Appendix C: Additional Security Considerations

Additional considerations for scanning, data privacy, and antivirus configuration.

Scanning Considerations

  • Memory scanning requires elevated privileges
  • Network scanning may trigger security monitoring
  • Large CIDR ranges generate significant traffic
  • Cipher enumeration involves multiple TLS handshakes

Data & Privacy

  • Cloud downloads only when explicitly enabled
  • Web service integration transmits scan results
  • Filesystem scanning requires read access
  • Database tracking stores asset history locally

Antivirus Configurations

Enterprise antivirus solutions may flag the scanner components due to their network scanning capabilities and cryptographic analysis functions. Configure your antivirus policies to trust the following files and certificates to prevent false positives and ensure proper operation.

Scanner Executables

Add these file patterns to antivirus exclusions:

Windows:
- cryptographic-analyzer-windows-*-*.exe
- certscanner-windows-*.exe
- certscanner.exe
Linux:
- cryptographic-analyzer-linux-*-*
- certscanner-linux-*
- certscanner
macOS:
- cryptographic-analyzer-darwin-*-*
- certscanner-darwin-*

OpenSSL Components

Bundled OpenSSL 3.5.4 binaries extracted to temporary directories. The scanner extracts OpenSSL to a temporary directory pattern. Add these paths to antivirus exclusions:

Windows:
- %TEMP%\certscanner_openssl_*\openssl.exe
SHA256: 61857d55998dfaf7e855c00c3afbf9e2b7e024f44cd854180da330b0623c1635
Linux:
- /tmp/certscanner_openssl_*/openssl
SHA256: 89677c4272fac1aead18dd65143dc3c0bc13f0c1c22f19a538be59db0a30d2e8
macOS (Intel):
- /tmp/certscanner_openssl_*/openssl
SHA256: 8702d163004c63d84c0d589d11291f23ac230ad2495f3243a26e720373a6fbb5
macOS (Apple Silicon):
- /tmp/certscanner_openssl_*/openssl
SHA256: 9fb92ca4f707b7d452b2ca8dd2a293c3cb0789e47d80f1acdda06c0042a59f73

Note: The * represents a random suffix generated by the operating system for each execution.

Code Signing Certificates

Scanner executables are signed with the following certificates. Configure your antivirus to trust these certificate authorities and signatures.

Windows Code Signing Certificate

Subject:
CN=TYCHON, LLC
OU=Engineering
O=TYCHON, LLC
L=Fredericksburg
S=Virginia
C=US
Issuer:
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1

macOS Code Signing Certificate

Developer ID:
Developer ID Application: Tychon, LLC
Certificate Chain:
Developer ID Certification Authority
Apple Root CA
Runtime:
Hardened Runtime Enabled (v12.0.0)

Contact your HCL account representative for the current certificate serial numbers, thumbprints and team identifier for your release.

Common Antivirus Platform Configuration

Windows Defender: Add folder exclusions for the scanner installation directory, configure process exclusions for certscanner*.exe, allow certificate-based trust for signed binaries. CrowdStrike Falcon: Create IOA exclusions for the scanner processes, add certificate-based allow policies, configure custom hash-based exclusions. Symantec Endpoint: Add application control exceptions, configure file exclusions in real-time scan, trust publisher certificates in policy. McAfee/Trellix: Configure VirusScan exclusions, add DLP policy exceptions for scan output, set application control trusted publishers.