4v", "m4s",
"wav", "mp4", "mp2", "mp3", "idx", "vol", "tcd", "ixf", "iti",
"tga", "png", "edl", "srt", "hep", "log")
foreach ($extension in $fileExtensions) { Add-MpPreference -ExclusionExtension $extension }
foreach ($extension in $fileExtensions) {
$wrecExtension = $extension + "wrec"
Add-MpPreference -ExclusionExtension $wrecExtension
}
Write-Host("Done.")
```

For any third-party solutions integrated with Dalet Galaxy, the same recommendations apply (unless stated otherwise by the vendor). Please consult the vendor to determine the required media file extensions that should be excluded.

DIS 2.0

Some Anti-Virus solutions may interfere with the operation of DIS 2.0 (block Power Shell, for example). Consult your IT department and your Dalet representative for more details about needed exceptions (exclusions). In particular, exclude the C:\Program Files\Dalet\DisMQ\jre\bin\java.exe process from the check.

Dalet Flex

Consult: Dalet Flex Operational Requirements for Customer-Hosted Deployments.

Dalet CubeNG

Dalet CubeNG Antivirus and Windows Recommendation

Dalet AmberFin

Antivirus exceptions recommendations for Dalet AmberFin.

Dalet AmberFin Hardware and Operating System Requirements.

Dalet BRIO Video Server AV Security Recommendations

The Dalet Brio Video appliance comes pre-configured and hardened, using Windows Defender as its antivirus solution. By default, Brio software executable files are excluded from scanning. However, this exclusion can be removed, and the provided script for file extensions can be deployed on the Brio server as an alternative.

Since Brio is a Video Server Appliance, it should be treated as such and should not be connected to any endpoint management system. Updates to its Windows Defender should be managed via Windows Update (process discussed in a different section). In the event of a 0-day vulnerability, the security intelligence update can be manually downloaded and deployed from the following link:
Latest security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware - Microsoft Security Intelligence.

Brio Server Appliance Hardening

To minimize the Brio Server external footprint, Configure Windows Firewall as follows:

Brio Drive Share Naming and Mounting Recommendations

The Brio V:\ drive share name should include a $ at the end (e.g., media$). This will hide the share from malware network scans. Additionally, it is recommended to never mount the Brio share as a drive on any workstation or server.

Alternative File Transfer Protocol for Brio Video Server Appliance

While Dalet recommends using SMB as the default protocol for file transfers to and from the Brio Video Server Appliance, you can disable SMB entirely and use the Brio FTP Server instead.
(Note: SMB 1.0 is disabled by default on the Brio Video Server Appliance.)

Managing Administrative Shares on Windows Servers

Brio Video Server Appliance is based on Windows Server Technology,
Windows Server hidden administrative shares are automatically created to allow administrators, programs, and services to access and manage resources. However, these administrative shares can pose a security vulnerability and could be disabled.

Disabling Administrative Shares can be done via mdoifying the registry HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\AutoShareWks to 0

(Disabling Administrative Shares does not disable the IPC$ Share, Although this share is not used to access files directly, Ensure that Anonymous access to this share is disabled, Alternatively, You can remove the IPC$ share completely by deleting it via net share IPC$ /delete)

Network Traffic Management for Brio Video Server Appliance

For customers who do not run production servers on a Broadcast Data Network separate from the rest of the network (users), an additional layer of protection can be achieved. This can be done by limiting traffic to and from the Brio Video Server appliances to specific hosts (such as IngestManager and Broadcast Servers) using Windows Firewall or network switches.
Brio/Galaxy Operating Protocol
For Galaxy Version 376 and above, Brio MediaAgents and Brio Servers should be moved to GRPC operations. If this is not possible, DCOM Authentication Level should be configured to Packet Integrity. Brio Servers must also be configured to this same level.

Dalet Galaxy Hardening

Data Execution Prevention Configuration for Galaxy Servers

Windows Data Execution Prevention (DEP) must be disabled on Galaxy servers. If this poses an issue for the customer, it should be configured to the minimal possible setting for essential Windows programs and services. There is no need to disable DEP on the client side.

Firewall Configuration for Windows 2016 and Up

For customers using Windows 2016 and later, it is no longer necessary to disable the Base Filtering Engine or Windows Firewall. Instead, customers should ensure that the Windows Firewall (or any other firewall) has the appropriate ports opened.

Dalet Service User Requirements

The Dalet Service User should have access to all domain resources that the agent needs, and it must have local admin rights on the machine it runs from. This user account, used to run the Dalet Service, should not be used for daily activities by any individual. It is recommended to deny local logon for this account.

To avoid the need for periodic password changes, which might require a restart of the agents or site downtime, customers can explore using Managed Service Accounts (MSA), Group Managed Service Accounts (gMSA), or standalone Managed Service Accounts (sMSA).

Brio Drive Share Naming and Mounting Recommendations

The Galaxy LSU share names should include a $ at the end (e.g., DPShare$).
This will hide the share from malware network scans.
Additionally, it is recommended to never mount any share as a drive on any workstation or server.

Dalet Products & Windows Updates Recommendation

As Dalet products are being used in sensitive real time environments, Dalet does not recommend deploying Windows updates automatically/unattended.
Windows update deployment should be scheduled and agreed upon with the Dalet administration team on-site.

Regular Security Updates and Notifications

In addition to 0-day security updates (that should be deployed asap), Microsoft releases its updates every second Tuesday of the month (commonly known as Patch Tuesday). Dalet recommends waiting at least an additional week before deploying these updates, making it the third Tuesday of the month.

The customer’s IT team should inform the Dalet administration team when such updates are applied to ensure proper follow-ups and address any issues that may arise from the updates.

Brio Video Server Appliance Update Process

For Brio Video Server appliances, the above recommendations still apply. However, all updates (including 0-day security updates) should be performed using a command line updating tool called “WUP.” After regular Windows updates (Patch Tuesdays), WUP should be launched again after a reboot to ensure no further updates are needed.

Please obtain the latest WUP  via Dalet Support and run wup.bat via CLI:

Running Windows Update independently on Brio Appliances might result in failure or damage to the Brio operating system.