Symantec Endpoint Protection
|
Symantec Endpoint Protection GUI, version 11 (OS: Windows) | |
| Developer(s) | Symantec Corporation |
|---|---|
| Stable release |
14.0
|
| Operating system | Microsoft Windows, Mac OS X and Linux |
| Platform | IA-32 and x86-64 |
| Type | Antivirus and firewall |
| License | Trialware |
| Website |
www |
Symantec Endpoint Protection, developed by Symantec Corporation, is an antivirus and personal firewall software for centrally managed corporate environments providing security for both servers and workstations.
Version history
Symantec AntiVirus Corporate Edition was the initial software from Symantec in this market, its last release before discontinuation was version 10.2 MP1, (10.2.4). Its successor Symantec Endpoint Protection (SEP) software was released September 23, 2007 and labeled version 11. In 2009 a Small Business Edition (SBE) of SEP (version 11) was introduced[1] in addition for seats/nodes <=100 and labeled version 12. In 2011 both software lines were updated to version 12.1. In 2015 SEP SBE 12.1 was discontinued and replaced by SEP SBE version, reflecting changes in licensing (from perpetual to subscription) and shifting focus from on-premises to cloud-managed business.[2] SEP was updated from version 12.1 to version 14.0 October 28, 2016 introducing several improved and new detection features.
Symantec Endpoint Protection, current version history:
- Version 14.0 RTM (14.0.1904.0000), 28 October 2016 (release to manufacturing, initial SEP 14.0 version)[3]
- Version 12.1 RU6 MP6 (12.1.7061.6600), 16 September 2016 [4]
- Version 12.1 RU6 MP5 (12.1.7004.6500), 28 June 2016
- Version 12.1 RU6 MP4 (12.1.6867.6400), 18 April 2016 [5]
- Version 12.1 RU6 MP4 (12.1.6860.6400), 16 March 2016 [6]
- Version 12.1 RU6 MP3 (12.1.6608.6300), 04 November 2015 [7]
- Version 12.1 RU6 MP2 (12.1.6465.6200), 02 October 2015
- Version 12.1 RU6 MP1a (12.1.6318.6100), 03 August 2015
- Version 12.1 RU6 MP1 (12.1.6306.6100), 28 July 2015 [8]
- Version 12.1 RU6 (12.1.6168.6000), 9 May 2015 [9]
- Version 12.1 RU5 (12.1.5337.5000), 18 September 2014 [10]
- Version 12.1 RU4 MP1b (12.1.4112.4156), 29 July 2014 [11]
- Version 12.1 RU4 MP1a (12.1.4104.4130), 16 April 2014 [12]
- Version 12.1 RU4 MP1 (12.1.4100.4126), 19 March 2014
- Version 12.1 RU4a (12.1.4023.4080), 13 February 2014
- Version 12.1 RU4 (12.1.4013.4013), 5 November 2013
- Version 12.1 RU3 (12.1.3001.165), 6 June 2013 [13]
- Version 12.1 RU2 MP1 (12.1.2100.2093), 9 April 2013
- Version 12.1 RU2 (12.1.2015.2015), 15 November 2012 [14]
- Version 12.1 RU1 MP1 (12.1.1101.401), 8 May 2012
- Version 12.1 RU1 (12.1.1000.157), 17 November 2011
- Version 12.1 RTW (12.1.671.4971), 5 July 2011 (release to world, initial SEP 12.1 version)
System support
Endpoint Protection supports Windows 10, Red Hat Enterprise Linux (RHEL) 7.0 and 7.1, & Oracle Linux (OEL) 6U5 Since 12.1.6168.6000 [15] Windows 8.1 & Windows Server 2012 R2 (Since 12.1.4013.4013), Windows 8 & Windows Server 2012 (Since 12.1.2015.2015), Windows 7, Windows Server 2008, Windows Server 2008 R2,[16] Windows Server 2003, Windows Vista, Windows XP SP1 or higher, and Windows 2000 - and several distributions of Linux.[16] 64-bit versions of Windows XP, Vista and Windows 7 are supported as well, but Itanium and PowerPC processors are not supported.[16]
Security concerns and controversies
July 2016 - Google Project Zero Team has seen serious vulnerabilities with Symantec's Endpoint Protection products.[17][18] The code has been found to have flaws in the decomposer component, which allows analysis of various archive formats like.zip and .rar.[19]
This enforces a process of remote code execution to create computer worms to execute and interfere with the local network without the knowledge of users.[20][21]
These issues were fixed in release, 12.1.7004.6500 (12.1 RU6 MP5). [22]
Features
- Firewall
- Endpoint incorporates a rules-based firewall, as well as an anti-malware technique that Symantec calls "generic exploit blocking". The firewall is based on technology developed by Sygate Technologies, who were purchased by Symantec. Generic exploit blocking is a technique that attempts to proactivly blocks malware from exploiting unpatched vulnerabilities.[23]
- Proactive protection
- Endpoint uses Symantec's TruScan technologies to attempt detection of unknown malware. It analyzes both "safe" and "negative" behaviours of unknown applications.[24] It also integrates Symantec's Deepsight honeypot sensors to warn of emerging threats and provide threat advisories.[25] Proactive Threat Protection feature is supported on server operating systems in version 12.1 and above.[26]
- Intrusion prevention
Endpoint is able to create and enforce rules on client computers. For example, it can prevent clients from writing files to a USB flash drive. Intrusion prevention also works as IDS. Policies are enforced by TruScan. The IPS functionality acts as a first line of defence against network based attacks.[27]
- Generic Exploit Mitigation
Generic Exploit Mitigation prevents common vulnerability attacks in typical software applications, including the following types of protection: - Java exploit prevention, - Heap spray mitigation, and - Structured exception handling overwrite protection (SEHOP). The protections apply to the specific applications that are listed in the Intrusion Prevention policy. SEP downloads the application list as part of its LiveUpdate content.[28]
References
- ↑ "Symantec Endpoint Protection". Symantec.com. 2011-10-04. Retrieved 2011-10-18.
- ↑ "Symantec Endpoint Protection". Symantec.com. 2015-11-06. Retrieved 2015-11-06.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". Symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". Symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". Symantec.com.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution". Symantec.com.
- ↑ "About the SYM14-013 Symantec Endpoint Protection zero-day vulnerability". Symantec.com.
- ↑ "Symantec Endpoint Protection 12.1 Release Update 4 Maintenance Patch 1A". Symantec.com.
- ↑ "Latest Symantec Endpoint Protection Released - SEP 12.1.RU3". Symantec.com. 2013-06-06. Retrieved 2013-11-07.
- ↑ "Latest Symantec Endpoint Protection Released - SEP 12.1 RU2 and SEP 11.0 RU7 MP3". Symantec.com. 2012-11-15. Retrieved 2013-11-12.
- ↑ https://support.symantec.com/en_US/article.HOWTO111067.html
- 1 2 3 "Symantec Endpoint Protection". Symantec.com. Retrieved 18 October 2011.
- ↑ "Symantec and Norton security products contains security vulnerability- Explained Detailed". "US-CERT". Retrieved 2016-06-05.
- ↑ "Symantec bugfest highlights the dangers of security software". Retrieved 2016-07-05.
- ↑ "Google Found Disastrous Symantec and Norton Vulnerabilities That Are 'As Bad As It Gets'". Retrieved 2016-06-29.
- ↑ "Symantec may actually help hackers, Homeland security warns". Retrieved 2016-07-07.
- ↑ "Symantec admits it won't patch 'catastrophic' security flaws until mid-July". Retrieved 2016-07-07.
- ↑ https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_00
- ↑ "Data Sheet: Endpoint Security" (PDF). Retrieved 2011-10-18.
- ↑ Ramon Ray (2007-12-30). "How Symantec Is Changing to Better Meet Small Business Needs". Smallbiztechnology.com. Retrieved 2011-10-18.
- ↑ "Enpoint Security White Paper" (PDF). Retrieved 2011-10-18.
- ↑ http://www.symantec.com/business/support/index?page=content&id=TECH92440
- ↑ Sarrel, Matthew (2007-12-13). "Symantec Endpoint Protection 11 Review & Rating". PCMag.com. Retrieved 2011-10-18.
- ↑ "Enterprise Support - Symantec Corp. - Technical Solution" (PDF). symantec.com.
