Symantec Endpoint Protection
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
top
Symantec Endpoint Protection, developed by Broadcom Inc., is a security software suite that consists of anti-malware, intrusion prevention and firewall features for server and desktop computers.cite-ref-two-2-0[2]
Contents
• Features
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Version history
The first release of Symantec Endpoint Protection was published in September 2007 and was called version 11.0.cite-ref-messmer-2007-3-0[3] Endpoint Protection is the result of a merger of several security software products, including Symantec Antivirus Corporate Edition 10.0, Client Security, Network Access Control, and Sygate Enterprise Edition.cite-ref-messmer-2007-3-1[3] Endpoint Protection also included new features.cite-ref-messmer-2007-3-2[3] For example, it can block data transfers to unauthorized device types, such as USB flash drives or Bluetooth devices.cite-ref-messmer-2007-3-3[3]
At the time, Symantec Antivirus Corporate Edition was widely criticized as having become bloated and unwieldy.cite-ref-two-2-1[2] Endpoint Protection 11.0 was intended to address these criticisms.cite-ref-two-2-2[2] The disk footprint of Symantec Corporate Edition 10.0 was almost 100 MB, whereas Endpoint Protection's was projected to be 21 MB.cite-ref-two-2-3[2]
In 2009, Symantec introduced a managed service, whereby Symantec staff deploy and manage Symantec Endpoint Protection installations remotely.cite-ref-4[4] A Small Business Edition with a faster installation process was released in 2010.cite-ref-5[5] In February 2011, Symantec announced version 12.0 of Endpoint Protection.cite-ref-messmer-2011-6-0[6] Version 12 incorporated a cloud-based database of malicious files called Symantec Insight.cite-ref-messmer-2011-6-1[6] Insight was intended to combat malware that generates mutations of its files to avoid detection by signature-based anti-malware software.cite-ref-messmer-2011-6-2[6] In late 2012, Symantec released version 12.1.2, which supports VMware vShield.cite-ref-7[7]
A cloud version of Endpoint Protection was released in September 2016.cite-ref-8[8] This was followed by version 14 that November.cite-ref-osborne-2016-9-0[9] Version 14 incorporates machine learning technology to find patterns in digital data that may be indicative of the presence of a cyber-security threat.cite-ref-osborne-2016-9-1[9] It also incorporates memory exploit mitigation and performance improvements.cite-ref-gartner-10-0[10]
Features
Symantec Endpoint Protection is a security software suite that includes intrusion prevention, firewall, and anti-malware features.cite-ref-searchsecurity20182-11-0[11] According to SC Magazine, Endpoint Protection also has some features typical of data loss prevention software.cite-ref-scmag-12-0[12] It is typically installed on a server running Windows, Linux, or macOS.cite-ref-one-13-0[13] As of 2018, Version 14 is the only currently-supported release.cite-ref-symantec-enterprise-technical-support-2017-14-0[14]
Endpoint Protection scans computers for security threats.cite-ref-searchsecurity20182-11-1[11] It is used to prevent unapproved programs from running,cite-ref-searchsecurity20182-11-2[11] and to apply firewall policies that block or allow network traffic.cite-ref-15[15] It attempts to identify and block malicious traffic in a corporate network or coming from a web browser.cite-ref-16[16] It uses aggregate information from users to identify malicious software.cite-ref-scmag-12-1[12] As of 2016, Symantec claims to use data from 175 million devices that have installed Endpoint Security in 175 countries.cite-ref-scmag-12-2[12]
Endpoint Protection has an administrative console that allows the IT department to modify security policies for each department,cite-ref-searchsecurity20182-11-3[11] such as which programs or files to exclude from antivirus scans.cite-ref-scmag-12-3[12] It does not manage mobile devices directly, but treats them as peripherals when connected to a computer and protects the computer from any malicious software on the mobile devices.cite-ref-scmag-12-4[12]
Vulnerabilities
In early 2012, source code for Symantec Endpoint Protection was stolen and published online.cite-ref-vijayan-2012-17-0[17] A hacker group called "The Lords of Dharmaraja" claimed credit, alleging the source code was stolen from Indian military intelligence.cite-ref-akhtar-2012-18-0[18] The Indian government requires vendors to submit the source code of any computer program being sold to the government, to ensure that they are not being used for espionage.cite-ref-vijayan-2012-17-1[17] In July 2012, an update to Endpoint Protection caused compatibility issues, triggering a Blue Screen of Death on Windows XP machines running certain third-party file system drivers.cite-ref-19[19] In 2014, Offensive Security discovered an exploit in Symantec Endpoint Protection during a penetration test of a financial services organization.cite-ref-kirk-2014-20-0[20] The exploit in the Application and Device control driver allowed a logged-in user to get system access.cite-ref-kirk-2014-20-1[20] It was patched that August.cite-ref-kirk-2014-20-2[20] In 2019, Ofir Moskovitch, a Security Researcher discovered a Race Condition bug which involves 2 Critical Symantec Endpoint Protection Client Core Components: Client Management & Proactive Threat Protection and directly results in Protection Mechanism Failure that can lead to a Self-Defense Bypass, aka "SEMZTPTN" - Symantec Endpoint Minimized Timed Protection.cite-ref-21[21]
Reception
According to Gartner, Symantec Endpoint Protection 14 is one of the more comprehensive endpoint security products available and regularly scores well in independent tests.cite-ref-gartner-10-1[10] However, a common criticism is that customers are "fatigued" by "near constant changes" in the product and company direction.cite-ref-gartner-10-2[10] SC Magazine said Endpoint Protection 14 was the "most comprehensive tool of its type . . . with superb installation and documentation."cite-ref-scmag-12-5[12] The review said EndPoint Protection had a "no-brainer setup and administration," but it does have a "wart" that support fees are "a bit steep."cite-ref-scmag-12-6[12]
Forrester said version 12.1 was the most complete endpoint security software product on the market, but the different IT security functions of the software were not well-integrated.cite-ref-forrester-22-0[22] The report speculated the lack of integration would be addressed in version 14.cite-ref-forrester-22-1[22] Network World ranked Symantec Endpoint Protection sixth in endpoint security products, based on data from NSS Labs testing.cite-ref-smith-2017-23-0[23]
References
cite-note-11. "What's new for all releases of Symantec Endpoint Protection 14.x". Release versions, notes, new fixes, and system requirements for Endpoint Security and all versions of Endpoint Protection. [Symantec]. 17 November 2020.
cite-note-messmer-2007-33. ↑ citerefmessmer2007Messmer, Ellen (24 September 2007). "Symantec revamps endpoint security product". Network World. Retrieved 16 April 2017.
cite-note-44. ↑ citerefmessmer2009Messmer, Ellen (23 June 2009). "Symantec unveils endpoint protection services". Network World. IDG. Archived from the original on 19 May 2018. Retrieved 3 May 2017.
cite-note-messmer-2011-66. ↑ citerefmessmer2011Messmer, Ellen (15 February 2011). "Symantec looks to protect users from mutating malware". Network World. IDG. Archived from the original on 16 August 2017.
cite-note-77. ↑ citerefmessmer2012Messmer, Ellen (3 December 2012). "Symantec releases first anti-malware software to work with VMware vShield security system". Network World. IDG. Archived from the original on 16 August 2017.
cite-note-osborne-2016-99. ↑ citerefosborne2016Osborne, Charlie (1 October 2016). "Symantec launches endpoint protection solution based on artificial intelligence". ZDNet. CBS Interactive.
cite-note-searchsecurity20182-1111. ↑ "Symantec Endpoint Protection and the details for buyers to know". SearchSecurity. 8 February 2018. Retrieved 8 February 2018.
cite-note-scmag-1212. ↑ citerefstephenson2016Stephenson, Peter (22 August 2016). "Symantec Endpoint Protection 14". SC Magazine. Haymarket Media Group. Retrieved 20 April 2017.
cite-note-one-1313. ↑ citerefstephenson2012Stephenson, Peter (1 August 2012). "Symantec Endpoint Protection 12 v12.1". SC Magazine. Haymarket Media Group. Retrieved 16 April 2017.
cite-note-vijayan-2012-1717. ↑ citerefvijayan2012Vijayan, Jaikumar (6 January 2012). "Symantec confirms source code leak in two enterprise security products". Computerworld. Retrieved 18 April 2017.
cite-note-akhtar-2012-1818. ↑ citerefakhtar2012Akhtar, Iyaz (6 January 2012). "That stolen Symantec source code? It's for older enterprise products". CNET. CBS Interactive. Retrieved 18 April 2017.
cite-note-1919. ↑ citerefraywood2012Raywood, Dan (16 July 2012). "Symantec fixes 'blue screen of death' bug". SC Magazine UK. Haymarket Media Group. Retrieved 16 April 2017.
cite-note-kirk-2014-2020. ↑ citerefkirk2014Kirk, Jeremy (5 August 2014). "Symantec patches privilege escalation flaws in Endpoint Protection". Network World. IDG.
cite-note-2121. ↑ "Symantec Endpoint Protection Vulnerability". YouTube.
cite-note-forrester-2222. ↑ citerefshermanmccleanschianodostie2016Sherman, Chris; McClean, Christopher; Schiano, Salvatore; Dostie, Peggy (19 October 2016). "The Forrester Wave: Endpoint Security Suites, Q4 2016".
cite-note-smith-2017-2323. ↑ "NSS Labs rated 13 advanced endpoint security products, flagged 2 with caution rating". Network World. IDG. 15 February 2017. Archived from the original on 15 February 2017. Retrieved 18 April 2017.
External links