Computer Associates etrust Antivirus v 7.1

Size: px

Start display at page:

Download "Computer Associates etrust Antivirus v 7.1"

Melvin Wilkins
6 years ago
Views:

1 Product Advisor Charlotte Dunlap Analyst, Information Security Andrew Braunberg Senior Analyst, Information Security Contents Product Assessment Summary Current Perspective Product Strengths & Weaknesses Product Strengths & Weaknesses Product Buying Criteria Scanning and Outbreak Containment Architecture Vendor Support Product Metrics Europe +33 (0) Or visit our Web site: 1

2 Product Advisor Summary Analyst: C. Dunlap, A. Braunberg Date Updated: vember 10, 2005 Product Class: Enterprise AntiVirus in Information Security - U.S. Current Perspective: Threatening etrust Antivirus 7.1 is threatening to competitors because the enterprise suite offers robust security coverage at all points of entry into the enterprise and comes with an extremely aggressive price. CA s cutthroat pricing structure is a deliberate attempt to steal away market share from higher profile AV players Symantec, McAfee, and Trend Micro. CA, like other security vendors, has realized there is a lucrative business in the mid-market space. The company, which has traditionally focused on the high-dollar space, is now moving down market and is using the low pricing structure to gain the attention of customers. This is because customers are typically content to stay with the same security vendor for years. etrust Antivirus includes a unique dual scanning engine, to promote multi-layered protection, and broad OS support, including Linux. CA s low pricing campaign also includes lifetime signature support for free. CA has cultivated strong channel partnerships with leading systems integrators and sells this suite 100% indirect. Strengths & Weaknesses Strengths etrust Antivirus uses two scanning engines within the suite which is supported by two separate research divisions. This appeals to customers looking for layered protection. etrust Antivirus is aggressively priced, undercutting the competition significantly. The pricing strategy is CA s attempt to displace competitors, and is a good way to be considered in the customers buying process. CA offers lifetime access to signature updates without having to update software licensing. CA provides a broad range of operating system support in this product, including Linux. Weaknesses CA is a name with less notability at the desktop than its competitors. As the glue that holds this suite together, CA s centralized management product, etrust Security Command Center, is not as well known as other popular consoles such as McAfee s epolicy Orchestrator. Usability of etrust is not straightforward and fine-tuning of the product before deployment is time-consuming. The user interface, while simple to learn, is said to be cumbersome to use on occasion. etrust does not include anti-spam technology in this suite. Europe +33 (0) Or visit our Web site: 2

3 Product Assessment: Buying Criteria Scanning and Outbreak Containment etrust Antivirus provides anti-virus protection for the gateway, groupware server, and desktop in a single suite. The software provides scanning at the gateway for HTTP, FTP, POP3, and SMTP, and groupware tools to remove viruses and other malicious code from , attachments, and public folders. etrust includes two scanning engines developed by two different groups within the company for double the virus protection redundancy. Company officials claim 100% detection of in-thewild viruses. etrust provides incremental signature updates, and includes a redundant signature distribution system so anti-virus clients are rerouted to the next signature server when a signature distribution server is down. Like most competing offerings, etrust does not include anti-spam technology. Customers may purchase an add-on product, called Secure Content Manager, CA s own technology, which guards against spam and other unsolicited . CA provides central, policy-based management through its console called etrust Security Command Center. The console is simple to learn, but can be cumbersome to use, requiring extra drag and dropping, and pointing and clicking during policy updates. The etrust console was recently enhanced to centrally manage heterogeneous enterprise environments. Security Command Center supports correlation and event management and links to third-party anti-virus solutions, intrusion detection systems, and firewalls. etrust provides outbreak containment capabilities, which deploy policy-control templates to each product within the suite, defusing an attack based on the characteristics of the virus before a signature is defined. When a new virus surfaces, the management console automatically collects a set of policy-control templates from the vendor support site. etrust provides solid reporting capabilities through an integrated reporting engine. The suite offers 60 different report types, including one that details policy compliance by listing the systems that have etrust installed and which engine and signature versions are running on each system. Architecture etrust is simple to set-up and configure, but fine-tuning of the product before deployment requires a considerable amount of manpower hours. etrust provides support for a broad range of operating systems including Windows and Linux environments. Symantec and McAfee do not yet support the Linux platform. In the future, CA says it plans to support Linux client technology that includes real-time and scheduled scanning technologies. etrust is priced very low, a strategic move by the company in its attempt to displace competitors and become a stronger player at the desktop. etrust is priced at $25 per seat for 250 to 749 nodes, and $15 per seat for 750 or more nodes. Europe +33 (0) Or visit our Web site: 3

4 Product Assessment: Vendor Support provides 24/7 support from its rapid response team called TARGET (Threat Analysis and Response Global Emergency Team), which includes worldwide response centers that research and respond to threats. CA maintains two separate research teams, which operate independently to support etrust s two scanning engines. One is based in the U.S. and the other is based in Israel. etrust offers free lifetime signature updates, regardless of maintenance contract status. However, while customers are facing increases in annual support costs, this is a minor selling point to enterprise customers looking to stay current on product upgrades and have access to vendor support. CA customers have wider service and integration support through the company s strong channel partners. CA s distribution model includes 100% of the etrust product being sold indirect. All materials Copyright Current Analysis, Inc. Reproduction prohibited without express written consent. Current Analysis logos are trademarks of Current Analysis, Inc. The information and opinions contained herein have been based on information obtained from sources believed to be reliable, but such accuracy cannot be guaranteed. All views and analysis expressed are the opinions of Current Analysis and all opinions expressed are subject to change without notice. Current Analysis does not make any financial or legal recommendations associated with any of its services, information, or analysis and reserves the right to change its opinions, analysis, and recommendations at any time based on new information or revised analysis. For additional reproduction rights and usage information, go to Current Analysis, Inc Signal Hill Plaza, Second Floor, Sterling, VA Tel: , Toll free rue Troyon, Sevres Cedex, Paris, France Tel: +33 (1) Europe +33 (0) Or visit our Web site: 4

5 Product Metrics Product: Antivirus Features Deploy from Web Server Real-time detection/removal/remediation of spyware Application exclusions for setting custom policies Integrated AV and anti-spyware Tamper Protection AntiVirus Capabilities Real-time and On-demand AV File System Scanning Scheduled AV Scanning Real-time AV Attachment Scanning for Lotus tes Realtime AV Scanning for Incoming/Outgoing POP3 Deploy from Log-in Script Deploy from Network Share Deploy Using Third-party Distribution Tool Pre-configure Client Policy with Lockdown Settings Deploy with Elevated Privileges Central Quarantine of Suspicious Files Submission/Response of Suspicious Files Remote Policy Compliance (VPN) Real-time AV Protection-enabled Real-time Heuristic Scanning at Specified Level Real-time AV Protection on Specified Files In-memory Scanning Content Update Session Completed Outbound Worm Blocking Installed Antivirus Client Version is Specified Network Server Anti-virus Protection Virus Definition Files Older than Max Age Scan Individual File, Folder and Drive A Specified Scan Ran Within the Last (n) Days Forced Restart of Real-time Protection if Disabled Microsoft Exchange/Outlook Plug-in is Enabled Heuristic Scanning Lotus tes Plug-in is Installed and Enabled Includes Scan Throttling Options Initiates Scheduled Events that are Missed Identify Host that Dropped Threat on Machine Quarantine/Submit Suspicious Files for Analysis Detect and Remove Adware and Spyware Applications Auto Remediation if Virus Defns are Out of Date Auto Remediation if Real-time Protection is Off Alerts Customizable Text in Alert Message Compressed File Scanning SNMP Trap Client System Can Roam to Another Mgmt Server Laptop Battery Optimization Automatic Updating Capabilities Antivirus Signature and Engine Updates Management Server ''Pushes'' Content Updates Centralized Content Update Server Central Management Console Deploy Invisible Client Install Identify Clients w/o AV/Third-party AV Protection Pager Run a Program Write to System Event Log Tray Icon Shows Alerts and Disables Logging and Reporting View Detailed Logs from Console Logs Date and Severity of Attacks Filters Event Data Sent from Client to Mgmt Server OS Support - Windows OS Support - Other Platforms Mail Security with SCC Uninstall Third-party AV Software Deploy from Management Console Europe +33 (0) Or visit our Web site: 5

6 Product Metrics (contiuned) Product: Platforms: Whitelist by Top-Level Domain (TLD) with SCM Windows 32/64bit, Mac OSX, EMC, NetApp, vell, Solaris, HPUX, RedHat Linux, Suse Linux, Sun JDS (linux), Linux S/390, Windows Mobile/SmartPhone, Palm, XP Embedded, Exchange, Lotus tes/domino OS Support Mail Security AV Capabilities Windows, Linux Whitelist by Domain Using Wildcard Auto-generated Whitelist Recipient Whitelisting Content Enforcement Subject Line Blocking Message Body Filtering with SCM Real-time Scanning Rules-based Filtering Scheduled Scanning Attachment Scanning On-demand Scanning Custom Disclaimers with SCM Incremental Scanning Automatic Updating Message Store Scanning Frequency of Virus Definition Updating True-file Typing Virus Signatures Malformed MIME Threat Detection Scan Engine Updates Heuristic Antivirus Scanning Unified Virus Definition Update Quarantine Suspicious Files Heuristic Antispam Engine Definitions, with SCM Scanning Compressed Files Container Limits (''Zip of Death'' Prevention) Filename Blocking Extension Blocking Mass-mailer Cleanup Spam Prevention Integrated Anti-spam Subscription Service Option Detection with SCM Service/System Restart on Scan Engine Update Centralize Server Configuration Web-based Management UI Role-based Administration Auto-refreshable Configuration File Graphical Reporting System Alerts Sender Blocking Message Quarantine with SCM Real-time Blacklist (DNSBL) Support, with SCM Outbreak Alerting Filtering by Subject Line Centralized Reporting Filtering by Message Body Heuristic Antispam Engine Custom Subject Line Tag Optional X-Bulk Header Spam Score Handling Prevents Relaying n-local Requests (Antirelay) False Positive Prevention Sender Whitelisting Whitelist by Full Domain Whitelist by Address Whitelist by Sub-domain with SCM with SCM with SCM with SCM with SCM with SCM Mail Security Technology Integration Single-source Install Virus Scanning/Anti-spam/Content Enforcement OS Support Anti-virus Real-time Scanning of HTTP/FTP over HTTP Traffic On-demand Scanning Quarantine Alerts on Virus Infection with SCM Windows, Linux Europe +33 (0) Or visit our Web site: 6

7 Product Metrics (contiuned) Product: Alerts on Virus that Cannot be Repaired Dedicated Worldwide Security Research and Response URL Filtering Regular Security Protection Updates List-based Filtering Using Pre-defined Categories Real-time Heuristic Filtering of Web Page Content Blocked Site Override Custom Local Category Support Per User, Per Group, Per Computer Policy Options with SCM with SCM with SCM with SCM Response Centers WorldWide Professional Services Available Licensing Options Sold on a per de Basis Includes One-year Technical Support Includes One-year Upgrade Insurance Second-year Extended Maintenance Available Time of Day, Day of Week Scheduling with SCM Third-year Extended Maintenance Available Allow-only Mode Support Features Locked Mode with SCM 7X24X365 Extended Hours Available Audit Mode Auto Alert when Threshold of Blocked Sites Reached Auto Locking of Internet when Threshold Reached Management Central Policy Mgmt Using LDAP, Active Directory Secure Authentication Central Authentication Support Leveraging LDAP HTML-based User Interface Access Control List Support for Granular Mgmt Reporting Detailed Activity Reports Built-in Graphical Reporting Support for Event Manager for AntiVirus Most Active Users/Computers with SCM Number of Dedicated Contacts Level 1 Number of Dedicated Contacts Level 2 Number of Dedicated Contacts Level 3 Additional Dedicated Contacts Available Proactive Alerting Available Product tification Service Available Technical Account Manager Available 6 people in rth America 6 people worldwide These resources are not dedicated, they are a part of the 'Integrated Threat Management' development team (AV + PP) of 42 ('Technical Operations Manager' +C16 and 'Threat Marshal') Top 10 Web sites Accessed Bandwidth, Traffic Statistics Management, Configuration Change Information File Filtering Blocking by Attachment Type Container Limits (''Zip of Death'' Prevention) OS Support Windows, Linux, Solaris, HP, Windows x64 Vendor Back-end Response Europe +33 (0) Or visit our Web site: 7

etrust Antivirus Release 7.1

D A T A S H E E T etrust Antivirus Release 7.1 etrust Antivirus provides superior protection from the perimeter to the PDA against today s most prevalent security threat viruses. It eliminates virus infections,