Safe Deployment Practices for Faronics Anti-Virus

This document discloses the testing and deployment practices Faronics applies when releasing updates to the Anti-Virus product line. It is provided for informational purposes only.

Many established testing and deployment strategies are tailored to fully web-based applications. Faronics Anti-Virus runs on individual Windows endpoints — including kernel-mode device drivers operating in Ring 0 — so a more cautious approach is necessary.

Types of Updates

Updates for Faronics Anti-Virus fall into two categories, each with a distinct release cadence.

Virus Definition Updates — patterns and behavioral traits of malware, occasionally including code in a separately-signed DLL. Released 4–6 times daily to keep up with rapidly evolving threats.

Product Updates — kernel-mode device drivers, services, DLLs, and user-interface executables. Released through the multi-stage process described below.

Virus Definition Updates

Virus Definition Updates follow a specialized process designed for their rapid release cadence. They are developed and tested in a dedicated test lab. Although every update is tested on all supported platforms, the rapid cadence may occasionally result in unintended side effects. To mitigate this, the scanner engine and these updates are designed to safeguard machine usability.

Product Updates

Product updates have higher potential impact on the system due to the device driver components. Each release moves through the following stages.

1. Release Planning

Customers often remain on N−1 or N−2 releases, expanding the scope of upgrade test scenarios. Kernel-mode drivers operate in Ring 0, so driver code is changed only when absolutely necessary. Driver releases follow a year-or-longer cycle; other components are updated once or twice a year.

2. Development & Testing

The Development and QA teams collaborate continuously. Each feature is tested as it lands. A complete test plan is run on the feature-complete build to catch regressions, and again before the Release Candidate is announced. Faronics uses a PowerShell-based test suite for smoke and basic functional verification — the same suite previously used for Microsoft’s TestBase validation program.

3. Dogfooding

Once an RC is announced, IT deploys it across corporate machines that are not running mission-critical applications. Dogfooding continues after the build ships to the public.

4. Beta Testing

After 3–4 weeks of internal deployment, a curated group of trusted customers is invited into beta. The roster is chosen to cover a diverse range of hardware and software systems.

5. Controlled Rollout

After beta concludes, the build moves to a controlled rollout. Initial deployment is limited to a small curated customer list before expanding to a region (for example, North America) and then to general availability. If significant problems are detected and cannot be resolved promptly, the deployment is halted and the release is rolled back.

6. Monitoring & Feedback

Customer Support gathers feedback during controlled rollouts. Faronics provides a Comprehensive Data Collection tool that retrieves log files and relevant settings from a specific machine, run by the customer when requested by Tech Support. Findings are logged in bug tracking; severity determines whether to address an issue immediately or in a future release.

7. Recovery & Rollback

For major issues, the release build is withdrawn and the previous build is made available. The Comprehensive Data Collection tool gathers data from affected endpoints. A dedicated cleanup tool removes all product components and registry changes if a graceful uninstall is not possible.

8. Announcements & Customer Notifications

For minor issues, Faronics publishes an article on the Faronics Tech Support Portal. For more serious problems, customers receive email notifications. In critical cases, Tech Support contacts affected customers directly.

Conclusion

By following these practices, Faronics releases minor and major product updates with the goal of preventing disruption to customer operations.