Endpoint Protection

 View Only
Expand all | Collapse all

Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

  • 1.  Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 18, 2012 06:55 AM

    Hi All,

    I just need a comparison between 12. 1 and 12.1 RU2.

    In which ways 12.1 RU2 is more secured than 12.1 RU1 MP1.

     



  • 2.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 18, 2012 07:00 AM

    hi,

    Check this artical

    https://www-secure.symantec.com/connect/articles/whats-new-sep-121-ru2

    Edit

    Check also 

     

     

    New fixes and enhancements in Symantec Endpoint Protection 12.1 Release Update 2

    Article:TECH199676  |  Created: 2012-11-13  |  Updated: 2012-11-14  |  Article URL http://www.symantec.com/docs/TECH199676
     

     



  • 3.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Trusted Advisor
    Posted Dec 18, 2012 07:03 AM

    Also SEP12 RU2 is the only current version that works with windows 8 and windows server 2012



  • 4.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 18, 2012 07:13 AM

    There is no change in security, just a few added features

    What's new in Symantec Endpoint Protection 12.1.2

    https://www.symantec.com/business/support/index?page=content&id=HOWTO81091



  • 5.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Broadcom Employee
    Posted Dec 18, 2012 07:54 AM

    Hi,

    If we talk about security then Early Launch Anti-Malware Driver tab is newly added.

    Early Launch Anti-Malware Driver:

    Early launch anti-malware (ELAM) protects client computers from threats that load at startup. Symantec Endpoint Protection includes an early launch anti-malware driver that works with the Microsoft early launch anti-malware driver to provide the protection. The settings are supported on Microsoft Windows 8.

    The early launch anti-malware driver is a special type of driver that initializes first and inspects other startup drivers for malicious code. When the Symantec Endpoint Protection driver detects a startup driver, it determines whether the driver is good, bad, or unknown. The Symantec Endpoint Protection driver then passes the information to Windows to decide to allow or block the detected driver.The Symantec Endpoint Protection settings provide an option to treat bad drivers and bad critical drivers as unknown. Bad critical drivers are the drivers that are identified as malware but are required for computer startup. By default, Windows allows unknown drivers to load. You might want to select the override option if you get any false positive detections that block an important driver. If you block an important driver, you might prevent client computers from starting up.

    The Windows early launch anti-malware driver must be enabled for the Symantec Endpoint Protection settings to take effect. You use the Windows Group Policy editor to view and modify the Windows ELAM settings. See your Windows 8 documentation for more information.

    Check this artical

    https://www-secure.symantec.com/connect/articles/w...



  • 6.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Trusted Advisor
    Posted Dec 18, 2012 09:35 AM

    Hello,

    SEP 12.1 RU1 MP1 is an older version whereas SEP 12.1 RU2 is the Latest Release Update of SEP 12.1

    To brief you a bit on difference about older and Latest versions of SEP 12.1, 

    The Latest Version of SEP 12.1.1101.401 (RU1 MP1) has - 

    1. Over 800 product fixes 
    2. Third Party Removal 
    3. Remote Monitoring and Management (RMM) Support 
    4. Release of the Symantec Endpoint Protection Management Plug-in 1.5 for Kaseya 
    5. System Change Detection Exceptions 
    6. Changes to Tamper Protection alerts and logging 
    7. Trialware package size reduction 
    8. Support for SQL Server 2012 
    9. STAR updates 
    10. Security updates 

     

    Reference:

    https://www-secure.symantec.com/connect/articles/latest-symantec-endpoint-protection-releases-sep-121-ru1-mp1-and-sep-110-ru7-mp2

     

    Here are the Product Highlights for SEP 12.1 RU2:

    1) Extended Platform support

    • Mac OS X Mountain Lion (10.8)
    • Windows 8
    • Windows Server 2012

    2) Virtualization – Shared Insight Cache for VMware vShield

    3) Improved Protection

    • Improved STAR protection technologies
    • Windows 8 ELAM support
    • Windows 8 App remediation

    4) Extended Management

    • Web Services for 3rd party integration (i.e. RMM)
    • SEP Management Plugin for Kaseya 2.0
    • GUP roaming support for multiple subnets
    • Remote Sylink drop support from the SEP Manager
    • Expanded 3rd party security software removal – 130 products from 30 vendors

    Reference:

    https://www-secure.symantec.com/connect/articles/latest-symantec-endpoint-protection-releases-sep-121-ru2-and-sep-110-ru7-mp3

     

    Hope that helps!!



  • 7.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 19, 2012 01:22 AM


    Hi Mithun,

    Could you please explain or give a brief for the below point numbers.

    Point No:5,6,9.

    Hi Chetan,

    Thanks for your views.

    Could you please explain about Download protection under windows setting.

     



  • 8.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Broadcom Employee
    Posted Dec 19, 2012 01:31 AM

    System Change Detection Exceptions 

    This behavior happens when the SEP client Virus and Spyware Protection policy has been modified to log hosts file changes detected by SONAR. hosts file change detections are logged as an error in the System Event Log.

     

    Changes to Tamper Protection alerts and logging 

    ease to change configuration with alerts and logging.

    STAR updates

    Within Symantec, Security Technology and Response (STAR) oversees the research and development efforts for all of our malware security technologies. These form the core protection capabilities of Symantec’s corporate and consumer security products.

    Check the implementation guide



  • 9.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 19, 2012 01:56 AM

    Hi Chetan,

    It would be more understanble for me if you give some example and little brief about Early Launch Anti-Malware Drivers.

    How it would be heplful in evironment?



  • 10.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Broadcom Employee
    Posted Dec 19, 2012 02:06 AM

    this is feature of windows 8. are you using this OS in your environment.

    Early Launch Anti-Malware Driver:

    Early launch anti-malware (ELAM) protects client computers from threats that load at startup. Symantec Endpoint Protection includes an early launch anti-malware driver that works with the Microsoft early launch anti-malware driver to provide the protection. The settings are supported on Microsoft Windows 8.

    The early launch anti-malware driver is a special type of driver that initializes first and inspects other startup drivers for malicious code. When the Symantec Endpoint Protection driver detects a startup driver, it determines whether the driver is good, bad, or unknown. The Symantec Endpoint Protection driver then passes the information to Windows to decide to allow or block the detected driver.The Symantec Endpoint Protection settings provide an option to treat bad drivers and bad critical drivers as unknown. Bad critical drivers are the drivers that are identified as malware but are required for computer startup. By default, Windows allows unknown drivers to load. You might want to select the override option if you get any false positive detections that block an important driver. If you block an important driver, you might prevent client computers from starting up.

    The Windows early launch anti-malware driver must be enabled for the Symantec Endpoint Protection settings to take effect. You use the Windows Group Policy editor to view and modify the Windows ELAM settings. See your Windows 8 documentation for more information



  • 11.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 19, 2012 04:32 AM

    Hmmm definitely would requre to test ELAM in VM environment.... no Win 8 yet here...

     

    So ELAM 'definition' basically comes from normal AV/AS definition or from the internet?

    (or other component)

     

     

    Thanks



  • 12.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 20, 2012 05:52 AM

    Hi pete,

    Yes we are using windows 8 in our environment.



  • 13.  RE: Comparison Between SEP 12.1RU1 MP1 with 12. RU 2

    Posted Dec 20, 2012 05:29 PM

    You can check the Release Notes for details on 12.1.2, including the info provided in the What's New HOWTO doc included above, but the PDF format may be easier to look at. The Release Notes PDF also has details on known issues and workarounds too.

    sandra