Cheap and Dirty Windows Log File Archiving

So your company has a requirement to maintain log files for a year?

You don’t know how to go about it and you need to implement it now?

I have a solution for you and best of all it’s free. This solution however is not supported by me, there will be no bug fixes by me, and any damages you cause to your own servers is your own fault. That is my one sentence disclaimer to tell you that you truly are on your own.

For this solution or temporary fix (depending on your organization) you are going to need the following helper programs:

Info-zip – we’ll use this to compress down files and save space specifically we need the zip.exe file

MD5SUMS – this allows us to generate MD5 checksums to verify if any file tampering has taken place after the fact. Specifically we need the md5sums.exe file.

Dump Event Log (Dumpel.exe) – this is a tool offered by Microsoft to dump your event logs to a text file. Though this link is part of the Windows 2000 Resource Kit I have tested and it does work with the Windows XP and Windows Server 2003 log files.

We take these 3 programs and wrap them to work together via a batch file. All 3 of these programs MUST be in the same directory as the batch file for it to work as designed. Here is the batch file:

@echo off
REM Sets date variables for file name
for /F “tokens=1,2″ %%d in (‘date /T’) do set day=%%d & set date=%%e
set yyyy=%DATE:~6,4%
set dd=%DATE:~3,2%
set mm=%DATE:~0,2%
set startDate=%yyyy%-%mm%-%dd%
REM Adds Computer to prefix the date
set outputname=%computername%-%startdate%
REM Cleans out previous zip files from a bad run
del %outputname%.zip
REM Dumps each of the log files going back for 2 days
REM allowing for overlaps we may miss due to time changes
dumpel -f %outputname%.sec -l security -d 2
dumpel -f %outputname%.app -l application -d 2
dumpel -f %outputname%.sys -l system -d 2
REM creates an MD5 hash for verification checking
md5sums %outputname%.sec >%outputname%.md5
md5sums %outputname%.app >>%outputname%.md5
md5sums %outputname%.sys >>%outputname%.md5
REM Compresses the 4 files
zip %outputname%.zip %outputname%.*
REM Cleans up the unneeded files to save
del %outputname%.sec
del %outputname%.app
del %outputname%.sys
del %outputname%.md5

I’ve included my comments in the batch file – but let’s go through it a section at a time so you can fully understand it.

@echo off

If you don’t know @echo off supresses everything from your screen in a batch, I wouldn’t suggest modifying my script since this is batch file programming 101.

for /F “tokens=1,2″ %%d in (‘date /T’) do set day=%%d & set date=%%e
set yyyy=%DATE:~6,4%
set dd=%DATE:~3,2%
set mm=%DATE:~0,2%
set startDate=%yyyy%-%mm%-%dd%
REM Adds Computer to prefix the date
set outputname=%computername%-%startdate%

This section adds the prefix to the files we are going to be using on all of your files – these allows us to work with files that include the computer’s name you are running this on and the date on which it was run.

del %outputname%.zip

This verify actually cleans up the zip file if this script has already been run during the current day. Mine is modified to delete the zip file completely since at the end of my script I move my files to a remote location and don’t need archived logs filling up my hard drive quickly.

dumpel -f %outputname%.sec -l security -d 2
dumpel -f %outputname%.app -l application -d 2
dumpel -f %outputname%.sys -l system -d 2

This area does the physical dumping of the logfile. Dumpel is the command. The -f switch allows us to specify a file name. If you notice I used the %outputname% as the first part of the file with the file type of which log file it is as the suffix. The -l switch let’s us specify which logfile we are dumping from the event log (security, application, or system). the -d switch allows us to specify how many days we wish to save. I chose 2 days to allow some overlap on the log files which is good for security reasons since we shouldn’t miss any events if you change the time of the day the script is run. It also give us two more logfiles to verify the authenticity of the log data we are looking at.

When this section is done running you should have three files. If your computer’s name was BOB-SERVER and the date you ran this was one January 3, 2007 the file names would read like this; BOB-SERVER-2007-01-03.sec for your security log, BOB-SERVER-2007-01-03.app for your application log, and BOB-SERVER-2007-01-03.sys for your system log.

md5sums %outputname%.sec >%outputname%.md5
md5sums %outputname%.app >>%outputname%.md5
md5sums %outputname%.sys >>%outputname%.md5

This section generates an MD5 Hash of the logfile data allows you to see if the data was tampered from when it was originally generated. It is next to impossible to edit a file and maintain the same hash data. This allows you some security that your log files are authentic. For those wondering “well can’t I just rerun the md5 program and generate a new hash and save that after modification?” – I have your answer. I didn’t include how to store these files after they are generated and we will touch upon that question under “What do you do now?” at the bottom. The command outputs your three BOB-SERVER-2007-01-03 files and output it to a single BOB-SERVER-2007-01-03.md5 file that includes a section with each of the above files. I decided personally that I didn’t need an md5 file for each of them – feel free to modify this if your needs differ.

zip %outputname%.zip %outputname%.*

This compresses the dumped events logs down to a manageable size. I managed to get a 60 MB log file that I generated during varying testing phases down to just over 6 MB. I also manged to get 480 KB of log files down to 14kb. At this point you should have a BOB-SERVER-2007-01-03.zip file which includes your three event logs and you md5 file.

del %outputname%.sec
del %outputname%.app
del %outputname%.sys
del %outputname%.md5

This section cleans up the files outside of the zip. I manage t0 get these files down 90% in size I don’t need these to eat up extra space.

What do you do now?

From here I would add in a line at the end to move the logs to another server where you can store them for length your organization deems necessary. To help combat the MD5 re-engineering I mentioned above I would copy the compressed archived to two locations on your network. This will help make having an MD5 meaningful. Another option is adding a script that e-mails you the MD5 hash so you have it saved for reference. Having the MD5 and collecting 2 days of information from the logs and would mean an attacker may have to edit 2-4 archives and regenerate md5’s for them – double that if you store a second set of archives in another location.
While this may fulfill your needs for log file capturing and an easy way to store them, it does not address the fact of easy log file auditing and tracking down events. There are all in one solutions out there for you to use and I don’t say in any terms this a solution to those. You need to address your own needs and decide what works for you. This is to give you sometime until your decide what you are going to do.

Life Caching is better then Life Streams

Life Caching:

Life caching is setting up sites that you have complete control over to save data from sites that you only have varied levels of control. Getting all of your meta data in one place. Saving each detail of data in it’s place so it’s saved, used, and recyclable. Life caching is the next stage as the Data Portability Group moves forward. This is not the goal of the Data Portability Group – it is just what their goal enable you to do. The work however is burdened on to you and I can say there is no easy way to do this and some data leakage and loss will always slip through cracks, at least in this stage of the game.

Isn’t this what Life Streaming Accomplishes? How is Life Caching different?

Life Streaming is the step before life caching. While the concepts share alot of overlapping the simplest scenario is that a life stream is a picture in time that does not save your data. A life stream is ephemeral and actual current implementations are very fragile. I have a life stream here. RSS feeds expire so data is lost, companies go out of business so the links it points to is gone, or data just gets missed. But to truly get a better picture of life streaming here is what the life streaming blog says about it:

What is a Lifestream? In it’s simplest form it’s a chronological aggregated view of your life activities both online and offline. It is only limited by the content and sources that you use to define it. Mine is available here. Most people that create them choose a few sources based on sites that track our activities such as Del.icio.us (bookmarking), Last.fm (Music we listen to), Flickr (photos we take) etc…Then you can either find software to host your own, or find sites that provide a platform for you.

Many people have been writing about Lifestreams and the potential value they offer for ourselves and others. Some of those people are Jeff Croft, Jeremy Keith, and Emily Chang. It appears to be a concept that is gaining quite a bit of steam.

I was inspired to create a blog for the Lifestream concept after doing a little research which I wrote about on my blog. Most of the information I found was pretty scattered and there wasn’t a central repository of resources so I thought I should create one. I feel that beyond the self expression of allowing people to track their actions in a passive manner there will be many more exciting technologies that will surface from the backend data aggregation that can occur from people supplying this information.

The rub is that 99% of life streams only save the links of the RSS feeds and do not save the actual data. This is inefficient in design because like I said before data get’s lost for various reasons. Life caching however has the prime goal of saving that individual data for your use and your manipulation. This gives you freedom to do with what you want. Take your data anywhere and everywhere, do with it what you will.

How is this different from the Data Portability Group?

In some aspects, like the concepts of life streaming, life caching shares a few steps in common with the Data Portability Group. What the Data Portability Group means to give is methods and standards that give you tools to do with your data what you will. However, this doesn’t actually mean you will do anything with it or that there will be a standard out of the box configuration for you. The responsibility is on you to act and use these tools that will hopefully emerge.

The Data Portability Group is key for this going forward and allowing you to withdraw your data from the sites that were previously walled gardens. After the garden gates are finally thrown open you have the freedom to do with the data what you will. Please put this power to good use.

Why Do I care?

You should care because this is about you. It is who you are. It does not specifically define you in any ways and most people would understand that it’s a complete picture of you. There are however aspects of you that you may want to share at a later date. The stories your grandmother told you will get fuzzier over time. Hopefully the idea of life caching which is still in it’s infancy will lead to life story archives that the generations after us can learn from. Our grandkids will be able ot mine the data and read the stories you want to pass on.

Will those after you care that you listened to Fallout Boy on June 7th, 2008? Maybe not, but maybe your grandkids will discover similar music tastes with you. It will give them an understanding of who you are. It will also give them ways to identify with you in a way that you could never identify with the pilgrims that came across on the mayflower.

What do I save?

The ideal answer is everything. I would say between the RSS streams I save and the email I collect I am almost up to a 90% efficiency of collecting my personal data online.

To give you an example:

• I save everything I dig.
• I write places I go and stories about them in 43 places
• I write about things I’ve done at 43 things
• I save stories about people I’ve met at 43 people
• I save all the music I listen to that can be tracked with last.fm
• I track all boks I read and movies I watch with with allconsuming
• I save comments I make with cocomments
• I save when and what pictures I’ve uploaded to Flickr, Photobucket, and Picasa
• I save collections of data that I find meaning full with lists of best
• I save the bookmarks I make in del.icio.us
• I save the stories I’ve stumbled upon
• I save the things I’ve shared in google reader
• I save my newsvine articles
• I save my pownces and my tweets
• I save the stories I liked at reddit
• I save the videos I liked an/or uploaded to youtube

This may seem like a lot of data. It is, but it’s also what we deal with in a normal consuming internet fashion. I don’t use the tools that save which applications I’m running and I’m looking for something like last.fm for movies so it’s more automatic – but that will come in time.

Via e-mail I save my phone calls, my bills, banking history- all this can be stored offline and databased in the home. Your own personal Google for yourself should be the end goal of life caching.

Doesn’t this make it easier for companies to mine data about me?

Yes the google monster is omnipotent. Anything you share online can be snagged up and archived away by google. Is this a good thing? Maybe or maybe not. There is no reason you would need to make most of this data public. You could set up to store this data in email archives, private data sites, or personal home encrypted databases. Life caching is not about displaying your life. It’s about having control over it and saving it for a future date.

As the Data Portability Group expands they hope to implement permission controls for the data. This will help prevent against data mining to some extent. The only true answer is that if there are things that you don’t want anyone to know about do not place them anywhere that is publicly accessible or in the hands of any company or person other then yourself.

How do I store and backup the data?

There are many ways. I use WordPress with a variety of plugins to maintain all my data on the site. I also use quite a bit of feedburner kung-fu and gmail filters. The key thing is that I can extract this data into other formats from just those two methods. I could dump it into a personal database or wiki. The tools are only at the beginning of stages to make this useful for you. It is easier to back it up before you lose it then to want it after it is gone.

What Can’t I backup?

In an ideal world there is nothing that you can’t backup. We don’t however live in an ideal world. Mostly the limitations deal with which sites give you some form of access to your data. Some don’t allow you to take friend’s list with you. Other sites don’t allow you to get posts out unless you implement site scraping which could break the terms of service you agreed to.

The limitation is in the tools and the agreements and the Data Portability Group is helping lead the future in developments that will allow you greater access to your own data.

How do you share with your friends?

Beyond having a public blog which your friends may or may not visit there are multiple ways. I have two major RSS feeds coming out my website. The public RSS feed gives everyone a filtered feed of my posts. This way they don’t get spammed with every song I listen to on last.fm or every single story I digg when it happens. This RSS feed then goes and notifies my twitter friends that I’ve posted something new that I find relevant. It also goes out and feeds the stories to tumblr, jaiku, and facebook. It is also the feed that my RSS readers get.

The secondary feed goes to feedburner and gives me a post to email option. This allows me to save via an email archive all of my daily posts so they are searchable through gmail for myself. Users could subscribe to this feed if they asked me, it’s just the amount of data can sometimes be overwhelming and I’ve had a few complaints from a couple of twitter friends.

From my wordpress blog I post to other blog sites. For example when I finish and publish this post it will also be posted at my msn spaces accounts, my old blog at blogspot, vox, xanga, myspace, livejournal, and dandelife. So no matter where you have friended me you can get notifications that I’ve published and posted something.

Finally in some of the message boards I use my signature contains a java script that rotates my 5 newest stories so people can read the headlines and click if they find it interesting.

Do you truly think that this is the future?

Yes, your data is you and part of you is also your data. Hopefully the stories we wish to pass down can be archived, saved, and cached for all to read and consume for generations to come.

Final Notes:

I hope this explanation is relevant for you and that you have interesting in preserving your own data. Each of the links in this article will help you with different aspects of your design. If you have further questions or need some details expanded please leave a comment or contact me so we can hash out ideas and clarify them.

For those heavily interested I would recommend posting and devising ways that you can cache your online and offline life. Work with the Data Portability Group on tools to make this work. The most important thing is to only deal with companies that allow you to do with your data what you want and place it where you need it. Thank and support the companies that do.

Spokeo – The Interesting, Exciting, and Scary

Spokeo is one of the latest Web 2.0 services I have tried here is how it works:

First you sign up and it asks if you want to look for friends from your address book (gmail, yahoo, AOL, etc,) it then spends time going through all the addresses and see which services they belong (Amazon, Myspace, Last.fm, Digg, Twitter, Etc.) – at this point it shows you all of their public activity on these services.

You also have the option of linking your myspace, linkedin, or other accounts where it doe the same searching as before. This is interesting since it allows you to track your friends without hunting them all down and searching them out. You know what they are up to without actively going to all these different sites online for hours at a time. You may never log into your normal sites to keep up with your friends, it all coming to you.

Now the scary – you can put in any e-mail address and look up someone the same way. You also receive hits from your address book of someone you may have had one quick e-mail exchange with but no relationship. Because of this you are infringing on their privacy.

More people need to be aware of Spokeo so they understand the implications of their online activities and how easy they are to track and monitor. I’m well aware and have been for awhile, I use teh internet and post information knowing this and expecting it. Other people I know are not nearly as aware.

I would recommend trying it out just to see what you can find. If your worried about your e-mail address becoming part of the beast i would advise to sign up with a throw away e-mail address.

Netflix privacy issues – The Government Knows Your Rentals

My previous post about Palantir Technologies intelligence sorting tool brought up the fact that they used netflix’s data as part of their dataset analysis. Further research shows that netflix routinely releases their full dataset with the user’s private information scrubbed. So for a brief minute here Netflix is in the clear. This goes on further though from issues that have been discovered about this. Netflix didn’t stay clear very long.

Arvind Narayanan and Vitaly Shmatikov from The University of Texas at Austin on November 11, 2006 released a paper on how to break the anonymity of the Netflix dataset. This information is aggregate and the method is quite complex. There is however the fact that this data can be found and linked back to you with the correct tools. Palantir releases tools for the intelligence community and having tested it I have no confirmation but since it’s public data at this point has no reason not to include it in their sample data set they provide to costumers.

Before I go further I would like to say I don’t think Palantir has done anything wrong. The problem is that Netflix has released this data to the public even after they learned that the anonymity can be broken. With Palantir’s strengths there is very little effort to link these rentals to you in your private records. Now I will be the first to dismiss government paranoia but in this case with such little effort would the intelligence community really pass up this information? Data by itself is meaningless, but data in aggregate can be very powerful.

If you are concerned with the government or anyone else tracking your rental history I would suggest leaving netflix as soon as possible.

Palantir Technologies -The Intelligence Community’s New Analysis Platform

The Intelligence Community’s New Analysis Platform is the webinar I am attending today. It is hosted by Carahsoft – the same people that hosted the Symantec Webinar I attended. The company whose products this is about is called Palantir Technologies. They have wide spread financial and government data analysis tools. Todays webinar focuses on the government sectors.

From a side note while we are waiting for this to start Palantir, according to wikipedia, is an artifact from the Tolkien mythos. specifically: A palantír (sometimes translated as Seeing Stone but actually meaning “Farsighted” or “One that Sees from Afar”) is a stone that functions somewhat like a crystal ball.

Webinar started

They start with the standard thank you to their host carahsoft.

Palantir was started in 2004 by Alexander Carr (sp) and the paypal team. They pointed out that the main part of Paypal was anti fraud and that’s how they relate to the intelligence community. They spent sometime discussing Paypal and their competitors. The reason paypal succeeded compared to their competitors was that they had analysts to sort the data compared to using pure computer work. The analyst then built tools to work with the data at the conceptual level compared to the data level. This allowed the analysts to help fight fraud better then the competition which allowed them to succeed.

Paypal then looked at what areas they could fit these types of tools. They recognized that they would fit best in the high finance and the intelligence community. They worked and created tools and today’s webcast was about the intelligence community tools. Planatir is a front end and backend tool

Data Integration – takes all your records and puts them into one unified view that allows an analyst to have an easy view of unified data.

Search and Discovery – see who the user communicated with – persistent search which alerts the analyst when new information becomes available.

Link Analysis- the database includes historical and auditible revision analysis – I assume this is it help ensure the integrity of the database. Includes meta data for source, who added it, and where it came from, who updated it, essentially every step of change and data you could want. This also allows the revisioning database to look quickly at the data history. They then go on to show different views and history tracking they can utilize.

He shows how you could do different information extractions to track terrorist activities (once again using the terrorist threat to try to drive the point home /rolleyes). While this would be a great tool in general I think this could have been done another way instead of driving the terrorist angle. The data set that it can pull from is quite large and very interesting.

Very interesting drag and drop interface for entity resolution and analysis. Very Web 2.0ish but yet seems they put too much emphasis on the fisher price like interface. It’s not a bad thing just overly rounded – but I assume this may help things work faster – I have nothing to compare it to though. They are offering a video at the end so I’m not going to describe all of the interface and his interaction with it.

This does make Jim Cropcho’s discovery of a flaw in the ohio voting records a very trivial discovery for this software and makes how we maintain our records especially our voting and documents that should be private (no your phone is not really considered private sorry) otherwise data discovery with tools like this is trivial.

The platform does support plug-ins.

When asked how many entities they can handle they stated over 100 million entities – they have pulled in all of IMDB, Wikipedia – and NETFLIX!!!! – so this company is looking at user checkouts and ratings on netflix – I’m going to follow up with netflix and find out what of my private data is available to these other companies.

More links

here
here
Flash Demo

For more carahsoft webinar’s go here for sign up.

Palantir Technologies -The Intelligence Community’s New Analysis Platform

The Intelligence Community’s New Analysis Platform is the webinar I am attending today. It is hosted by Carahsoft – the same people that hosted the Symantec Webinar I attended. The company whose products this is about is called Palantir Technologies. They have wide spread financial and government data analysis tools. Todays webinar focuses on the government sectors.

From a side note while we are waiting for this to start Palantir, according to wikipedia, is an artifact from the Tolkien mythos. specifically: A palantír (sometimes translated as Seeing Stone but actually meaning “Farsighted” or “One that Sees from Afar”) is a stone that functions somewhat like a crystal ball.

Webinar started

They start with the standard thank you to their host carahsoft.

Palantir was started in 2004 by Alexander Carr (sp) and the paypal team. They pointed out that the main part of Paypal was anti fraud and that’s how they relate to the intelligence community. They spent sometime discussing Paypal and their competitors. The reason paypal succeeded compared to their competitors was that they had analysts to sort the data compared to using pure computer work. The analyst then built tools to work with the data at the conceptual level compared to the data level. This allowed the analysts to help fight fraud better then the competition which allowed them to succeed.

Paypal then looked at what areas they could fit these types of tools. They recognized that they would fit best in the high finance and the intelligence community. They worked and created tools and today’s webcast was about the intelligence community tools. Planatir is a front end and backend tool

Data Integration – takes all your records and puts them into one unified view that allows an analyst to have an easy view of unified data.

Search and Discovery – see who the user communicated with – persistent search which alerts the analyst when new information becomes available.

Link Analysis- the database includes historical and auditible revision analysis – I assume this is it help ensure the integrity of the database. Includes meta data for source, who added it, and where it came from, who updated it, essentially every step of change and data you could want. This also allows the revisioning database to look quickly at the data history. They then go on to show different views and history tracking they can utilize.

He shows how you could do different information extractions to track terrorist activities (once again using the terrorist threat to try to drive the point home /rolleyes). While this would be a great tool in general I think this could have been done another way instead of driving the terrorist angle. The data set that it can pull from is quite large and very interesting.

Very interesting drag and drop interface for entity resolution and analysis. Very Web 2.0ish but yet seems they put too much emphasis on the fisher price like interface. It’s not a bad thing just overly rounded – but I assume this may help things work faster – I have nothing to compare it to though. They are offering a video at the end so I’m not going to describe all of the interface and his interaction with it.

This does make Jim Cropcho’s discovery of a flaw in the ohio voting records a very trivial discovery for this software and makes how we maintain our records especially our voting and documents that should be private (no your phone is not really considered private sorry) otherwise data discovery with tools like this is trivial.

The platform does support plug-ins.

When asked how many entities they can handle they stated over 100 million entities – they have pulled in all of IMDB, Wikipedia – and NETFLIX!!!! – so this company is looking at user checkouts and ratings on netflix – I’m going to follow up with netflix and find out what of my private data is available to these other companies.

More links

here
here
Flash Demo

For more carahsoft webinar’s go here for sign up.

Failing my Civic Duty

The gentleman who runs The Public Ballot IMed me last night to see if I voted and if the way the ballots were handled had changed in my area. I had completely spaced and with real life being hectic the last seven days i had completely spaced and forgot or didn’t take notice.

So I can say that I failed to get the vote out – but would love to congratulate Jim Cropcho on changing the vote handling in at least one district with the flaw he found in the voting system that I wrote about earlier here.

I still believe this should be changed in all Ohio districts and any other states where this flaw remains. For more information and up to date news on this issue please visit The Public Ballot.

I’m going to crawl beneath a rock for failing to get my vote out. I’ll be much happier when online voting becomes a possibility.

Symantec Endpoint Protection 11.0

I’m currently in a webex seminar for Symantec Endpoint Security – the moderator has not joined yet. I thought I would share thoughts and ideas as this went along – and for reference to myself at a later date. I realize this is no apple speech or Nintendo launch – but we all have to get our real time blogging skills up to date somehow. I signed and view no disclosure agreement in the invitation that was given to me and I would not have violated it if I did. This is not specific to my job or company so I don’t feel I’m violating any trust.

The seminar is scheduled to be 1 hour and 15 minutes – unless it’s a really short seminar and its only 1 minute 15 seconds – in that case I guess this is a hug waste of time.

Waiting for the moderator – we just got a message that the seminar will start in 3 minutes – 2 minutes late btw.

The presenter according to the slide is Kevin Haley, Director of Technical Product Management in the Endpoint Security Group.

Since my understanding is that replaces Symantec Anti-virus there is a drastic change as they consolidate all the products they have purchased in the past trying to get them to work cohesively.

The seminar just started only 4 minutes late.

Kevin is responsible for Symantec End Point protection.

Agenda:
Goals of the seminar
Overview of the product
Migration and Migration issues
Additional tools

Goals:

They’ve muted the participants for our own anonymity *roll eyes* – I know from experience that this is solely to not get stopped by possible trigger points that listeners may have.

We have options of typing in questions and getting them answered in real time.

Product Overview:

Symantec Endpoint Protection 11.0 and Symantec Multi-tier protections 11.0

Multi tier is the new version of SAV Enterprise Edition 8, 9, 10 – customer with upgrade protection and support with Symantec will get a free upgrade. This also includes SAV for Mac OSX.

Endpoint protection 11.0 – is the upgrade for SAV CE, SCS, Symantec Sygate Enterprise Protection, and Whole Confidence online for corporate PC’s get this in their upgrade contract

They now took a poll if we entered the beta test for Symantec Endpoint Protection – 9% did public – 20% did external and 69% did not (this was a seminar poll for the participants.

They are talking about the reasons for integrating everything

Parts

Antispyware – Leads in root kit detection and removal *unless they are keeping quiet for Sony
Antivirus

Firewall technology – taken from Symantec Client Security and Sygate

Intrusion Prevention – Behavior Based Threat protection – SONAR whole security – network traffic protection

Device Control/ Application Control

Network Access Control – add on client

New client is all bubbly and vista like – take that how you want. New help and support button allows some basic troubleshooting info in one spot. Access to windows accounts info, disk space, log files, and version information. You can also import or export policies from the client. Any client installed by default from the CD are initially self managed – if you want them to be managed by default you need to create an installation package on your management server.

You can change all policies not just the firewall based on location.

The file that tells if the client is managed or unmanaged is located in the file sylink.xml – contains also server list, certificate info, heartbeat, and communications. There is a tool to auto edit the file included on the cd for easy managed to unmanaged deployment. You could also edit this manually and the file is said to be documented.

Intrusion prevention capability – network based intrusion prevention tied into the tcp stack – generic exploit blocking from SCS and Sygate IDS which supports custom signatures – signature format is similar to Snort. Behavior blocking – proactive threat scan from whole security – innovative behavior based analysis – uniquely accurate low .004% false positive rate (testing for 2 years) via the web site and the consumer product (your enterprise beta testers) – enables broad deployment on endpoints. 20 million installations during the test – so 40 false positives for every 1 million PC’s – can also do white listing so false positives only show up once.

Stupid picture of a cookie jar with a digital camera and video camera – cookies disappear in the night and you want to catch who is doing this used camera for random images or camcorder you can review the film later but the camcorder solution is more expensive – so proactive threat scanning takes a picture of all the processes every 15 minutes and analyzes it. *is this seriously the best analogy?????????

Application Control – you can disable certain application

Device protection – block devices by type – trying to stop items like USB, infrared, Bluetooth, serial , parallel , firewire, scsi, PCMCIA – can block read/write execute on burnable media drives – can block all USB except keyboard and mouse – *I would just use a browser

Features overview
email report distribution on a schedule
centralized event logging
customizable reports
real time event viewing
notifications view
event export to SSIM or 3rd part
Embedded and MS SQL support
Client install package builder
patch and update
remote installation
import and sync with Ad
authenticate with AD
customized agent package installation
Migration from SAV, SCS, SSEP,& SNAC
Centralized Web Based console
Simplified interface for SMB and enterprise
Role Based Access
Administrative domains
Assign rights by user or group
User defined multi tier groups
RSA SecurID
Integrated management of all agent components
single console for management of AV, FW, NAC and other policies
Group based polices
- I missed the last two.

Migration

Standard migration steps so far – document, design, install architecture, migrate existing groups and policies, configure reporting, configure server/site (policies, groups, Admins, notifications etc. , create and test client packages,

Java based Management – talk to it on HTTPS (admin and client) clients can be configured for HTTP if you want unencrypted traffic- SQL database for storage.

Database contains
Group structure
policies
patches
logs
content

only replicates
Group Policies/Logs/Content

SQL can be separate from the management sever – many management servers can use a single database. Numbers are to be determined but there is basic info in the documentation – hard numbers will not be available in FCS (First Customer Shipment)

Distributed environment – multiple management servers and databases – Management servers always replicate policies and group information between them – so they will all know about ALL the clients and policies – any client can check into any server – but you can restrict that by server or server group – you can also setup a order it checks in. Logging replication is optional and they call it filtering – if you have a current architecture where all information rolls up to a master server you can still do that – or you can replicate all logs to all servers.

Supports migration from SAV, SCS, and SSEP – clients upgrade to SAV 11.0 will automatically connect to new SESM

Look and feel for reporting data is the same

First use wizard simplifies initial setup

SEPM can run on the save server as a SAV management server since they are designed to coexist since they use different executables.

Migration 1 – on same server as your SAV server
Install SEPM
Move Group and Policy info from SSE
Install SAV 11
Decommission original Parent server

Migration 2 – different server
Policies can migrate with first use wizard – other steps very similar

Reporting migration

Sav 10.1 – you can redirect clients to the new SEP 11 database for reporting.

Client installation – support to install over SAV 9-10.1, SCS 3-3.1, SEP 5.1, SPA 5.1 (don’t have to uninstall these products)

Already rolled out internally at Symantec with 5000 users

First use wizard – which will enable you to migrate your groups, policies, users to your new management server – they will not install the client automatically on a management server-so this will have to be done manually. They warn about installing the client firewall on the servers install – LOL – I can see why but I wonder how many administrators actually did that.

Content distribution

SEPM gets client updates and content from Symantec live update – clients can be patched from management server using only a small difference file that can be pushed down.

Still can get content from central internal live update server or rapid release definitions

Clients send events, operation state, and command status to the SEPM server – commands are sent to client from server, profiles, content, updates sent to client – content and updates only the different micro definitions they don’t’ have are sent instead of all the definitions each time.

Clients with a group update provider – will go to the group update provider for content (av defs, etc.)

The group update providers caches information from the SEPM server – designed for low bandwidth architectures.

Unmanaged clients can still go to live update on their own

Additional tools

http://edm.symantec.com/endpointsecurity/
http://www.symantec.com/endpointsecurity/migrate – migration information
Consulting Services and support

Goodbyes and that’s the end

Questions and Answer from the text box:+

Question: Sorry missed what said… Did you mention Macintosh would be included?
Answer: Yes, MAC will be included

Question: Will the Multi-Tier console server handle Macintosh clients?
Answer: MAC will not be managed by the SEPM console this release

Question: Will it be Vista compliant?
Answer: Yes

Question: Will the Symantec Multi-tier Protection for MAC be able to utilize the Parent Servers for Windows?
Answer: No. MAC has its own console as it stands today.

Question: Asking about the console. Will there still be a seperate console server for Macs?
Answer: Yes

Question: So there won’t be a Mac solution if we’re a SEPM customer?
Answer: MAC is included in the Multi-Tier Protection but it is managed by a seperate console and server structure

Question: What is the upgrade from SAVCE
Answer: Symantec Endpoint Protection 11.0

Question: is the full endpoint suite required, or can you still purchase products separately?
Answer: You get everything as long as you are current on maintenance.

Question: Assuming no more console?
Answer: MAC will be managed by its own console. SEPM will manage all windows clients

Question: Can you turn off various components?
Answer: Yes, you can enable and disable the features as needed.

Question: Will it have built in reporting capabilities or do we need to continue with SAV reporter?
Answer: SEPM has reporting built in.

Question: Will the SEP v11 console be able to managed legacy clients (SAV10, etc)
Answer: No. It will not manage legacy SAV clients

Question: Will this all still be in a single agent?
Answer: Yes, Single Client with all the mentioned technologies

Question: Will these products be Vista logo’d or just Vista compliant? Also will you be providing both 32bit and 64bit clients?
Answer: Yes, we will be providing both 32 and 64 bit versions of the client. Vista compliant.

Question: What? We will need to run multiple consoles? Will they all feed into SSIM?
Answer: SEPM will manage the windows clients only with this release. Yes, we will have a collector for SSIM

Question: Will we go over migrating an existing Reporting Server to the built-in reporting in SEPM?
Answer: There is a white paper that will be available as well as a migration wizard

Question: would this be red if I disabled it from management side?
Answer: Yes

Question: does the user need admin rights to execute a FIX
Answer: The fix can be run as system by the client

Question: Are there different levels of users provided in the SEPM?
Answer: Yes, administrators can have different functions and rights as configured. There is limited administration.

Question: Will the 64-bit client differ by processor type, or will the 64-bit client be universal?
Answer: Universal

Question: Current installation from CD presents you an option to choose the management server if you want to install managed. Why has that been removed?
Answer: You can create packages that are “unmanaged” still it is just a different process.

Question: can it be locked so a cleint can’t remove from a server?
Answer: Yes

Question: In previous versions, we could specify management server. This is not possible

now?
Answer: Yes. It still is possible to specify the server that will manage the client.

Question: Will the client upgrade handle all current individual components that may be installed on the desktop (SSEP, SAV10, etc.)?
Answer: Yes, absolutely

Question: Does the new policy import/export replace the usage of GRC.dat and the need to at times manually implement it.
Answer: Yes. Sylink.xml is the new file used.

Question: Will the SPEM have the ability to set security access for other users/groups to manage their servers or sites?
Answer: Yes

Question: So the sylink.xml replaces the grc.dat except it doesnt disappear once processed by the client?
Answer: Yes, exactly

Question: When will this release be available?
Answer: End of the month

Question: can you import SNORT signaturs?
Answer: No, we support REGEX and have a language similiar to snort

Question: Is there a maximum network latency value between a policy sevrer andf end client that we should consider when determine the count and location of policy servers on our global network?
Answer: We will have a scalability document for distro

Question: Does the current license also include the signature subscription for IDS?
Answer: Yes

Question: Has the port range for communication between SErvers and Clients decreased? Or will it still range from 1024-4999?
Answer: It will be SSL

Question: Will this presentation be available for download so we can share with upper management?
Answer: Via email

Question: Does the client upgrade require a reboot from version 10.x
Answer: to start the firewall but not for AV protection

Question: We currently install the SAVCE client on Windows Server OS managed by a Parent server. Which product is recommended for Windows Server OS or which components are recommeded to be disabled on Server OS?
Answer: SEP can be run on servers and clients. All technologies are portable

Question: is the management console still MMC based?
Answer: No

Question: Is there a reporting server for this similar to the SAV 10 reporting server?
Answer: No, it is integrated now.

Question: When will training be available for SEP 11?
Answer: At release

Question: will we be able to customize the white list
Answer: Yes

Question: Does Behavior blocking handle rogue keyloggers?
Answer: Yes

Question: Will the new console be able to communicate with “legacy’ SSEP agents (or, can we upgrade the SSEP-PM without requiring the SSEP agents to upgrade at the same time)?
Answer: It will support legacy SSEP clients but not SAV.

Question: so just 443 and 80
Answer: Exactly!

Question: Can specific applications be “black listed”?
Answer: Yes

Question: what are the functionality differences between Sym Endpoint Protection and Sym Multi-tier Protection?
Answer: Same technologies SMP includes email protection and MAC/linux

Question: will the clients listen on a port for server initiated communication, or is the communication only initiated by the client?
Answer: no client listen port. Client initiates all communication to the server

Question: Will SEP require SQL?
Answer: You can use SQL but the embedded (included) DB is Sybase

Question: Will mobile devices be supported? If so, what devices?
Answer: Seperate product

Question: Will the Q&A be made available after the call?
Answer: Yes

Question: any chance of getting a copy all the slides to review after the meeting?
Answer: Yes

Question: Is there an estimate available of the resource impact on a host machines due to the proactive threat scanning?
Answer: We will have this documented and available in a whitepaper
Question: Will SMS5 – Symantec Mobile Security Suite 5 integrate into SEP?
Answer: No.

Question: Do the antivirus capabilities within SEP 11 use less resources on a typical client and server? We have many problems with SAV 10 chewing up too much memory and CPU utilization, especially on virtual servers.
Answer: Yes, lower memory footprint

Question: Is there an override for the USB blocking?
Answer: Yes

Question: Can devices be blocked based on Manufacturer / Model?
Answer: No- windows class ID, not vendor class ID…..coming in the future though

Question: can usb thumb drives be blocked but other usb devices, ie scanner, printer be allowed?
Answer: Absolutely!

Question: is patch/maintenance release management going to be simplified over previous versions? (i.e. all inclusive rollups not requiring previous upgrades to a base version)?
Answer: Definitely

Question: so SMP includes the sygate firewall technology?
Answer: Yes!

Question: A new version of packager come with this – I am aware its unsupported but if new version does come with it will it be supported? If not any idea when?
Answer: Packager is gone. The packaging mechanism is the Sygate technology

Question: Will the schema be available for the database, so we can query it?
Answer: Definitely!!!

Question: Will SMSDOM (Mail Security for Domino) Still be supported as well as Premium Anti-Spam? How about for Exchange?
Answer: Yes

Question: Are the INTEL portions from previous NAV/SAV versions been eliminated altogether?
Answer: Yep

Question: Are the policies for the client available to be pushed via Group Policy in AD?
Answer: Yes

Question: can you restrict file types allowed to write to USB drives? i.e. allow MP3, but not DOC or XLS?
Answer: Yes.
Question: Can the Class ID blocking be managed by OUs, say the Director level can use usb drives, regular sales cannot?
Answer: Yes, using grouping

Question: Can individual components – say, the firewall portion – be disabled selectively? For example, we may want AV on a server but not necessarily firewall (even more specifically, for performance savings?).
Answer: YES!

Question: What version of java?
Answer: Local version

Question: how much space is required for the sql ie per machine?
Answer: DB size will vary by client count

Question: Does this version get away from storing client information in the registry?
Answer: Yep

Question: Can the management server be installed on VM?
Answer: Yep!

Question: Did he say the client port is 80?
Answer: Or 443 depending on selection by administrator

Question: is a certificate server required?
Answer: no

Question: In the current version of SAV10 Reporting, there is a vulnerability of the PHP component. Will SEPv11 provide better response to layered components that have known vulnerabilities?
Answer: Absolutely!

Question: the client/server traffic is based on port 80/443 correct? How is that going to affect clients running websites using port 80/443?
Answer: There should not be a conflict but the ports are configurable

Question: from the remediation aspect, will SAFE mode be required for a 100% detection and cleaning?
Answer: Depends on the threat. SEP 11 will clean better than SAV 10 though

Question: For replication what type of nbandwidth does it use over a WAN?
Answer: All documented in the scalability doc

Question: Since the client information is no longer in the registry how can we check AV status through scripts? Is there a WMI interface?
Answer: Some status can still be checked via the registry
Question: Since this is running on 80 or 443 is it using some type of web server underneath for communication (e.g. Tomcat/Apache/etc.)?
Answer: on the manager yes. There is a tomcat server and IIS

Question: We have encountered issues with the volume of network traffic generated by corrupted defs. How does the 11.x version address this issue?
Answer: corrupt defs should be a thing of the past.

Question: are there any JRE versions that are not supported or are recommended for the management console? Will the client itself require JRE to be installed for SEP to work?
Answer: CLient does not require JRE. The version installed is a local version specific to SEPM.

Question: will registry still use intel\landesk\virusprotect6 structure?
Answer: Nope. All intel technologies for management are gone and the registry has been changed as far as structure

Question: How can we obtain the scalability document?
Answer: It will be posted at release

Question: has sepm been certified for vm
Answer: We support VM environments. Not sure if it is certified by VM

Question: Why is this not backwards capable with SAV 10 or 9? Upgrading an entire enterprise can take a while.
Answer: Completely different management architecture.

Question: is there a method for users to alter administrative scan schedule (but not any other option)?
Answer: Yes

Question: what about Sygate 4.1?
Answer: no

Question: Will you be able to save all the old data from the SAV 10.1?
Answer: yes, migration wizard will cover this

Question: no over intall for 7.x is that correct
Answer: right

Question: OVerinstall of 10.2 for Vista supported?
Answer: yes

Question: he said that scalability doc will be available about a month after SEP 11.0 release
Answer: probably sooner
Question: when you overinstall does this require a reboot on the endpoint
Answer: Yes, but not for AV, just for the FW

Question: Will the overinstall work even if the previous client is password protected? Or will it still require a registry hack to remove?
Answer: It will work

Question: can SAV10 client groups be migrated, or is there granularity to support that type of group?
Answer: Migration wizard will allow this

Question: Does SEP support NT4.0 clients?
Answer: no
Question: does it work on vm . Currently version 10 I have on vm
Answer: Yes

Question: Is the upgrade to SAV 11 more reliable than the upgrade to SAV 10? We were forced to use NONAV to pre-clean the SAV 8 and SAV 9 systems before going to SAV 10
Answer: Yes.

Question: What is the SEPM blog URL?
Answer: https://forums.symantec.com/syment?category.id=endpoint

Question: Is the installer follow standard MSI best practices?
Answer: Yes

Question: will management server install require reboot (windows server 2003)?
Answer: no

Question: This includes central management and reporting for the FW?
Answer: Yes

Question: Any problems creating an SMS package for installing to clients?
Answer: no

Question: to install over 4.1 do you need to uninstall 4.1, reboot and install SEP or can you uninstall 4.1, install SEP and reboot?
Answer: Yes

Question: Can our TAM answer questions regarding SEP 11 yet? Or do we have to wait until the release?
Answer: Yes

Question: We run Symantec Mail Security for Exchange. If we run SEPv11 on the same box, are the defs compatible? Can they co-exist?
Answer: They can co-exist

Question: you mentioned earlier that the client initiates all contact with the server. What about Virus sweeps, updates that you want to push, do you have to wait til the next time the client checks in
Answer: No

Question: does the patch require a reboot? We have lots a 24×7 servers.
Answer: no

Question: Will the dif patch require reboots on the clients?
Answer: no

Question: No problem to run in a mixed environment, e.g. legacy clients reporting to previous management console, newer clients reporting to newer management console?
Answer: no problem with a parallel environment

Question: We are going to have a lot of language requirements (Thai, German, French, Russian, Swedish, Japannesse, Chinesse). Is there a link on your web page to the supported language versions?
Answer: It will be posted but is not right now. Should be at release time. We are localizing alot of languages

Question: For definition distribution, what is the approx size of the diff-defs? If a client has been off the network for a week or longer, what is the approx size of the diff-def?
Answer: will vary

Question: Thanks for the GUP!!
Answer:

Question: If a client goes to a GUP and then that client goes to another group will it still look for the GUP group A
Answer: no

Question: With ver9 and > Symantec expanded the feature set to combat spyware and malware, many customers complained of CE being bloated, memory-intensive, and causing issues with many line-of-business applications. With all these added features in this new product release can you point to any documentation related to this version benchmarks and/or performance specs compared to previous releases?
Answer: Its all documented. Check the portal

Question: will rapid release definitions be available for the Liveupdate server?
Answer: yes with LUA 2.5

Question: Not sure if this was asked. But when a client connects to a 11.0 server does it use a certificate like in the past for communications?
Answer: no

Question: Can the gups be configured as Primary, secondary, and can the clients recognize that
Answer: no

Question: when will this be available for download from the platinum site?
Answer: end of the month

Question: Thank You
Answer: You are welcome

Symantec Endpoint Protection 11.0

I’m currently in a webex seminar for Symantec Endpoint Security – the moderator has not joined yet. I thought I would share thoughts and ideas as this went along – and for reference to myself at a later date. I realize this is no apple speech or Nintendo launch – but we all have to get our real time blogging skills up to date somehow. I signed and view no disclosure agreement in the invitation that was given to me and I would not have violated it if I did. This is not specific to my job or company so I don’t feel I’m violating any trust.

The seminar is scheduled to be 1 hour and 15 minutes – unless it’s a really short seminar and its only 1 minute 15 seconds – in that case I guess this is a hug waste of time.

Waiting for the moderator – we just got a message that the seminar will start in 3 minutes – 2 minutes late btw.

The presenter according to the slide is Kevin Haley, Director of Technical Product Management in the Endpoint Security Group.

Since my understanding is that replaces Symantec Anti-virus there is a drastic change as they consolidate all the products they have purchased in the past trying to get them to work cohesively.

The seminar just started only 4 minutes late.

Kevin is responsible for Symantec End Point protection.

Agenda:
Goals of the seminar
Overview of the product
Migration and Migration issues
Additional tools

Goals:

They’ve muted the participants for our own anonymity *roll eyes* – I know from experience that this is solely to not get stopped by possible trigger points that listeners may have.

We have options of typing in questions and getting them answered in real time.

Product Overview:

Symantec Endpoint Protection 11.0 and Symantec Multi-tier protections 11.0

Multi tier is the new version of SAV Enterprise Edition 8, 9, 10 – customer with upgrade protection and support with Symantec will get a free upgrade. This also includes SAV for Mac OSX.

Endpoint protection 11.0 – is the upgrade for SAV CE, SCS, Symantec Sygate Enterprise Protection, and Whole Confidence online for corporate PC’s get this in their upgrade contract

They now took a poll if we entered the beta test for Symantec Endpoint Protection – 9% did public – 20% did external and 69% did not (this was a seminar poll for the participants.

They are talking about the reasons for integrating everything

Parts

Antispyware – Leads in root kit detection and removal *unless they are keeping quiet for Sony
Antivirus

Firewall technology – taken from Symantec Client Security and Sygate

Intrusion Prevention – Behavior Based Threat protection – SONAR whole security – network traffic protection

Device Control/ Application Control

Network Access Control – add on client

New client is all bubbly and vista like – take that how you want. New help and support button allows some basic troubleshooting info in one spot. Access to windows accounts info, disk space, log files, and version information. You can also import or export policies from the client. Any client installed by default from the CD are initially self managed – if you want them to be managed by default you need to create an installation package on your management server.

You can change all policies not just the firewall based on location.

The file that tells if the client is managed or unmanaged is located in the file sylink.xml – contains also server list, certificate info, heartbeat, and communications. There is a tool to auto edit the file included on the cd for easy managed to unmanaged deployment. You could also edit this manually and the file is said to be documented.

Intrusion prevention capability – network based intrusion prevention tied into the tcp stack – generic exploit blocking from SCS and Sygate IDS which supports custom signatures – signature format is similar to Snort. Behavior blocking – proactive threat scan from whole security – innovative behavior based analysis – uniquely accurate low .004% false positive rate (testing for 2 years) via the web site and the consumer product (your enterprise beta testers) – enables broad deployment on endpoints. 20 million installations during the test – so 40 false positives for every 1 million PC’s – can also do white listing so false positives only show up once.

Stupid picture of a cookie jar with a digital camera and video camera – cookies disappear in the night and you want to catch who is doing this used camera for random images or camcorder you can review the film later but the camcorder solution is more expensive – so proactive threat scanning takes a picture of all the processes every 15 minutes and analyzes it. *is this seriously the best analogy?????????

Application Control – you can disable certain application

Device protection – block devices by type – trying to stop items like USB, infrared, Bluetooth, serial , parallel , firewire, scsi, PCMCIA – can block read/write execute on burnable media drives – can block all USB except keyboard and mouse – *I would just use a browser

Features overview
email report distribution on a schedule
centralized event logging
customizable reports
real time event viewing
notifications view
event export to SSIM or 3rd part
Embedded and MS SQL support
Client install package builder
patch and update
remote installation
import and sync with Ad
authenticate with AD
customized agent package installation
Migration from SAV, SCS, SSEP,& SNAC
Centralized Web Based console
Simplified interface for SMB and enterprise
Role Based Access
Administrative domains
Assign rights by user or group
User defined multi tier groups
RSA SecurID
Integrated management of all agent components
single console for management of AV, FW, NAC and other policies
Group based polices
- I missed the last two.

Migration

Standard migration steps so far – document, design, install architecture, migrate existing groups and policies, configure reporting, configure server/site (policies, groups, Admins, notifications etc. , create and test client packages,

Java based Management – talk to it on HTTPS (admin and client) clients can be configured for HTTP if you want unencrypted traffic- SQL database for storage.

Database contains
Group structure
policies
patches
logs
content

only replicates
Group Policies/Logs/Content

SQL can be separate from the management sever – many management servers can use a single database. Numbers are to be determined but there is basic info in the documentation – hard numbers will not be available in FCS (First Customer Shipment)

Distributed environment – multiple management servers and databases – Management servers always replicate policies and group information between them – so they will all know about ALL the clients and policies – any client can check into any server – but you can restrict that by server or server group – you can also setup a order it checks in. Logging replication is optional and they call it filtering – if you have a current architecture where all information rolls up to a master server you can still do that – or you can replicate all logs to all servers.

Supports migration from SAV, SCS, and SSEP – clients upgrade to SAV 11.0 will automatically connect to new SESM

Look and feel for reporting data is the same

First use wizard simplifies initial setup

SEPM can run on the save server as a SAV management server since they are designed to coexist since they use different executables.

Migration 1 – on same server as your SAV server
Install SEPM
Move Group and Policy info from SSE
Install SAV 11
Decommission original Parent server

Migration 2 – different server
Policies can migrate with first use wizard – other steps very similar

Reporting migration

Sav 10.1 – you can redirect clients to the new SEP 11 database for reporting.

Client installation – support to install over SAV 9-10.1, SCS 3-3.1, SEP 5.1, SPA 5.1 (don’t have to uninstall these products)

Already rolled out internally at Symantec with 5000 users

First use wizard – which will enable you to migrate your groups, policies, users to your new management server – they will not install the client automatically on a management server-so this will have to be done manually. They warn about installing the client firewall on the servers install – LOL – I can see why but I wonder how many administrators actually did that.

Content distribution

SEPM gets client updates and content from Symantec live update – clients can be patched from management server using only a small difference file that can be pushed down.

Still can get content from central internal live update server or rapid release definitions

Clients send events, operation state, and command status to the SEPM server – commands are sent to client from server, profiles, content, updates sent to client – content and updates only the different micro definitions they don’t’ have are sent instead of all the definitions each time.

Clients with a group update provider – will go to the group update provider for content (av defs, etc.)

The group update providers caches information from the SEPM server – designed for low bandwidth architectures.

Unmanaged clients can still go to live update on their own

Additional tools

http://edm.symantec.com/endpointsecurity/
http://www.symantec.com/endpointsecurity/migrate – migration information
Consulting Services and support

Goodbyes and that’s the end

Questions and Answer from the text box:+

Question: Sorry missed what said… Did you mention Macintosh would be included?
Answer: Yes, MAC will be included

Question: Will the Multi-Tier console server handle Macintosh clients?
Answer: MAC will not be managed by the SEPM console this release

Question: Will it be Vista compliant?
Answer: Yes

Question: Will the Symantec Multi-tier Protection for MAC be able to utilize the Parent Servers for Windows?
Answer: No. MAC has its own console as it stands today.

Question: Asking about the console. Will there still be a seperate console server for Macs?
Answer: Yes

Question: So there won’t be a Mac solution if we’re a SEPM customer?
Answer: MAC is included in the Multi-Tier Protection but it is managed by a seperate console and server structure

Question: What is the upgrade from SAVCE
Answer: Symantec Endpoint Protection 11.0

Question: is the full endpoint suite required, or can you still purchase products separately?
Answer: You get everything as long as you are current on maintenance.

Question: Assuming no more console?
Answer: MAC will be managed by its own console. SEPM will manage all windows clients

Question: Can you turn off various components?
Answer: Yes, you can enable and disable the features as needed.

Question: Will it have built in reporting capabilities or do we need to continue with SAV reporter?
Answer: SEPM has reporting built in.

Question: Will the SEP v11 console be able to managed legacy clients (SAV10, etc)
Answer: No. It will not manage legacy SAV clients

Question: Will this all still be in a single agent?
Answer: Yes, Single Client with all the mentioned technologies

Question: Will these products be Vista logo’d or just Vista compliant? Also will you be providing both 32bit and 64bit clients?
Answer: Yes, we will be providing both 32 and 64 bit versions of the client. Vista compliant.

Question: What? We will need to run multiple consoles? Will they all feed into SSIM?
Answer: SEPM will manage the windows clients only with this release. Yes, we will have a collector for SSIM

Question: Will we go over migrating an existing Reporting Server to the built-in reporting in SEPM?
Answer: There is a white paper that will be available as well as a migration wizard

Question: would this be red if I disabled it from management side?
Answer: Yes

Question: does the user need admin rights to execute a FIX
Answer: The fix can be run as system by the client

Question: Are there different levels of users provided in the SEPM?
Answer: Yes, administrators can have different functions and rights as configured. There is limited administration.

Question: Will the 64-bit client differ by processor type, or will the 64-bit client be universal?
Answer: Universal

Question: Current installation from CD presents you an option to choose the management server if you want to install managed. Why has that been removed?
Answer: You can create packages that are “unmanaged” still it is just a different process.

Question: can it be locked so a cleint can’t remove from a server?
Answer: Yes

Question: In previous versions, we could specify management server. This is not possible

now?
Answer: Yes. It still is possible to specify the server that will manage the client.

Question: Will the client upgrade handle all current individual components that may be installed on the desktop (SSEP, SAV10, etc.)?
Answer: Yes, absolutely

Question: Does the new policy import/export replace the usage of GRC.dat and the need to at times manually implement it.
Answer: Yes. Sylink.xml is the new file used.

Question: Will the SPEM have the ability to set security access for other users/groups to manage their servers or sites?
Answer: Yes

Question: So the sylink.xml replaces the grc.dat except it doesnt disappear once processed by the client?
Answer: Yes, exactly

Question: When will this release be available?
Answer: End of the month

Question: can you import SNORT signaturs?
Answer: No, we support REGEX and have a language similiar to snort

Question: Is there a maximum network latency value between a policy sevrer andf end client that we should consider when determine the count and location of policy servers on our global network?
Answer: We will have a scalability document for distro

Question: Does the current license also include the signature subscription for IDS?
Answer: Yes

Question: Has the port range for communication between SErvers and Clients decreased? Or will it still range from 1024-4999?
Answer: It will be SSL

Question: Will this presentation be available for download so we can share with upper management?
Answer: Via email

Question: Does the client upgrade require a reboot from version 10.x
Answer: to start the firewall but not for AV protection

Question: We currently install the SAVCE client on Windows Server OS managed by a Parent server. Which product is recommended for Windows Server OS or which components are recommeded to be disabled on Server OS?
Answer: SEP can be run on servers and clients. All technologies are portable

Question: is the management console still MMC based?
Answer: No

Question: Is there a reporting server for this similar to the SAV 10 reporting server?
Answer: No, it is integrated now.

Question: When will training be available for SEP 11?
Answer: At release

Question: will we be able to customize the white list
Answer: Yes

Question: Does Behavior blocking handle rogue keyloggers?
Answer: Yes

Question: Will the new console be able to communicate with “legacy’ SSEP agents (or, can we upgrade the SSEP-PM without requiring the SSEP agents to upgrade at the same time)?
Answer: It will support legacy SSEP clients but not SAV.

Question: so just 443 and 80
Answer: Exactly!

Question: Can specific applications be “black listed”?
Answer: Yes

Question: what are the functionality differences between Sym Endpoint Protection and Sym Multi-tier Protection?
Answer: Same technologies SMP includes email protection and MAC/linux

Question: will the clients listen on a port for server initiated communication, or is the communication only initiated by the client?
Answer: no client listen port. Client initiates all communication to the server

Question: Will SEP require SQL?
Answer: You can use SQL but the embedded (included) DB is Sybase

Question: Will mobile devices be supported? If so, what devices?
Answer: Seperate product

Question: Will the Q&A be made available after the call?
Answer: Yes

Question: any chance of getting a copy all the slides to review after the meeting?
Answer: Yes

Question: Is there an estimate available of the resource impact on a host machines due to the proactive threat scanning?
Answer: We will have this documented and available in a whitepaper
Question: Will SMS5 – Symantec Mobile Security Suite 5 integrate into SEP?
Answer: No.

Question: Do the antivirus capabilities within SEP 11 use less resources on a typical client and server? We have many problems with SAV 10 chewing up too much memory and CPU utilization, especially on virtual servers.
Answer: Yes, lower memory footprint

Question: Is there an override for the USB blocking?
Answer: Yes

Question: Can devices be blocked based on Manufacturer / Model?
Answer: No- windows class ID, not vendor class ID…..coming in the future though

Question: can usb thumb drives be blocked but other usb devices, ie scanner, printer be allowed?
Answer: Absolutely!

Question: is patch/maintenance release management going to be simplified over previous versions? (i.e. all inclusive rollups not requiring previous upgrades to a base version)?
Answer: Definitely

Question: so SMP includes the sygate firewall technology?
Answer: Yes!

Question: A new version of packager come with this – I am aware its unsupported but if new version does come with it will it be supported? If not any idea when?
Answer: Packager is gone. The packaging mechanism is the Sygate technology

Question: Will the schema be available for the database, so we can query it?
Answer: Definitely!!!

Question: Will SMSDOM (Mail Security for Domino) Still be supported as well as Premium Anti-Spam? How about for Exchange?
Answer: Yes

Question: Are the INTEL portions from previous NAV/SAV versions been eliminated altogether?
Answer: Yep

Question: Are the policies for the client available to be pushed via Group Policy in AD?
Answer: Yes

Question: can you restrict file types allowed to write to USB drives? i.e. allow MP3, but not DOC or XLS?
Answer: Yes.
Question: Can the Class ID blocking be managed by OUs, say the Director level can use usb drives, regular sales cannot?
Answer: Yes, using grouping

Question: Can individual components – say, the firewall portion – be disabled selectively? For example, we may want AV on a server but not necessarily firewall (even more specifically, for performance savings?).
Answer: YES!

Question: What version of java?
Answer: Local version

Question: how much space is required for the sql ie per machine?
Answer: DB size will vary by client count

Question: Does this version get away from storing client information in the registry?
Answer: Yep

Question: Can the management server be installed on VM?
Answer: Yep!

Question: Did he say the client port is 80?
Answer: Or 443 depending on selection by administrator

Question: is a certificate server required?
Answer: no

Question: In the current version of SAV10 Reporting, there is a vulnerability of the PHP component. Will SEPv11 provide better response to layered components that have known vulnerabilities?
Answer: Absolutely!

Question: the client/server traffic is based on port 80/443 correct? How is that going to affect clients running websites using port 80/443?
Answer: There should not be a conflict but the ports are configurable

Question: from the remediation aspect, will SAFE mode be required for a 100% detection and cleaning?
Answer: Depends on the threat. SEP 11 will clean better than SAV 10 though

Question: For replication what type of nbandwidth does it use over a WAN?
Answer: All documented in the scalability doc

Question: Since the client information is no longer in the registry how can we check AV status through scripts? Is there a WMI interface?
Answer: Some status can still be checked via the registry
Question: Since this is running on 80 or 443 is it using some type of web server underneath for communication (e.g. Tomcat/Apache/etc.)?
Answer: on the manager yes. There is a tomcat server and IIS

Question: We have encountered issues with the volume of network traffic generated by corrupted defs. How does the 11.x version address this issue?
Answer: corrupt defs should be a thing of the past.

Question: are there any JRE versions that are not supported or are recommended for the management console? Will the client itself require JRE to be installed for SEP to work?
Answer: CLient does not require JRE. The version installed is a local version specific to SEPM.

Question: will registry still use intel\landesk\virusprotect6 structure?
Answer: Nope. All intel technologies for management are gone and the registry has been changed as far as structure

Question: How can we obtain the scalability document?
Answer: It will be posted at release

Question: has sepm been certified for vm
Answer: We support VM environments. Not sure if it is certified by VM

Question: Why is this not backwards capable with SAV 10 or 9? Upgrading an entire enterprise can take a while.
Answer: Completely different management architecture.

Question: is there a method for users to alter administrative scan schedule (but not any other option)?
Answer: Yes

Question: what about Sygate 4.1?
Answer: no

Question: Will you be able to save all the old data from the SAV 10.1?
Answer: yes, migration wizard will cover this

Question: no over intall for 7.x is that correct
Answer: right

Question: OVerinstall of 10.2 for Vista supported?
Answer: yes

Question: he said that scalability doc will be available about a month after SEP 11.0 release
Answer: probably sooner
Question: when you overinstall does this require a reboot on the endpoint
Answer: Yes, but not for AV, just for the FW

Question: Will the overinstall work even if the previous client is password protected? Or will it still require a registry hack to remove?
Answer: It will work

Question: can SAV10 client groups be migrated, or is there granularity to support that type of group?
Answer: Migration wizard will allow this

Question: Does SEP support NT4.0 clients?
Answer: no
Question: does it work on vm . Currently version 10 I have on vm
Answer: Yes

Question: Is the upgrade to SAV 11 more reliable than the upgrade to SAV 10? We were forced to use NONAV to pre-clean the SAV 8 and SAV 9 systems before going to SAV 10
Answer: Yes.

Question: What is the SEPM blog URL?
Answer: https://forums.symantec.com/syment?category.id=endpoint

Question: Is the installer follow standard MSI best practices?
Answer: Yes

Question: will management server install require reboot (windows server 2003)?
Answer: no

Question: This includes central management and reporting for the FW?
Answer: Yes

Question: Any problems creating an SMS package for installing to clients?
Answer: no

Question: to install over 4.1 do you need to uninstall 4.1, reboot and install SEP or can you uninstall 4.1, install SEP and reboot?
Answer: Yes

Question: Can our TAM answer questions regarding SEP 11 yet? Or do we have to wait until the release?
Answer: Yes

Question: We run Symantec Mail Security for Exchange. If we run SEPv11 on the same box, are the defs compatible? Can they co-exist?
Answer: They can co-exist

Question: you mentioned earlier that the client initiates all contact with the server. What about Virus sweeps, updates that you want to push, do you have to wait til the next time the client checks in
Answer: No

Question: does the patch require a reboot? We have lots a 24×7 servers.
Answer: no

Question: Will the dif patch require reboots on the clients?
Answer: no

Question: No problem to run in a mixed environment, e.g. legacy clients reporting to previous management console, newer clients reporting to newer management console?
Answer: no problem with a parallel environment

Question: We are going to have a lot of language requirements (Thai, German, French, Russian, Swedish, Japannesse, Chinesse). Is there a link on your web page to the supported language versions?
Answer: It will be posted but is not right now. Should be at release time. We are localizing alot of languages

Question: For definition distribution, what is the approx size of the diff-defs? If a client has been off the network for a week or longer, what is the approx size of the diff-def?
Answer: will vary

Question: Thanks for the GUP!!
Answer:

Question: If a client goes to a GUP and then that client goes to another group will it still look for the GUP group A
Answer: no

Question: With ver9 and > Symantec expanded the feature set to combat spyware and malware, many customers complained of CE being bloated, memory-intensive, and causing issues with many line-of-business applications. With all these added features in this new product release can you point to any documentation related to this version benchmarks and/or performance specs compared to previous releases?
Answer: Its all documented. Check the portal

Question: will rapid release definitions be available for the Liveupdate server?
Answer: yes with LUA 2.5

Question: Not sure if this was asked. But when a client connects to a 11.0 server does it use a certificate like in the past for communications?
Answer: no

Question: Can the gups be configured as Primary, secondary, and can the clients recognize that
Answer: no

Question: when will this be available for download from the platinum site?
Answer: end of the month

Question: Thank You
Answer: You are welcome

FBI Gets Conviction in Computer Hacking??? Case

Excerpt:

“The evidence produced at trial showed that he deleted patient data of clients of the North County Health Services Clinic. The data was stored at the place he was working at the time, the Council of Community Health Clinics (”CCC”), which is located in San Diego, California. His actions resulted in financial losses to his employer, the North County Health Services Clinic, and other clinics as well. He also caused the patients to suffer loss of care.”

Fom reading the full article the term hacking should not be used in the context used. Since he worked there as an IT person it seemed it gained unauthorized access to certain databases- which would would be more of a computer tampering charge. Possible a charge because accessing personal client data could be added in.

Since he worked there as an IT person – computer trespass or any hacking charge could be blowing this out of proportion. I’m not defending the guy or saying that he did nothing wrong – just a very poor use of the term “hacking”.