This document describes Verint’s policy for applying third-party software updates on Verba servers (referred to as Covered Products). The policy is applicable to the supported versions of Verint’s product. For more information, see Releases.  

The servers hosting Covered Products run on Microsoft Windows Server operating systems, with no proprietary software components.  

Verint products leverage a wide range of industry standards to help reduce total cost of ownership and benefit from integrated network-level security. While there are many advantages to this IT-centric approach there are also challenges, that other similar Microsoft-based IT infrastructures also share, around viruses, security patches, third-party software, etc. 

This document is intended for Verint prospects, customers, resellers and dealers (each referred to in this document as customers), and outlines Verint’s policy on: 

• Anti-virus software and third-party software that is not certified by Verint 

• Service Packs and minor versions issued for third-party software that is Verint-certified 

• Security fixes and updates for third-party software that are Verint-certified 

Protective Measures for Network Security

It is the customer's responsibility to protect their network servers and technology-related assets (which may include Verint-manufactured software packages and/or Verint-supplied or customer-supplied third-party software packages or hardware) against unauthorized access or intrusion including, but not limited to, malicious or criminal acts, worms, Trojan horses, viruses, or network attacks. In addition, it is the customer’s responsibility to correct defects and/or problems that affect the functioning of the network and operating system software, after their own analysis of the risks, consequences, and expenses involved. 

Customers may elect to reduce these risks, consequences, and expenses by executing protective measures for network security, such as the installation of a third-party anti-virus software program or installation of Microsoft-provided and other third-party security fixes, and updates. It is the customer’s responsibility to apply such fixes/updates. 

Failure to provide adequate security may result in the customer's exposure to service disruptions and subsequent losses including, but not limited to, denial of service, software program replacement and reinstallation expenses, loss of confidential and proprietary information, fraudulent expenses, loss of data and loss of revenue. Any loss and incurred expenses associated with failure to actively address security issues are solely the customer's responsibility. 

If the customer is not prepared to perform this work, they should retain the services of a third-party or Microsoft-certified provider. 

Anti-Virus 

It is the customer's responsibility to install and update any anti-virus software program on their network servers and technology-related assets, including Covered Products. Verint does not certify any specific anti-virus software but provides well-defined guidance for creating a scan exclusion list.  

Verint recommends the installation of certain anti-virus software programs identified as Microsoft antivirus partners: http://windows.microsoft.com/en-US/windows/antivirus-partners 

Microsoft Software Compatibility 

Verint tests and certifies Verba solutions on specific versions of Microsoft operating systems. Certified major versions of Microsoft Windows OS and SQL Server software are listed on the Server sizing and requirements page. 

Embedded and Customer provided Software Components 

Covered Products include embedded or bundled with the Covered Products components from Microsoft and others. Embedded / bundled components are limited for use with the Covered Products and may not be used independently of the Covered Products. Embedded / bundled and customer provided software components may include stand-alone products (such as Microsoft SQL), products that are made available with the operating system (such as Internet Explorer), or re-distributable components provided as part of developer environments (such as.NET framework, data access components, or JRE). 

Product documentation such as the Verba Knowledge Base and other deployment reference guides clearly specify the software to be installed by the customer. This includes the Microsoft Windows operating system, Microsoft SQL Server etc. The documentation covers versions; installation and configuration procedures are provided by manufacturers. Other components are provided as part of the Covered Products installation package.  

Microsoft and other Third-Party Feature and Service Packs 

Microsoft may issue Feature and/or Service Pack releases of its software. Other third-party software vendors also use similar release vehicles to provide necessary updates to the software. Feature and service packs for Microsoft and third-party products’ new major versions need to be certified when using the Covered Products. 

When software vendors release feature or service pack version, Verint analyses the software changes, assesses the effect of the changes on the solution, and may decide to certify that feature or service pack to operate with Covered Products. The certification may apply to all or some of the Covered Products. The certification can also be scheduled as part of the next major Verba release. 

Verint strongly advises the customer to wait to install a feature and/or service pack version until it is certified for installation on Verba servers. If the customer does not follow Verint’s recommendation and installs a feature or service pack prior to certification, Verint may request the update be uninstalled as a prerequisite to providing further support for the solution. The effort to restore functionality to the supported solution may require an additional services charge. 

Security and Critical updates 

Apart from major, feature and service pack releases, Microsoft, Oracle Java, OpenJDK Java and Apache Tomcat periodically release updates related to security issues and/or product defects/enhancements. These will collectively be termed Security and Critical third-party updates.   

These updates are certified by Verint on a frequent basis as detailed in the following sections.  

Microsoft Critical updates and Security updates, Oracle Java and OpenJDK security updates

Microsoft Security and Critical updates can be installed at the customer’s discretion and do not require a confirmation from Verint. Verint reviews updates internally by keeping all test systems patched with the latest Microsoft and Oracle Java / OpenJDK Java updates and sends an alert in case an issue is discovered.

Apache Tomcat and OpenSSL security updates 

Verint’s proactive third-party certification schedule for Apache Tomcat and OpenSSL updates is aligned with Verba release schedule, new Tomcat / OpenSSL versions are to be integrated with new Verba releases.

Please note that Tomcat / OpenSSL updates cannot be downloaded and installed directly from the vendor’s website. Updates are customized and packaged by Verint to meet our software requirements and provide correct integration with Verba software. Only Tomcat / OpenSSL updates downloaded from Verint as part of Verba release installation package may be used to update Verba servers. The certification may also be scheduled as part of the next major Verba release.

Other Updates from Microsoft 

In addition to Service Packs and Security Bulletins, Microsoft issues a wide range of updates for its products that are available for download.  At the Operating System level, these are collectively termed Windows Updates and they fall into many categories: Critical Updates, Recommended Updates, Windows Tools, Multi-Language Features, Internet and Multimedia Updates, etc. 

For non-operating system components, there are also a wide range of updates available from the Microsoft Download Center (http://www.microsoft.com/downloads). 

In accordance with internal IT policies, the customer may choose to deploy updates that are Not Relevant to Verint’s solution or those marked by Microsoft as Not Critical. It is Verint’s recommendation that the Not-relevant and/or Not-critical updates are NOT deployed and that the customer wait until a suitable Microsoft Service Pack is released that includes all of these updates. 

Should the customer deploy updates that are Not-critical and/or Not Relevant, Verint will continue to provide support in accordance with its support/maintenance agreements, as detailed in the next sections.  However, Verint is not able to proactively test such updates due to their vast quantity and lack of relevance to the maintenance of a secure, properly functioning system. 

Verint Published Guidance on Third-Party Software 

Verint will provide information on any exceptions to its support and will advise its customers of service impacts to the operability or reliability of Verint-developed software packages related to anti-virus software and/or Microsoft operating system software programs including Service Packs or Updates as well as Java and/or Tomcat updates.    

Installation of Non-Certified Third-Party Products 

There are times when a customer wishes to install a third-party software product on a server that is part of a Covered Product’s solution.  One common example is the installation of anti-virus software, as noted in a previous section of this document. Customers may also have utilities used for health-monitoring, maintenance, or other IT related tasks. 

The installation of software that is not explicitly guided by Verint (and thus tested for interoperability) can present several challenges. 

It is a well-known and Microsoft documented fact that software installation and execution under Windows can adversely impact existing software in terms of DLL conflicts, registry settings, and other, sometimes subtle, system-level changes.  Furthermore, the operation of software – especially anti-virus or monitoring software that runs continuously in the background can affect the performance profile of the server (CPU availability, disk usage, memory consumption, etc.). Additionally, defects in a third-party software product can crash or otherwise adversely impact the entire server. 

As a result, Verint generally discourages the installation of third-party products on the servers that run Verba software – with the exception of software that is provided or guided by Verint as part of the solution.  However, whether in accordance with the anti-virus and security policies noted earlier in this document or in accordance with other Customer requirements, Verint does not preclude the installation of third-party products. 

Verint requests that customers notify Verint or their authorized support provider in the event of installation of a third-party product. The impact of such installations on Verint’s support commitments is noted in the section that follows. 

Verint reserves the right to provide guidance to the customer that a third-party product should not be installed when the product will seriously impact the Covered Product’s functionality or performance. 

Summary 

Verint Support 

Verint will provide support for Covered Products that are under a Verint maintenance contract (excluding time and materials or self-maintainer offerings) when the customer installs updates to Microsoft Service Packs or Updates, subject to certain exceptions that will be communicated explicitly by Verint, when relevant. Installation and/or updates of Microsoft Service Packs and Updates or other third-party software by the customer do not void the customer's Verint warranty or Verint maintenance contract for affected Verint- manufactured servers and/or Verint-developed software packaged with a Verint-supplied or customer-supplied third-party software packages except as otherwise provided. 

Any services performed by Verint as a result of the customer installing and/or updating Anti-Virus Software and/or Microsoft operating system software program Service Packs and Updates and/or other third-party products (hereinafter referred to as customer-installed software) other than those which are provided, certified or guided to by Verint as required for use in the solution could be billable to the customer at Verint’s then-current charges. 

If a problem is discovered in a Covered Product that appears to be affecting the operability or reliability of a Verint-developed software package after the customer has installed or updated the customer-installed software, the customer should report the error using the standard Verint maintenance support process. Verint reserves the right to direct the customer to disable (or remove) customer-installed software as part of Verint's troubleshooting process until the problem can be identified and resolved. 

The customer should be prepared to assess the risks and either remove the customer-installed software or decide to leave the customer-installed software installed. 

Verint does not guarantee that its products can be made compatible with particular customer-installed software, other than those products which are provided, certified or guided to by Verint as required for use in the solution.