The most recent articles from vnunet.com

Review: Trend Micro Worry-Free Business Security Advanced 6.0

Alan Stevens — 2009-09-22T08:00:00.000Z

Alan Stevens, V3.co.uk, Tuesday 22 September 2009 at 08:00:00

Latest version delivers a high level of security with less impact on users and PC resources

Internet threats continue to grow at an alarming rate, making it hard to keep protection up to date, while the tools themselves can be really intrusive. Trend Micro’s Worry-Free Business Security Advanced 6.0 addresses both issues, most notably through its innovative new Smart Scan technology, which offloads much of the work involved to remote servers elsewhere.

Rather than maintain a collection of signatures on each client, Smart Scan signatures are divided into those for known threats, such as Trojans and spyware (around 80 per cent), and those mutating rapidly, which it handles using heuristics (roughly 20 per cent). Only the heuristic scanning is done locally on the client PC, with the rest handled either by a security server on the LAN or, if out of the office, a Trend service in the Cloud.

The end result is the ability to distribute updates more rapidly while the local client has far less impact in terms of processing and memory requirements. The new Worry-Free client can also be configured to pause during high CPU consumption, plus it offers a number of other enhancements including protection against threats transmitted by portable USB devices.

As the name implies, the Worry-Free suite is designed to take the worry out of network protection with a suite of tools to protect against viruses, spam, spyware and most other common malware. Customers with limited expertise can get a reseller to install and remotely manage the product, but given that it took us less than half a day to fully deploy on a small company LAN, most small business managers should be able to get by without outside help.

The first task was to configure the central security server, for which we used an existing file server running Windows Server 2003, although any version of Windows from 2000 onwards can be employed. There’s support too for both 32-bit and 64-bit implementations, and for small deployments a desktop PC can be used instead. A web server is also needed to host the management console, which we didn’t have, but that wasn’t a problem as the setup program installing Apache on our server could handle this side of things.

We then needed to distribute the security agent to our other servers, desktops and notebooks, for which a variety of tools are available. In our case we opted to push the software out centrally via the web console, which worked reasonably well, except for a couple of PCs where we emailed the users a link for them to install locally. Alternatively, we could have added the link to an internal web site, used login scripts or created a custom package for distribution using Windows group policy or a third-party distribution tool.

Regardless of deployment method, the agent took just a couple of minutes to install and once in place started protecting the PC straight away. Moreover, unlike some security tools, the default settings are likely to suit most customers’ needs. So, for example, Smart Scan is turned on by default and updates retrieved from the server on an hourly basis. Another nice feature is the availability of different security profiles for when users are in the office and connected to the LAN, or when out and about.

A security agent for Exchange is also included, although on our network we had an SMTP server and a lot of small businesses will use hosted services. Fortunately, that’s not a problem as you also get a bundled licence for Trend’s hosted security scanner, InterScan Messaging Hosted Security. To use this we simply provided Trend with our domain name, and then had our DNS records updated to point incoming mail at the InterScan servers. That done, messages were filtered for viruses and spam before being forwarded to our local SMTP mail server as normal.

Other things we liked included the ability to disable Windows autorun when a USB device was connected to a client, graphical management of quarantined files, and the ability in this release to filter and block access to specific types of web site. The fact that users hardly noticed what was going on was a major plus too, the Smart Scan technology making the Worry-Free client far less of a drain compared with a lot of alternatives.

On the downside, Worry-Free is a Windows-only solution with no protection available for either Apple Mac or Linux systems. Another potential concern was that, like other security suites, it might prove a little too comprehensive for its own good, but with Worry-Free Business Security Advanced 6.0, Trend seems to have found the right balance between security and ease of use. Indeed, once configured, we found it very straightforward to manage with little day-to-day administration required other than the occasional check of the web-based console to see what it was up to.

F-Secure Internet Security 2010 versus Sunbelt Vipre

Ian Williams — 2009-08-18T14:52:00.000Z

Ian Williams, V3.co.uk, Tuesday 18 August 2009 at 14:52:00

A head-to-head test of two leading security suites

There are many anti-virus and internet security suites available these days, and it can be difficult to decide which one to install. In this review we'll be putting two of the latest to arrive on the scene, F-Secure Internet Security 2010 (IS2010) and Sunbelt Vipre, head to head to determine which is better at protecting your valuable data.

Both install very easily, although IS2010 provides a more robust set of options when choosing the manual install route. The IS2010 install comes in at around 70MB, and Vipre at a very lean 16MB.

The products work just fine on Windows XP and Vista, but for those of you who have already upgraded to the Windows 7 release candidate, or are planning to upgrade to the new Microsoft operating system when it becomes available, it's worth noting that several security applications don't yet work on Windows 7.

IS2010 had no problems on Windows 7, but we had to use a new beta version of Vipre in order to get all the functionality working properly. This should be a full release soon, so we'll give it a pass on that one.

System performance

Anti-virus programs have come a long way in recent years in terms of monitoring systems without significantly impacting performance. Some of this is thanks to improvements in hardware, but a lot of it is down to more efficient processes.

We installed both suites on separate partitions of a Samsung netbook with 2GB of memory, and ran Passmark's Performance Test before and after to gauge the impact of the applications on the system. Happily, neither IS2010 nor Vipre had any discernable effect on the Performance Test score, which consistently came out around the 200 mark before and after installing the security suites.

Vipre takes up only around 17MB of system memory across just two processes, while IS2010 is a bit more heavy handed, requiring around 35MB across nine separate processes.

The main screen on both products provides status information, but F-Secure's newly revamped interface wins out as the most user friendly with its large icons and simple menus, while Vipre goes for a more matter-of-fact layout.

IS2010 does offer a bit more in the way of features, with optional packet logging for technical users, customisable parental controls and a plug-in for internet browsers with icons next to each link to represent the safety of the site being pointed to. Unlike AVG, which has a similar feature, this is not just within the search results but with all links, even in webmail applications.

The parental controls can be configured for children and teenagers, and can limit the number of hours spent online and/or the times that the internet can be accessed, as well as restricting the sites and type of content.

Vipre, on the other hand, provides a worldwide threat level meter on the main page representing the overall threat landscape, as well as a secure file eraser and history cleaner to help ensure that any of this information can easily be removed and not recovered. Vipre also features something it calls PC Explorer, which lets users look deeper into several of the individual running processes to see the source of various processes, internet applications and ActiveX content.

For notebook users, Vipre provides a battery conservation option which turns off automatic updates and scheduled scans when the device is not plugged in to a power source. Although the impact of this is relatively minimal, it could save some frustration for end users trying to stop these actions while out and about.

As well as virus and malware protection, both also provide a firewall and email scanning as part of the package.

Threat protection scores

To test the security of the applications we used Comodo Leaktests version 1.1.0.3. Both scored 160 out of 340, meaning that each passed just under half of the tests. It's important to note that this doesn't meant that either of these products will only protect your PC against half of the threats out there. Firstly, some rely on being actively run by the user in administration mode, and, although it means that the attack vector is possible, many would be detected if it contained a malicious payload.

Full scans

When it came to running the default full scans, Vipre looks like it comes out on top. Although it took around an hour to run its deep scan, it reported having searched through 128,381 objects, while IS2010 took just 20 minutes but only reported scanning 37,553 objects. It's slightly worrying that Vipre initially reported several false positives (including the local version of Wordpad and one F-Secure file residing on the other partition) but this appears to be due to a few bugs in the beta version we were running. After a reinstall and another update we were unable to replicate this.

IS2010 will be available from 3 September at £39.95 for a one-year three-PC licence, while Vipre offers several options including a one-year single-user licence priced at £29.95 and a Home Site package which provides a one-year subscription for all PCs located at a single residence for £49.94.

It's a close call between the two and really comes down to the individual user, and their requirements and technical skill. But, according to our tests, both security suites should help defend your PC against most attacks and, while Vipre's lean design and deep searches are a bit better suited to more advanced users, IS2010 is an excellent option for a more general user, thanks largely to its more user-friendly interface and options.

From a purely financial perspective, those with a single PC or more than three in one location may find it more economical to opt for Vipre.

For more information on setting up and running F-Secure Internet Security 2010, we’ve also posted up a step-by-step photo guide.

ISS BlackIce PC Protection 3.5

Paul Rowlingson — 2002-08-07T15:02:16.000Z

Paul Rowlingson, vnunet.com, Wednesday 7 August 2002 at 15:02:16

Additional protection in the latest BlackIce firewall.

Formerly known as BlackIce Defender, BlackIce PC Protection 3.5 has a new name and some new features. The most notable of these is the ability to monitor both incoming and outgoing communications.

It's capable of detecting and blocking attacks/intrusions on a PC, and the new Application Protection prevents unrecognised applications from launching, whether delivered through a web browser, instant message or email.

Interested solely in TCP/IP communication it is well suited to home use, monitoring dialup, DSL and cable connections for suspicious activity and dealing with them as per your instructions.

Four security levels cater well for individual requirements, ranging from Trusting to Paranoid. Trusting allows all inbound traffic, whilst Paranoid blocks all unsolicited incoming traffic, with the other two levels sitting in between.

Defence against suspicious attacks is all done in the background, with system tray (or sound) activity alerts. Attacker information, including the IP address, can be viewed in the Events log.

It is here that rules can be defined for persistent good or bad communications. Users can choose to ignore the event and block or trust the attacker. Blocking is for an hour, a week, a month or forever.

When BlackIce is installed it will scan your hard drive(s) and authorise every application it finds, ensuring that any future unknowns will be spotted. Unknowns will include any intentional software installations, which can be a little annoying, but they can be authorised with a single mouse click.

Due to the initial scan it is imperative that a PC is virus free for BlackIce to be effective, so ensure that antivirus software is installed and the PC is scanned prior to installation.

Any subsequent unknown applications will be will prevented from starting, but nothing is done to remove them from your PC. Again, a virus program is required here.

The cluttered Settings interface is disappointing, but a concise Quick Start Guide goes some way to alleviating this.

Contact:

Guildsoft 01752 895100

www.guildsoft.co.uk