Symantec AntiVirus Enterprise Edition

Transcription

1 Kristen Noakes-Fry Product Report 7 November 2003 Symantec AntiVirus Enterprise Edition Summary Symantec AntiVirus market leader for the Intel-based PC and server combats viruses from the desktop all the way to the Internet gateway. New all-in-one products incorporate firewall and intrusion detection features. Note Symantec AntiVirus formerly known as Norton AntiVirus incorporates several former Norton AntiVirus products into the Symantec AntiVirus Enterprise Edition 8.6 Suite. Symantec has discontinued active use of the brand name Norton in its corporate business, but continues use of the Norton brand in its consumer and retail business. Table of Contents Overview Analysis Pricing Competitors Strengths Limitations Insight List Of Tables Table 1: Enhancements: Symantec AntiVirus Enterprise Edition 8.6 Table 2: Overview: Symantec AntiVirus Table 4: Symantec AntiVirus Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 Corporate Headquarters Symantec Corporation Stevens Creek Boulevard Cupertino, CA 95014, U.S.A. Tel: Internet: In Canada: Tel: Overview The Symantec AntiVirus products combine detection, scanning and repair technologies to protect desktops, file servers, groupware servers and Internet gateway traffic from new and known viruses, worms, blended threats, spam and other unwanted content at multiple computing levels, from the desktop to the Internet gateway. Symantec AntiVirus products use Norton AntiVirus Extension (NAVEX) for virus scanning and repair and LiveUpdate for deploying virus definitions and new engines across the enterprise. Symantec AntiVirus Enterprise Edition 8.6 Products in this suite include: Symantec AntiVirus for SMTP Gateways 3.1 Symantec Mail Security 4.0 for Microsoft Exchange Symantec AntiVirus Corporate Edition 8.1 Symantec AntiVirus/Filtering 3.1 for Lotus Notes/Domino Symantec Web Security 3.0 (AntiVirus and Filtering) Other Symantec AntiVirus Products Include: Symantec AntiVirus Gateway Solution Symantec AntiVirus for SMTP Gateways Symantec AntiVirus Enterprise Edition Symantec AntiVirus Corporate Edition Symantec AntiVirus Command Line Scanner 1.0 Symantec AntiVirus for NetApp Filers Symantec AntiVirus/Filtering for Domino (Advanced Interactive Executive [AIX], Solaris, iseries and Linux) Symantec AntiVirus/Filtering for Domino (Win2000/NT) 7 November

3 Symantec Mail Security for Microsoft Exchange Symantec AntiVirus for Blue Coat Security SYMBOL 183 \f Symbol \s 10 \h Symantec AntiVirus for Microsoft Internet Security and Acceleration (ISA) Server Symantec AntiVirus for Network Appliance NetCache Symantec AntiVirus Scan Engine Symantec AntiVirus for Clearswift MIMEsweeper Products With Multiple Security Functions Symantec Gateway Security Appliance provides firewall, intrusion detection system (IDS), content filtering, virtual private network (VPN) and antivirus functions. Symantec Client Security combines three desktop protection technologies desktop firewall, IDS protection technology and Symantec antivirus technology into one integrated, centrally manageable managed product. Table 1: Enhancements: Symantec AntiVirus Enterprise Edition 8.6 Symantec System Center Digital Immune System NAVEX Symantec Security Response Expanded Symantec Web Security Offering Expanded Symantec AntiVirus for SMTP Gateways Symantec Mail Security for Exchange Symantec AntiVirus/Filtering for Domino After deploying antivirus solutions, managers can create, enforce and update policies to keep servers and desktops properly configured at all times across the enterprise and multiple platforms. Internet-based response infrastructure connects the customer digitally to Symantec Security Response for quick virus threat resolution. Permits virus definitions and scan engine technologies to be updated without the need to deploy new software and, in most cases, reboot the system. Provides rapid, around-the-clock analysis and response helping stop viruses before they spread across the enterprise. Policy-based uniform resource locator (URL) filtering integrated with virus protection for HTTP traffic. Integrated, multilayered anti-spam for single-pass scanning of all Simple Mail Transfer Protocol (SMTP) traffic for viruses, spam and other unwanted content. Integrated rules-based filtering in addition to core virus protection functionality. Integrated rules-based filtering in addition to core virus protection functionality. Table 2: Overview: Symantec AntiVirus Version 8.6 (Enterprise Edition) Date Announced 20 August 2001 Date First Installed 1 September 2001 Types of Antivirus Technologies Used On-demand and Real-time scanning engines, with virus definitions based on scanning and heuristic technologies. 7 November

4 Table 2: Overview: Symantec AntiVirus Operating System Symantec AntiVirus products are available for the following platforms: DOS, Platforms Supported Win3.1x, Windows 95/98/ME/XP/NT/2000/2003 desktops; Windows NT/2000/2003 and Novell NetWare file servers; IBM OS/2; Apple Macintosh; Sun Solaris; Red Hat Linux; IBM Lotus Notes on Win2000/NT; IBM AIX; OS/390; OS/400; Microsoft Exchange 2000/2003, 5.0 and 5.5 Gateways Supported Symantec AntiVirus for SMTP Gateways provides integrated, multilayered security for Internet traffic. It scans attachments for viruses and stops unwanted content and spam using layered technologies, such as anti-spam heuristics and support for multiple blacklists and whitelists. Unwanted content can be blocked based on subject line or file size. Symantec Web Security 3.0 provides real-time URL filtering and virus protection for HTTP and FTP traffic at the proxy server or firewall. Certifications International Computer Security Association (ICSA), Virus Bulletin (VB) 100 Languages Software and documentation both localized into German, French, Italian, Spanish, Supported Brazilian, Dutch, Norwegian, Swedish, Danish, Finnish, Polish, Czech, Hungarian, Documentation Japanese, Traditional Chinese, Simplified Chinese, Korean. Documentation only is localized to Turkish and Hebrew. Viruses Detected Heuristic Engine Scanning Engine Types of Files Scanned Macro Virus Detection Detects in-the-wild viruses (per Virus Bulletin 100 certification). Detects blended threats, sophisticated viruses and worms that use multiple methods to attack or propagate. They cause harm, propagate via multiple protocols (require no human intervention), and exploit weaknesses in Web and servers. Unlike traditional scanning, Bloodhound the heuristic engine detects new and unknown threats by scouring an application s overall structure, file data, instructions, programming logic and other characteristics: Uses specialized logic to evaluate the probability of a viral infection. Stops suspicious files before they impart damage. Inspects files transparently to identify virus-like behavior in a virtual space. Repairs any viruses found on the customer s computer automatically. NAVEX separates the scanning engine from the scanning application. Thus, the scanning engine can be updated independently and distributed as a portion of Symantec s standard virus definitions: Allows customers to update engines, when necessary, at the same time as virus definitions seamlessly, automatically and, without reinstalling the application or disrupting service. Platform-neutral source code in the event of a new virus or class of virus, Symantec can compile one set of source code to run on all Symantec-supported platforms. In its default configuration, Symantec AntiVirus scans all files for viruses, Trojans, worms and mass mailers. Detects macro viruses. 7 November

5 Actions Taken When a Virus Is Detected Updates for Signatures or Patterns Technology Used for Updates (such as, push technology) Management Features Logging and Reporting Protection for Clients Quarantine. Infected files are isolated and encrypted until Symantec has repaired or cleaned them to guard against the infection spreading to other system and data files and other computers: Quarantine Console allows virus management across domains. Quarantine Server is deployed centrally to communicate with clients and servers to receive copies of infected files. Central Quarantine Server maintains the latest virus definitions automatically and checks for cures. If none are found, the server forwards the file to Symantec automatically over a secure connection. Once the infection is cured, the server will receive the newest definitions for distribution and repair of the problem. LiveUpdate delivers virus definition and scan engine updates to all antivirus products across the enterprise. It connects to the Symantec server manually or automatically to download the most current virus definitions: Using microdefinitions, or incremental updates, Symantec keeps track of which virus definitions a customer has previously downloaded to keep the update packages small and efficient. LiveUpdate Administrator (LUAdmin), a tool provided with Symantec System Center, allows corporate administrators to create internal virus definition LiveUpdate servers. Using the tool, the administrator can download the latest virus definitions to the internal server, and configure client machines to get definitions from this internal server rather than the Symantec server. Symantec AntiVirus Corporate Edition for Desktops and File Servers employs LiveUpdate, but also includes Virus Definition Transport Method technology to push both virus definitions and engine updates through its three-tier hierarchical management architecture to all managed endpoints. When a user is on the Internet, AntiVirus checks with LiveUpdate servers for new definitions every four hours. When they are available, new definitions are downloaded and installed behind the scenes, providing continued and uninterrupted protection to the user. In tests by Symantec, 180,000 desktops can be updated from a single parent server in 51 minutes. The Symantec System Center enables centralized configuration and deployment of virus definitions and product updates to multiplatform desktops and file/print servers. Centralized distribution reduces deployment headaches, such as sneaker nets, failed jobs and bad installations. Product performs logging and reporting functions. All client settings can be locked down so users cannot change them. Or client systems can be configured at the management console and then monitored. If a virus is detected, a repair is automatically launched and an alert is broadcast to the IT administrator via the Symantec System Center console. 7 November

6 Protection for Internet Gateways Protection for Networks and Desktops Security Features Policy Enforcement Virus Quarantine Virus Source Tracking Digitally Signed Binaries Support for Intrusion Detection Systems (IDS) Support for Content Inspection Symantec AntiVirus for SMTP Gateways provides integrated, multilayered mail security for Internet traffic, allowing administrators to block malicious code and unwanted content at the first line of network defense the SMTP gateway. It scans attachments for viruses and stops unwanted content and spam using a combination of layered technologies, such as anti-spam heuristics, multiple realtime blacklists, and support for customized blacklists and whitelists. Unwanted content can be blocked based on common message characteristics, such as file name, extension and subject line. Administrators can schedule flexible policy updates, receive system and security alerts, and generate management reports from a secure Web browser. Symantec Web Security protects HTTP/FTP traffic with scalable, highperformance, one-time scanning that integrates list-based and heuristic, contextsensitive analyses to protect the Web gateway from viruses and unsuitable content. Symantec researches, develops and supports its own international URL filtering lists, as well as protection technologies, including NAVEX Bloodhound and the multilingual Dynamic Document Review for content analysis. Centralized policy management and built-in support for external directory services including Lightweight Directory Access Protocol (LDAP) and Windows NT Users/Groups permits flexible administration of multiple users, groups and servers. AntiVirus Corporate Edition provides multiplatform virus protection at the desktop and file server tiers, enterprisewide. Integrates with EMC Celerra and NetAPP File Servers to support antivirus protection at the storage layer for storage and delivery of network-attached data. Symantec AntiVirus Corporate Edition allows IT managers to set and lock down policies that keep systems up to date and properly configured, fully protecting users at all times. Administrators can manage policies from a centralized console to keep DOS, Windows 3.x, Windows 9x/ME, Windows 2000, Windows XP, Windows NT, Windows 2003, and NetWare servers and desktops updated and properly configured. All client settings can be locked down so users cannot change them. Or client systems can be configured centrally at the management console and then monitored. If a virus is detected, a repair is automatically launched and an alert is broadcast to the IT administrator via the Symantec System Center console. Symantec AntiVirus products offer a quarantine feature that allows users to isolate infected files in a segment of the computer, in an encrypted state, until they are repaired by Symantec. The administrator can identify the machine that generated a virus alert. Yes. Symantec offers a separate product, Symantec Client Security, which combines desktop firewall and IDS protection technologies along with the virus protection of Symantec AntiVirus. Symantec researches, develops and supports its own Dynamic Document Review (DDR) content-analysis technology. 7 November

7 Support for Installation and Support Symantec provides antivirus protection at the server for both Microsoft Exchange and Lotus Notes/Domino. These products stop viruses, spam and other unwanted content at the mail server, before they can spread into or out of the organization. Symantec AntiVirus Corporate Edition includes both an MS Exchange and Lotus Notes plug-in that protects the local user s mail database. In addition, Symantec AntiVirus for SMTP Gateways protects against -borne viruses at a critical point of entry into the corporate network. Installation Centralized installation and management, which simplifies enterprise planning and the creation of server hierarchies and groups. Support Free online support for users. Additional phone support options available. Vendor call back and response is targeted and usually occurs within 24 hours support is available to customers who have purchased platinum or premiumplatinum maintenance agreements. Symantec provides training and certification for many Symantec products through its channel partners. System Requirements: Hardware Windows 9x/ME Windows XP Windows NT/2000 Windows ME/98: Windows ME/98 with Internet Explorer 4.01 or higher Intel Pentium 150MHz or higher processor for Windows ME Intel Pentium 133MHz or higher processor for Windows 98 32MB of RAM Windows XP Home Edition and Professional: Windows XP Home Edition and Professional with Internet Explorer 4.01 or higher Intel Pentium 300MHz or higher processor 128MB of RAM Windows 2000 Professional: Windows 2000 Professional with Internet Explorer 4.01 or higher Intel Pentium 133MHz or higher processor 64MB of RAM Windows NT Workstation: Windows NT Workstation with Internet Explorer 4.01 or higher and with service pack 6 or higher Intel Pentium 133MHz or higher processor for Windows NT 32MB of RAM 7 November

8 Windows 2000 Server/Advanced Server Windows 2000 Server: Intel Pentium or compatible Windows 2000 Server with Service Pack 2 256MB RAM Microsoft Internet Explorer 4.0 or later Windows 2003 Windows 2003 Server: Server/Advanced 64-bit support Server 256MB RAM Microsoft Internet Explorer 4.0 or later Solaris Solaris: Scalable Processor Architecture (SPARC)-based server Solaris version 7 or 8 256MB RAM System Requirements: Software Desktop (minimum OS) Server (minimum OS) Groupware Other Analysis Platform independent Platform independent Platform independent The Digital Immune System provides central administration for Symantec security products. Through a single console, the Digital Immune System enables administrators to locate potential PC and server security problems quickly and take systematic measures to resolve these. Symantec estimates that hundreds of redundant requests are handled in real time without need for human involvement. New potential viruses are discovered: Through the use of technologies, such as heuristic scanning (in the case of Symantec, Bloodhound heuristics). By antivirus administrators who see files and systems exhibiting strange behaviors and then submit the files for analysis. How the Digital Immune System Works At Central Quarantine, suspect network files are quarantined and rescanned. Scan and Deliver secures submission component packages and forwards to Immune System Gateways any samples for which no cure is immediately available in the daily updates. These Gateways contain the newest individual cures available for recently discovered viruses. 7 November

9 Should no cure be available, the sample is sent transparently and automatically to Symantec, where Symantec AntiVirus Research Automation (SARA) attempts to replicate the virus in a virtual environment. SARA captures the virus signature(s), generates a detection and repair routine, tests the cure, and if the fix is verified against all replicas sends the tested cure back to customers. SARA can generate virus cures automatically for approximately 90 percent of all submissions. (Unresolved problems are referred to Symantec s virus analysts to produce a cure manually.) Automated intelligence determines which items in the queue receive the newly generated fix based on the fingerprint of the sample file. Once the cure has been complete, it is sent back to the Immune System Gateway from which it came and is replicated on all Immune System Gateways. The cure is then sent to the customer s Central Quarantine Server that deploys the cure to the infected machine or to all managed machines in the enterprise. Extensible Antivirus Scan Engine Technology Application independent The scan engine is used by, but is not part of, the core software application scanning components, which may be added or modified without affecting the operation of the software itself. Scan mode independent The same scan engine and definition component is used for both ondemand and on-access scanning, providing the same protection in both modes. Platform independent The same detection and repair algorithms (changes to the scan engine), as well as definitions, are written in a common language (C). Algorithms and definitions are compiled and tested simultaneously for the appropriate Windows, Unix, Linux, NetWare, AS/400 and Macintosh environments. Tier independent The same NAVEX engine and definitions are used on all network tiers from Symantec AntiVirus for Desktop/Server to the SMTP Gateway, Domino and Exchange servers. Language independent Since the core software application is not changed, localizing software updates does not present a problem. All customers regardless of location or product language receive the same level of protection at the same time. Version independent All currently supported releases use the latest scan engine technology based on the NAVEX architecture receiving updates to new threats without being required to migrate to the next version. Symantec Security Response Symantec Security Response provides customers and affiliates worldwide with seven-day, 24-hour support against virus threats, including new and existing viruses. As new computer viruses surface, Symantec Security Response creates identification and detection profiles for these viruses and delivers detection and repair options. These definitions and corrections are issued subsequently to Symantec customers. Symantec Security Response delivers: Security through product security policies and best-practice guidelines that can be updated and distributed through automated processes, such as LiveUpdate. Security through its incident response program, including emergency signatures, definitions and policies, and outbound communications, such as alerting services. Symantec response centers are located in the U.S. (California, Texas and Utah), Australia, Japan and The Netherlands. 7 November

10 Pricing Symantec sells its products through distributors and resellers that determine the retail prices. Site licenses are available. GSA Pricing Yes. Competitors Symantec AntiVirus is the market leader in antivirus solutions for the Intel-based PC and server. Symantec encounters most of its competition outside North America. In the worldwide enterprise antivirus market, it takes second place to Network Associates, while third-place Trend Micro is the leading supplier of antivirus products in Japan. In June 2003, early signs of potential major competition appeared on the horizon when Microsoft acquired the Reliable AntiVirus (RAV) product from a small Romanian antivirus software vendor, GeCAD an indicator that Microsoft intends to enter the antivirus market. Unlike Trend s and McAfee s antivirus management products, Symantec fails to provide reporting within a single product. Rather, for reporting, the new Event Manager product must be installed. Once installed, however, it is not restricted to antivirus (AV)-related issues but can pull in events from a wide variety of security-based applications. Table 4: Symantec AntiVirus Network Associates McAfeeVirusScan Trend Micro InterScan VirusWall Sophos Anti-Virus Solution Computer Associates etrust Antivirus Protects desktops, servers, groupware and Internet servers; offers wireless and personal digital assistant (PDA) protection, Internet Gateway protection, protection, file server protection, desktop protection and management solutions. Push channel disseminates virus information, updates and upgrades to the network administrator. Top-down, server-based approach intercepts viruses and malicious code at the Internet gateway. Optionally supports spam blocking, content filtering and mail traffic management. Other products protect groupware and servers, application servers and desktops. Application programming interface (API) Sophos Anti-Virus Interface (SAVI) for Windows NT and Unix enables third-party vendors and service providers to link to the Sophos virus protection engine to provide antivirus capabilities to securityrelated products. etrust Antivirus part of the etrust brand of security products detects virtually all known viruses; macro virus threats, malicious Java and ActiveX threats; and other malicious code. Offers centralized, policy-based management and automated distribution of signature update files. Strengths Quick Response to Widespread Viruses Through Symantec Security Response and Digital Immune System, Symantec reports that it responds to the vast majority of submissions in real-time, with little or no delay, turning around fixes for new viruses within an hour. Virus Definitions Updated Quickly 7 November

11 Symantec s LiveUpdate provides a quick and efficient means for updating virus definitions. Customers check Symantec s online database for new virus definitions and posted fixes. Updates and Virus Fixes Easy to Distribute NAVEX a modular scanning engine enables Symantec Security Response engineers to update portions of the Symantec AntiVirus software efficiently to deliver virus fixes such as new virus signatures, new scan engines and updates to customers in a form that is easy to distribute. Combined with the Microdefinitions technology, NAVEX offers a single-code approach that enables users to update virus definitions simultaneously across all supported Symantec AntiVirus platforms without requiring system or service stops and restarts. Limitations Lacks Intrusion Detection Symantec AntiVirus contains no intrusion-detection features and does not support intrusion-detection products from other vendors. However, clients can cross-grade to Symantec Client Security, an integrated superset that includes Symantec AntiVirus. Increased Licensing and Maintenance Prices According to Gartner clients, enterprise licensing program changes and product and maintenance prices have markedly increased the cost of Symantec s products. At the same time, Symantec is making no significant product and functionality improvements focused on small or very large enterprises. Lacks First-Class Personal Firewall Symantec s personal firewall is an average product that attracts sales mainly because of the brand recognition of Symantec s antivirus products. However, Symantec s Personal Firewall and AntiVrus products are managed and updated independently; thus, they do not leverage each other for learning and responding to new attacks. Insight As the seventh largest PC software supplier in the world, Symantec continues to benefit from brand recognition and reputation for good service. Current security offerings include virus protection, firewall, intrusion detection and vulnerability management. Symantec has moved to meet the current market need for an all-in-one appliance to replace traditional firewalls. The products that make up all-in-one offerings, such as Symantec Gateway Security Appliance and Symantec Client Security, particularly the personal firewall, are not all best of breed. Even so, these offerings fill a real need for a multifunction security appliance for small and midsize business market (SMB) and remote offices. Although Microsoft s antivirus plans could pose a threat to Symantec s market position, Symantec s antivirus products remain strong and reliable contenders in the enterprise antivirus market. 7 November