Norton Personal Firewall for Macintosh Evaluation Guide Firewall Protection for Client Computers Corporate firewalls, while providing an excellent level of security, are not always enough protection for an enterprise network. Client-side firewall products, like Norton Personal Firewall, provide an extra level of protection from worms and blended threats, ensuring that each user is protected from potentially devastating attacks. Gateway firewalls can protect the organization from hackers and threats while employees are in the office, but that protection is lost as soon as users leave the building. Employees who regularly take their laptops home are open to hackers while checking email or surfing the web using a home connection. It is quite possible for a user to accidentally bring a worm or virus to the office, thereby bypassing the corporate firewall and spreading the infection internally. With client-side antivirus and firewall protection, however, these threats can be neutralized. 1
Contents Introduction Firewall Protection for Client Computers................. 1 What is Norton Personal Firewall for Macintosh?..................... 3 Norton Personal Firewall Key Differentiators.................... 4 Key Features and Benefits......................... 4 Technical Specifications and System Requirements................... 6 2
What is Norton Personal Firewall for Macintosh? Norton Personal Firewall is the best selling firewall on the Macintosh platform. This easy-to-use utility goes beyond the basic capabilities of the built-in OS X firewall, allowing users to see who is connected to their machine, via which service, and providing the ability to monitor outgoing connections. Differentiation from built-in OS X Firewall The Apple firewall controls only allow Mac OS X users fundamental access to the UNIX firewall in the form of a very simple preferences panel. Users can only turn the firewall on and off and block TCP/IP transmissions. There is no customization with the basic firewall: once a protocol is turned off, it is completely deactivated. Users cannot specify whether one external party can be allowed access and another denied access. In contrast, Symantec Norton Personal Firewall for Macintosh offers advanced protection from Internet hacking, and provides the following additional capabilities: Blocks outgoing connections to give users better system control and protection Provides IT administrators control of the types of information being shared throughout the network Enables clients and administrators to see connected users on the fly Allows administrators to track who is visiting shared volumes and allow or disallow access to employees & authorized channel partners only Contains firewall status and activation via the dock icon to enable users to control firewall protection, view connected users, and monitor recent connection attempts Provides inbound and outbound connection blocking Allows users to configure network access to specific programs, such as itunes and FTP, via the application control Enables users to be virtually invisible to other Internet users through Stealth Mode functionality Tracks all access attempts and transmission types via a detailed access history, providing key data about threats and intrusions Provides optional integration with Norton AntiVirus for Macintosh 3
Norton Personal Firewall Key Differentiators 1. Self-test mode to ensure the firewall is on and systems are protected. IT staff can have users test a machine's settings to make sure the firewall protection is working as needed. Users can test various connection types from different IP addresses to ensure appropriate protection. 2. View and adjust firewall settings from the menu bar and dock icon in Mac OS X. This option enables users to change firewall settings on the fly, or to adjust to different locations as needed. For instance, a user can temporarily disable the firewall to allow the IT help desk to FTP necessary files to a machine. 3. Allows users to view a list of currently connected visitors on the fly. Norton Personal Firewall for Macintosh allows users to see the IP address of anyone connected to the machine, via which specific service. This allows easy identification of visitors from outside the appropriate network and helps IT staff evaluate a potential intruder. An access log can be viewed instantly from the application's dock icon to provide real-time answers for support personnel. 4. Detailed logs provide valuable information concerning access attempts. Norton Personal Firewall for Macintosh maintains detailed logs, tracking a variety of data regarding incoming (and, if desired, outgoing) traffic, including IP addresses, connection service, port number, time/date, and mode. Logs can be exported and sent to IT administrators to track possible attacks and sources. Key Features and Benefits Norton Personal Firewall for Macintosh provides a variety of additional features not included in the Mac OS X built-in firewall and competing products. Key features and associated benefits include: Features Blocks outgoing connections based on user-defined criteria Provides a view of currently connected users and associated services, including FTP, itunes music sharing, and instant messaging, for example. Identifies, via Visual Tracking, online intruders and relevant information, such as the intruder's geographic location and IP address; the identification of the network administrator; and data provided by the "WhoIs" database ( e.g., the name of the intruder's organization, the ISP, the administrator, and contact information). Benefits Gives IT staff and users better control and protection. Can prevent home use of certain controls or applications a business does not want accessed. Can also help in the defense against Trojan horses, which utilize ports when sending information to hackers. Makes it easier to spot hacking attempts when users know, in realtime, who is connected to the computer. Helps IT staff assess vulnerabilities and take action to shut down potential threats. Provides valuable information about hacking attempts to help IT administrators take preventive and proactive action. 4
Key Features and Benefits (cont.) Features Benefits Automated set-up process for easy installation and initial operation. Makes it easier for novice users with little technical knowledge to install the product and protect their machines immediately. IT staff can help offsite users install and set up the firewall in three easy steps, ensuring machines are protected, regardless of location. Provides automatic protection that sets itself up for the most common Internet applications users right out of the box for Mac OS X, OS 9, and OS 8. (Norton Personal Firewall 2.0 for Macintosh is included for Mac OS 8 and 9 users). Immediate, ongoing protection from hackers for Mac OS X, OS 9, and OS 8 users. IT staff can install Norton Personal Firewall for Macintosh on machines for immediate protection. Stealth Mode makes the Macintosh client invisible to hackers by dropping ping attempts without informing senders there is a computer at the attempted address. Provides powerful protection from hackers who are unable to see a secured Macintosh on the Internet. This is particularly useful for users traveling and using unsecured networks, including wireless networks at restaurants and hotels. Corporate employees using Stealth Mode can surf the web and check email while being invisible to hackers looking for open ports within their IP range. Allows firewall customization and changes to default settings such as allowing or denying access according to protocol, port number, or IP address; or changing ports to meet individual needs. Provides firewall flexibility while safeguarding a Macintosh from unauthorized access. IT staff can have unprecedented control over allowed services. For example, employees may use instant messaging but not access Blizzard.net or Quake III servers. Allows users to download files (via Active FTP) behind the firewall without turning it off. Enables the firewall to accept FTP downloads generated by users without reconfiguring or turning the firewall on or off. Notifies users of unauthorized attempts to access the system, and allows them to accept or deny access attempts by service, by port, or by IP address. Captures the information in log files. Lets users know someone is attempting to access their Macintosh. History logs show attempted connections that were denied and allowed. The logs also display: allowed TCP http connections to the Internet allowed attempts if another service is utilized UDP and TCP packets Provides specific information to respond to vulnerabilities, or take action against hackers. LiveUpdate keeps applications up-to-date by checking for updates regularly. Provides an automated method for managing antivirus updates. IT staff can easily ensure users always have the most current version of the software. 5
Technical Specifications and System Requirements TCP and UDP blocking Reads all packets coming in Blocks port scanning (no warning or alert) Filters UDP/TCP packets IP address Subnets Static (always the same IP address) Dynamic (always changing and in a range IP address) Port access Provides commonly used ports in the Self Test and Custom Port window. SYN Blocking (Denial-of-Service) Blocks all unwanted TCP activity so a TCP packet with a SYN command will always be denied. MAC OS X Macintosh system with PowerPC G3 or higher processor Mac OS X version 10.1.5 or higher 128 MB of RAM (required for Mac OS X) 25 MB of available hard disk space DVD or CD-ROM drive Internet connection required for LiveUpdate TM MAC OS 9 PowerPC-based Macintosh system Mac OS 9.2 or higher 24 MB of RAM 10 MB of available hard disk space DVD or CD-ROM drive Internet connection required for LiveUpdate TM 6
ABOUT SYMANTEC Symantec is the global leader in information security providing a broad range of software, appliances and services designed to help individuals, small and mid-sized businesses, and large enterprises secure and manage their IT infrastructure. Symantec's Norton brand of products is the worldwide leader in consumer security and problem-solving solutions. Headquartered in Cupertino, Calif., Symantec has operations in more than 35 countries. More information is available at www.symantec.com. Symantec Corporation World Headquarters 20330 Stevens Creek Boulevard Cupertino, CA 95014 USA 408 517 8000 800 721 3934 www.symantec.com Symantec has worldwide operations in more than 35 countries. For specific country offices and contact numbers please visit our Web site. For product information in the U.S., call toll-free 800 745 6054. Symantec, the Symantec logo, and Symantec Client Security are US registered trademarks of Symantec Corporation.Symantec and the Symantec logo are U.S. registered trademarks of Symantec Corporation. All other brands and products are trademarks of their respective holders/s. Copyright 2004 Symantec Corporation. All rights reserved. 09/04 10296684