Enterprise Antivirus Solutions

[Saulbadguy]

We currently use Symantec Endpoint Protection 11 for about 2500 nodes and it's working well for us, however i've been tasked with "exploring" other options.

What is everyone using for an Enterprise AV solution here? Naturally, we require centralized management of endpoints and distribution of updates.

Any resources and/or opinions are welcome.

 

[Chiefcrowe]

I just recently saw a demo of Forefront 2010 and it looked quite good. I haven't tested it yet or anything but it seems very granular and easy to use. I will be checking it out when i have a chance.

 

[JeffreyLebowski]

Honestly, The Symantec Endpoint 11 is one of the best products out.
While they can't make a consumer product for crap, their enterprise stuff is very good and easy to use.

 

[Chiefcrowe]

They claim that version 12 is even better but we'll see about that...

 

[zerocool1]

I've heard it'll integrate their DLP Endpoint agent so if you're runnning that in your environment then it should make deployment a heck of a lot easier.

 

[WobbleWobble]

We use Trend Micro here and it's been a great product. I've been pretty happy with their SmartScan scanning technology and web reputation service.

Though my big complaint is the management of TrendMicro OfficeScan clients and the handling of large numbers of clients. 2500 should be OK, as that's close to what we break our OfficeScan servers into but we have many more clients than that forcing us to use multiple OfficeScan servers.

If you do virtualization, they have some great support for VDIs and Deep Security for ESX.

 

[Chiefcrowe]

interesting... how does trend micro work with a Virtual Desktop Infrastructure?

 

[WobbleWobble]

OfficeScan and their VDI plug-in pretty makes it smart enough to avoid scanning storms.

As per their data sheet...

New! Optimized for Desktop Virtualization
• Automatically recognizes whether an agent is on a physical or virtual endpoint to better target protection
• Prevents network, CPU, and storage conflicts by serializing scan and update operations per virtual server
• Shortens scan times of virtual desktops by white-listing base images and previously scanned content

http://us.trendmicro.com/imperia/md...nterprise/officescan/ds04_os10.5_100603us.pdf

McAfee has their MOVE technology. Though McAfee is newer to the VDI world and MOVE is either in beta or has only recently been released.

 

[Chiefcrowe]

oh i see.. that is very cool. from what i've heard of Symantec Endpoint 12, it also has similar technology.

 

[Mide]

I implemented TrendMicro OfficeScan at my company and I can't say that I'd recommend a renewal after our 2 years run out.

The bad
1) If you have slower machines in your company like we do...oldest are D610s...the startup takes forever. You are essentially unable to do anything until the "blue ball" appears in the task bar. The same goes for even faster machines. I have a C3D with 4GB of RAM and it still takes a good amt of time before I can start using my system. That is why coffee exists I guess.

2) The web reputation service is always using up bandwidth. After we turned it on we noticed a large spike in usage as every damn website users needed to be verified with the central Trend server first.

The Good
1) It was the cheapest per license compared with others

2) In the management interface you can do remote installs without any fuss.

 

[WobbleWobble]

We're still running Pentium 4s and some have as few as 256MB RAM. Even my own work machine is P4, I don't feel that OfficeScan slows down the machine anymore than any other enterprise AV. But that's just my opinion...

If you're using OfficeScan 10.5 with Smart Scan v2, you can redirect clients to it as an internal file and web reputation service.

 

[LiuKangBakinPie]

We use Trend Micro here and it's been a great product. I've been pretty happy with their SmartScan scanning technology and web reputation service.

Though my big complaint is the management of TrendMicro OfficeScan clients and the handling of large numbers of clients. 2500 should be OK, as that's close to what we break our OfficeScan servers into but we have many more clients than that forcing us to use multiple OfficeScan servers.

If you do virtualization, they have some great support for VDIs and Deep Security for ESX.

Trend micro is part of cloud like Mcafee. Once it loose internet connectivity its detection like Mcafee drop to 70 percent. Just keep that in mind.

Op for enterprise Symnatec aka norton have always been the forefront as that's the area they paid much attention too hence the the neglecting of their home products. Just last few years they paid more attention to the home users while still putting most their resources towards enterprise part of their packages. You don't get any better than them. They specialize in it and staying with them is your best option.

 

[hanoverphist]

im facing a renewal shortly, have been using trendmicro for a long time. way before the 'worry free" thing all came out. i have been wondering about replacement software also, i havent kept up as much as i should be with competition for them at all. we are a small firm, 20 clients and just me for an admin. are there any real benefits to moving to a different brand at this point?

 

[Mide]

We got 1 more year of Trend license...if that was up I'd highly look into something else like Symantec's product. They've since improved Norton quite a bit on their home-user end so I'm hoping that they did the same with their Endpoint solution. I'd contact them and get a demo lab going to see about resource management, server control, etc.

 

[Texashiker]

2 years ago we had Panda Security for Enterprise - we had problems from the very start. There were constant issues with the panda firewall / proxy server that would randomly block internet access.

Last year we were using Computer Associates threat management - there have been issues with this one as well. They were late on getting the windows 7 installer working, instead of mailing a DVD with the latest version, they want you to download a 2 - 3 gig file. Why does an anti-virus need an installer that is 2 - 3 gigs to start with? Much less have to download it.

After trying to download the r12 update, and constant time out issues, I gave up. I contacted support and asked them to mail me a DVD. That was 3 or 4 months ago and I have yet to see the disk. If you have an active support contract, there should not been an issue with a company mailing you a dvd that cost $1 to ship.

In the next few months I am going to take a serious look at a Symnatec / norton solution.

 

[dpodblood]

We're using Sophos here.

 

[Gamingphreek]

Stuck with McAfee.... ugh ePO.

 

[Homerboy]

we're using SEP here... and a pile of machines just got hit with malware via HTTP. SEP didn't do it's job at all. Even a test install of Avast free blocked the incriminating sites/links.

I want new options too!

 

[Emulex]

SEPM while nasty is far better than microsoft's management software for forefront. i'm sorry to say since i sell both that SEPM is better. but 12 might have some hope if they pull their SEPM out of their arses and stabilize their product. lol.

 

[Chiefcrowe]

why would you say that SEPM is far better?

 

[VinylxScratches]

I hear F-Secure is really awesome.

It even removes Symantec like a charm when migrating.

 

[LiuKangBakinPie]

I hear F-Secure is really awesome.

It even removes Symantec like a charm when migrating.

Just found this awesome antivirus called Xp Antivirus. Glad I found it or it found me. Just after install it found 135 trojans and removed them.

 

[VinylxScratches]

Not sure what you are alluding to, F-Secure is legit.

http://www.f-secure.com

 

[imagoon]

Trend micro is part of cloud like Mcafee. Once it loose internet connectivity its detection like Mcafee drop to 70 percent. Just keep that in mind.

Op for enterprise Symnatec aka norton have always been the forefront as that's the area they paid much attention too hence the the neglecting of their home products. Just last few years they paid more attention to the home users while still putting most their resources towards enterprise part of their packages. You don't get any better than them. They specialize in it and staying with them is your best option.

Source please?
Trendmicro has a cloud based solution that gets pushed down to the server and to the clients on an hourly basis. It isn't like the cloud shuts off and the program goes stupid. We use Trendmicro Officescan here and the "cloud" is primarily used when the clients can't connect to the officescan and smartscan server farms.

I so highly recommend Officescan at this point after the horrible experiences with McAfee and to lesser extent Norton.

 

[Exterous]

I implemented TrendMicro OfficeScan at my company and I can't say that I'd recommend a renewal after our 2 years run out.

The bad
1) If you have slower machines in your company like we do...oldest are D610s...the startup takes forever. You are essentially unable to do anything until the "blue ball" appears in the task bar. The same goes for even faster machines. I have a C3D with 4GB of RAM and it still takes a good amt of time before I can start using my system. That is why coffee exists I guess.

2) The web reputation service is always using up bandwidth. After we turned it on we noticed a large spike in usage as every damn website users needed to be verified with the central Trend server first.

The Good
1) It was the cheapest per license compared with others

2) In the management interface you can do remote installs without any fuss.

Intesting - we specifically tested some D610s and D600s (along with GX270s and 80s) with Trend before switching because we have a lot of labs using older equipment and didn't have any issues with startup time.

We also have a lot of custom lab software that we have had issues in the past with Norton and Blink AV. No problems yet with Trend

The remote install ease was a big plus for us as we have a lot of remote users who are constantly traveling around the world

We didn't like the Reputation filter but honestly didn't spend too much time messing around with it as Websense finally got approved