Computer Associates International etrust Antivirus

Size: px

Start display at page:

Download "Computer Associates International etrust Antivirus"

Alaina Stephens
6 years ago
Views:

1 Kristen Noakes-Fry Product Report 29 August 2003 Computer Associates International etrust Antivirus Summary etrust Antivirus from Computer Associates employs signature scanning and heuristics across several platforms to detect and cure malicious code on desktops, servers and personal digital assistants (PDAs). Note In March 2003, the InoculateIT brand name was discontinued. etrust Antivirus v7 includes technologies formerly available as etrust InoculateIT, etrust Content Inspection, etrust InoculateIT Groupware (Microsoft Exchange and Lotus Notes/Domino Options), InoculateIT Enterprise Edition and Unicenter TNG Advanced Antivirus Option. Table of Contents Overview Analysis Pricing Competitors Strengths Limitations Insight List Of Tables Table 1: Enhancements: Computer Associates etrust Antivirus v7 Table 2: Enhancements: Computer Associates etrust Antivirus v7 for the Gateway Table 3: Overview: Computer Associates etrust Antivirus Table 4: Features and Functions: CA Antivirus Technology Table 5: Security Features Table 6: Price List: etrust Antivirus Table 7: Competitors Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.

2 Corporate Headquarters Computer Associates International, Inc. One Computer Associates Plaza Islandia, NY 11749, U.S.A. Tel: ; Fax: Internet: Overview Computer Associates (CA s) etrust Antivirus v7 accommodates the whole range of antivirus protection across several platforms, including Windows NT/2000/2003 servers; NetWare servers; Windows 9x/Me, 2000 and XP desktops; Microsoft Pocket PC 2002 and PalmOS (free download) on the PDA; and Solaris and Linux platforms. Features include: Protects against in-the-wild viruses, including boot sector, multipartite, macro, script and polymorphic viruses. Protects against malicious Java and ActiveX, including viruses transmitted through and databases on GroupWare systems, such as Microsoft Exchange and Lotus Notes. Adds Zombie scanning to protect Windows machines against denial-of-service attacks. etrust Antivirus etrust Antivirus v7 is part of the Threat Management solution area within the wider etrust brand, which includes: etrust Identity Management etrust Access Management etrust Threat Management etrust Security Command Center The Threat Management solution area protects networks against all forms of malicious attacks, addressing all potential points of entry from Internet gateways to user desktops to PDAs; it covers intrusion detection/prevention, access control, administration, authentication, auditing, certificate validation and PKI: etrust Antivirus etrust Intrusion Detection etrust Policy Compliance etrust Vulnerability Manager 29 August

3 Table 1: Enhancements: Computer Associates etrust Antivirus v7 Web-Based Administration Support for Roaming Users Enhanced Lotus Note/Domino Support Enhanced Microsoft Exchange Support New Gateway Protocol New Platforms on the PDA Web-based administration available from the Windows platform. etrust Antivirus allows the client to configure itself automatically based on location. With the etrust Antivirus console, administrators can create different threat zones for different groups, such as specific departments and dial-up users. Once placed into a pre-defined threat zone, the etrust Antivirus client determines automatically: The preferred signature download server How often to check and download new signatures Which virus engine would be most appropriate etrust Antivirus v7 for Lotus Notes/Domino scans all inbound and outbound messages in real time for malicious attachments, protecting GroupWare server from -borne viruses. Enhancements include customizable warning messages, integration with the etrust Antivirus Log Viewer and support for clusters. Provides additional flexibility and ease of administration. etrust Antivirus v7 for Microsoft Exchange scans all inbound and outbound messages in real time for malicious attachments, protecting the GroupWare server from -borne viruses. Enhancements include integration with the etrust Antivirus Log Viewer and VS API 2.0 support for Exchange 2000 SP1+. Provides ease of administration and the benefits associated with the latest API from Microsoft. Post Office Protocol 3 (POP3) stores and serves s for various client machines not connected to the Internet, holding the s until the user logs in. New PDA support for Microsoft Pocket PC 2002, in addition to the PalmOS free download. New Apache Linux Server edition as part of etrust Antivirus v7 for the Gateway. Table 2: Enhancements: Computer Associates etrust Antivirus v7 for the Gateway Integrates With etrust Audit Improves Mail Delivery Blocks Attachments Quarantines Infected s Improves Signature Updates Through Message Forwarding, provides greater flexibility in enterprisewide antivirus reporting. Multithreaded delivery of enables to be delivered in parallel instead of being queued. Use of key words provides the administrator greater flexibility and control as to what traffic enters the network. When used for perimeter protection, etrust Antivirus enables the intended recipients to follow up on blocked attachments. Can now pull signature updates from the etrust Antivirus Admin Server, ensuring that antivirus protection is current on the gateway. Table 3: Overview: Computer Associates etrust Antivirus Version v7 Date Announced March 2003 Date First Installed 1996 as InocuLAN, 1998 as CA InoculateIT Types of Antivirus Scanning, heuristics, policy-based (behavioral) Technologies Used 29 August

4 Table 3: Overview: Computer Associates etrust Antivirus Operating System Platforms Supported Gateways Supported Certifications Languages Supported Documentation etrust Antivirus v7 PDAs: Microsoft Pocket PC 2002; PalmOS. Desktops: Windows 95, 98, ME, NT 4.0, 2000, XP; Linux; Sun Solaris; and Macintosh. Servers: Windows NT 4.0 Server, Windows 2000 Server, Windows Server 2003, Linux, Sun Solaris and Novell NetWare. Lotus Notes/Domino, Microsoft Exchange. Gateways: Stand-Alone Gateway Simple Mail Transfer Protocol (SMTP) POP3/FTP/HTTP MS-Proxy Server MS-ISA Server Apache Linux Server Check Point FireWall-1 via Content Vectoring Protocol (CVP) Open Platform for Security (OPSEC) ICSA Labs, West Coast Labs Check Mark, Virus Bulletin (VB100 percent), OPSEC, Novell Tested and Approved English, French, German, Spanish, Japanese Table 4: Features and Functions: CA Antivirus Technology Viruses Detected Antivirus Engine Heuristic Engine Scanning Engine Types of Files Scanned Macro Virus Detection Actions Taken When VirusIsDetected Updates for Signatures or Patterns Detects virtually all viruses in the wild, including boot sector, master boot sector, memory resident, file multipartite, macro, stealth and polymorphic viruses. Employs two scanning engines (InoculateIT and Vet). Heuristic virus detection engine employs an advanced rules-based detection method to detect unknown viruses. Remotely configures and scans any etrust Antivirus server or workstation. Scans compressed file archives and Internet downloads, including.zip,.arj and Microsoft compressed files. A Macro Virus Analyzer is CA s proprietary technology to detect and cure macro viruses in Microsoft Office files. etrust Antivirus servers can automatically log off client workstations that attempt to upload an infected file: An Alert Manager notifies security administrators of all critical virus incidents from any server. Software automatically isolates users who attempt to move, copy or save infected files over the network. Free virus signature updates are downloaded automatically from the Internet and distributed to etrust Antivirus servers and clients: Updates are released twice a week or immediately when a new virus alert is issued. An update-holding interval lets the software test downloaded software and signature file updates on specified computers before fully implementing them across the network. 29 August

5 Table 4: Features and Functions: CA Antivirus Technology Technology Used for Updates (for example, push technology and so on) Management Features Logging and Reporting Protection for Clients Protection for Servers Protection for Internet Gateways Protection for Networks and Desktops Protection for PDAs Updated signatures are distributed automatically across the network to all potential points of entry. All systems in the enterprise or workgroup that are protected can be grouped and managed from a central console: Software options can be pre-configured before deployment to multiple machines. Software can be installed remotely on servers and workstations throughout the network. Support for roaming users. Web-based administration. Software lets administrators select from a variety of methods to handle viruses, including copy cure, rename, move, report, delete or purge. Software allows for centralized, policy-based administration of antivirus clients, including the ability to lock down settings. Automatic installation is provided. Virus Scanning Logs identify users associated with each virus event: Centralized log of all virus events, including files checked, viruses found and responses, is stored in a Central Activity Log. Logs may be forwarded to etrust Audit for greater flexibility in antivirus reporting and for integration into etrust Security Command Center. Software extends virus protection to Windows NT/2000, XP, 95/98/ME and Linux: The clients automatically update themselves from the server. Virus protection is also available for Apple Macintosh and PDAs running Pocket PC 2002, and for PalmOS. Software allows scheduled scanning and real-time protection against infection from diskettes, downloaded files and documents. Servers: Windows NT 4.0 Server, Windows 2000 Server, Windows XP Server, Windows 2003 Server, Linux, Sun Solaris and Novell NetWare. Stand-Alone Gateway (SMTP/POP3/FTP/HTTP) MS-Proxy Server (FTP/HTTP) MS-ISA Server (FTP/HTTP/SMTP) Apache Linux Server (FTP/HTTP) Check Point FireWall-1 (via CVP) (FTP/HTTP/SMTP) Windows 95, 98, ME, NT 4.0, 2000, XP, 2003; Linux; Sun Solaris; and Macintosh. Protection for PDAs running Microsoft Pocket PC 2002 and Palm OS (free download). Table 5: Security Features Policy Enforcement Virus Quarantine Prevents the disabling or altering of antivirus settings by locking down client configurations. etrust Antivirus servers can automatically log off client workstations that attempt to upload an infected file. 29 August

6 Table 5: Security Features Virus Source Tracking Digitally Signed Signatures and Binaries Support for Intrusion Detection Systems Integration With etrust Audit Through Message Forwarding Protection Against Malicious Code Virus Protection for Installation and Support Virus-scanning log includes a reference to the client workstation where the infected file originated. Using CA s private key, etrust Antivirus signature updates and runtime models are checked for tampering and spoofing. etrust Intrusion Detection, a complementary product to etrust Antivirus, delivers surveillance, detection of intrusions and attacks, URL blocking, alerting, logging and real-time response. Enables accountability and flexibility in antivirus reporting. etrust Antivirus v7 for the Gateway Protects against viruses of malicious Java Applets and ActiveX controls at the Internet gateway. It scans SMTP, POP3, FTP and HTTP traffic for potential viruses. Lotus Notes/Domino, Microsoft Exchange Provides protection against viruses transmitted through on groupware systems. Provides real-time detection and cure for all attachments. Software lets administrators choose to protect incrementally and to centrally manage the options from any server in the network. Novell Groupwise virus protection is provided by a partner, Beginfinite. Installation The CA Technical Support department has support teams around the world, which includes native speakers of both English and the local-language. Technical support is available by , telephone, online documentation, product release notes and FAQs. Support Both Support and upgrade protection are included in the cost of maintenance. One free year of maintenance is included with the product with a charge for an additional one or two years. Support includes all of the following: 7 24 phone support Free signature updates Guaranteed response within 24 hours of a new virus attack 24 7 support by CA s etrust Threat Analysis and Response Global Emergency Team (TARGET). esupport over the Web is free. System Requirements: Hardware Windows 9x/ME etrust Antivirus has different minimum requirements on each platform. While etrust Antivirus may run on systems with lower specification, the following are recommended minimums. At least 32MB RAM At least 20MB hard drive space Can run effectively on a 133MHz PC No coverage for Macintosh 29 August

7 Table 5: Security Features NetWare NetWare versions (3x, 4x or 5.0) At least 16MB RAM At least 15MB free disk space Windows NT/2000 Windows 2000 with Service Pack 1.; however, Service Pack 6a (NT Service Pack 5minimum). 32MB free disk space (Intel) 133MHz PC System Requirements: Software Desktop (minimum Windows 95/98/Me operating system Windows NT 4.0/2000/XP [OS]) Server (minimum Windows NT 4.0 x86 OS) Windows 2000 Windows Server 2003 NetWare 3.12 Linux (Red Hat, SuSE, Turbo and Caldera) Sun Solaris/SPARC 2.6 and higher Groupware Lotus Notes/Domino R5, releases 4.x, 5.x and 6.0 Microsoft Exchange 2000 SP1+ and Exchange 5.5 service pack 3+. Analysis With the purchase of Cheyenne Software in 1996, CA benefited from Cheyenne s years of experience as a provider of one of the first antivirus solutions as well as one of the first providers of solutions for the LAN environment. Cheyenne s InocuLAN eventually became InoculateIT and, finally, etrust Antivirus. In 2001, CA rebranded the antivirus product as etrust InoculateIT for CA s indirect channel partners and etrust Antivirus for CA s direct sales force. Meanwhile, in 1999, CA acquired Vet Anti-Virus from Cybec, re-packaging the product as the Personal Edition of InoculateIT and, until June 2001, making it available free on the Internet. Streamlining the Antivirus Offerings In March 2003, etrust Antivirus v7 was released for both CA s direct sales force and CA s channel partners and the InoculateIT name was discontinued. etrust Antivirus v7 includes etrust Antivirus Groupware (Microsoft Exchange and Lotus Notes/Domino Options) and etrust Content Inspection, previously sold as separate products. Other technologies included in etrust Antivirus v7 were formerly available as InoculateIT Enterprise Edition, Unicenter TNG Advanced Antivirus Option, etrust Antivirus Groupware, etrust Content Inspection, etrust InoculateIT, InoculateIT, etrust InoculateIT for Linux, etrust InoculateIT for NetWare, etrust InoculateIT for Windows, InoculateIT for Windows Workgroup Edition, etrust InoculateIT Lotus Notes/Domino Option, etrust InoculateIT Microsoft Exchange Option, InoculateIT Advanced Edition, InoculateIT for Palm OS, Inoculan AntiVirus for Windows 95, Inoculan AntiVirus Suite for Microsoft BackOffice, InoculateIT Workgroup Edition, InoculateIT, InoculateIT for Windows Advanced Edition. Two Scanning Engines etrust Antivirus has one brand name, but provides two different scanning engines stemming from two different product acquisitions: 29 August

8 InoculateIT, originally developed by Cheyenne Vet, originally developed by Cybec Although the two scanning engines have two separate development groups within CA, they can be managed together from a single management console. Single-Console Updating etrust Antivirus offers a flexible signature update procedure. The updates are free and are automatically downloaded from the Internet to the corporate server based on an update frequency defined by the network administrator. The network administrator also has the option to choose to examine the updated signature file on a local machine to ensure there are no conflicts with network software. When the signature file is approved, it is automatically disseminated to all other systems on the network down to the desktop. Real-Time Virus Scanning etrust Antivirus uses two primary scanning methods to scan for viruses in real time: The first is a proprietary signature-scanning method which scans for known types of viruses, including polymorphic, multipartite, stealth, script and macro viruses, in addition to worms and Trojans. The second is a heuristics-based scanning to detect unknown viruses. With its use of positive and negative rules, the heuristics engine attempts to keep the number of false positive results to a minimum. The organization can to choose up to three levels at which to scan, with each level varying on the type of scan and the speed at which the scan is performed. These levels can vary from desktop to desktop based on the parameters defined by the network administrator. Fast Scan is the fastest because it scans only the header of the file, determines what the checksum is and opens the file only if it is determined to be virus-free. The Secure Scan level scans every part of the file to detect for viruses. The Reviewer Scan, which is the slowest, adds the entire heuristics rule base to the scanning process before tagging the file virus-free. CA treats etrust Antivirus as an integral part of its entire security strategy and has implemented that philosophy in two ways: First, each of its security products can be managed from a central console; signature file updates can be distributed from a single console. Second, it made the antivirus functionality part of the etrust offering, which includes an integrated portfolio of software to enable security in an e-business environment. Primary Markets CA s primary target for etrust Antivirus is the enterprise market. For these customers, central administration is an important element of CA s etrust strategy. etrust Antivirus provides central administration of your antivirus implementation. In addition, etrust Antivirus also integrates into etrust Security Command Center, which can manage all the security products in an enterprise. 29 August

9 Pricing The list price for etrust Antivirus v7 is the same for direct and channel sales. Table 6: Price List: etrust Antivirus Product Description Price (US$) etrust Antivirus v7 Signature File Updates Sold directly by CA s sales force and by CA s channel partners for the same list price. Automatically downloaded to the corporate servers based on update frequency defined by network administrators. Boxed Product for 5, 10 and 25 users is available. Tiers Licensing prices start at $35 a node for users. Free. Note: For two years ( ), CA offered InoculateIT Personal Edition free of charge. Since that program ended, users may log in to my-etrust.com and pay a nominal charge for etrust EZ Antivirus, which includes software upgrades, virus definition updates and technical support via . GSA Pricing No. Competitors Table 7: Competitors Network Associates McAfee Active Virus Defense McAfeeVirusScan Norton Sophos Anti-Virus Solution Symantec Symantec AntiVirus Trend Micro InterScan VirusWall Protects desktops, servers, GroupWare, Internet servers, wireless and PDA, Internet gateway, and file server. Push channel disseminates virus information, updates and upgrades to the network administrator. Auto update function pre-schedules updates, hourly updates via an Internet download and also CD-ROM and diskette distribution. See Symantec. Sophos focuses solely on the antivirus requirements of networked organizations. The architecture employs a combination of virus scanning and checksumming. Since the architecture is operating system-independent, the product may be delivered on a wide range of networks. Protection for Windows or NetWare environments; plus options for gateway, firewall and groupware antivirus protection. Symantec offers a variety of antivirus products for all layers of the enterprise, from the desktop to file servers, groupware servers and gateways. Symantec has discontinued active use of the brand name Norton. Top-down, server-based approach intercepts viruses and malicious code at the Internet gateway. Optionally supports spam blocking, content filtering and mail traffic management. Other products protect groupware and servers, application servers and desktops. Strengths Wide Range of Protection 29 August

10 Protects against malicious Java and ActiveX code, in addition to antivirus protection support for gateways, and groupware/ servers. Central Security Management Within etrust Products etrust Security Command Center provides event aggregation and correlation, as well as command and control, from a central console for etrust and non-ca products. Worldwide Research and Support To monitor new virus threats around the clock, and to deliver up-to-date virus signature files to the etrust Antivirus installations, CA s etrust TARGET has resources in North America, Europe, the Middle East and Australia. Technical support is available 24 hours a day, 7 days a week, 365 days a year. Limitations Late Market Entry While etrust Antivirus is in version 7 of the product life cycle, the actual product line was a late entry into the antivirus market. By the time CA entered the antivirus market in 1996, products from Symantec and McAfee products from Network Associates were already firmly established. Part of Very Broad Product Portfolio From years of acquisitions, CA has a broad product offering, often including seemingly redundant products. As result, customers are overwhelmed with product options, and a specific tool can be lost in the shuffle. Product quality issues and substandard product support are frequently mentioned by users and may well be symptomatic of CA s broad product portfolio. Insight CA s etrust Antivirus provides antivirus protection for PDAs, desktops, servers, groupware and the gateway, in one product, for one price, and one license, with a very low, long-term total cost of ownership (TCO), making it very attractive to enterprises. Key features are its dual virus scanning engines; superior centralized, policy-based management; a stellar record of detection of virtually all known viruses, macro virus threats, malicious Java, ActiveX and other malicious code; and etrust TARGET (for an immediate response to any new virus or blended threat). 29 August

etrust Antivirus Release 7.1

D A T A S H E E T etrust Antivirus Release 7.1 etrust Antivirus provides superior protection from the perimeter to the PDA against today s most prevalent security threat viruses. It eliminates virus infections,