Security Response recommendations for Symantec Endpoint Protection settings
Updated: 19 Aug 2010 | 11 comments
Hello everyone,
I believe this will help answer many questions our users have regarding their configuration/settings.
Best,
Eric
discussion Filed Under:
Comments
The document talks about
The document talks about screenshots. Umm, where are they?
Screen shots
Security Response recommends the following Scan Settings
Prachand Kumar MCSE-2003 Symantec Technical Specialist (SCTS)
Screen shots
Security Response recommends the following setting changes to Truscan for best protection
Prachand Kumar MCSE-2003 Symantec Technical Specialist (SCTS)
Thanks. I made all these
Thanks.
I made all these changes except for the network scan. Now let's see how many fake av programs SEP lets through.
*crossing fingers*
If you are looking for
If you are looking for blocking Fake Av's then you should use ShadowPapa's application control policy.
https://www-secure.symantec.com/connect/articles/how-use-sep-protect-against-rogue-browser-helpers
VMWARE-- SEP 12.1 vs McAfee vs Trend Micro
Prachand: while I appreciate
Prachand: while I appreciate the write-up and screenies, I am left to wonder, have you guys tested these settings? In our lab, TruScan in its default configuration caused such performance drawbacks, we actually had to turn it off altogether. Bloodhound detection set to maximum will result in huge number of false positives.
yes , the settings had been
yes , the settings had been tested before putting it for the customer. As far has performance and false postive is concerned ,it would happen at an extent , as with High Security comes a bit of over head.
Prachand Kumar MCSE-2003 Symantec Technical Specialist (SCTS)
Hi, i have perform a demo
Hi,
i have perform a demo about Security recommendations. so any one guid me and give me security recommendation regardin symantec endpoint protection
According to the table at
According to the table at http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010020308592948, each and every Auto-Protect action taken for security risks should be Quarantine/Delete. Is this correct? Is anybody else doing ALL of this?
On machines that our admins
On machines that our admins use, I put Hack Tools and Remote Access as quarantine and then leave alone, since I don't want to accidently delete a usuful utility, which sometimes is used for evil as well. But on high security systems, I leave the delete action as secondary.
Eric C. Lukens IT Security Policy and Risk Assessment Analyst University of Northern Iowa
You should be able to set
You should be able to set centralized exceptions for the specific tools rather than a blanket leave alone statement
Symantec Technical Support Engineer, SEP, SAV for Linux<
Would you like to reply?
Login or Register to post your comment.