SEP 12.1 Shared Insight Cache without internet connection

Created: 15 Nov 2012 | Updated: 16 Nov 2012 | 2 comments

symantec_va_se Symantec Employee

I have a customer with 80% of clients that are on VMware in Classified environment without internet connection.

For all the obvious reasons, using VIE along with SIC would be ideal, but how do you all (especially in DoD/Intel area) leverage SIC if there are no internet connection?

Any feedback on this will be much appreciated!

Discussion Filed Under:

Security, Endpoint Protection (AntiVirus) - 12.x, Endpoint Protection (AntiVirus), Best Practice, Case Study, Configuring, Documentation, Installing, Integration, Monitoring, Tip/How to, Virtualization

Login or register to post comments
Comments RSS Feed

Comments 2 Comments • Jump to latest comment

hdablin

SEP 12.1 Shared Insight Cache without internet connection - Comment:20 Dec 2012 : Link

What is the issue exactly? As far as I know, SIC is an internal Insight cache, it doesn't require internet connection at all.

It gathers the information about what files has been scanned and shares this info with other SEPs. So, for instance, you have PC1 and PC2. Both of them are running SEPs. So, let assume, that some file, "file_runner.exe", is on both PCs.

If SEP on PC1 have checked the file, than PC2 does not need to do the same job. Because the SEP from PC1 had reported status of "file_runner.exe" to SIC server and the SEP on PC2 can use this info: it can inquire the checking results from the SIC instead of performing actual check.

So, as you can see, the Internet connection is not involved into the process.

Please, look at these threads:

https://www-secure.symantec.com/connect/forums/sep-121-insight-cache-server-working

https://www-secure.symantec.com/connect/forums/vietool-versus-shared-insight-cache-server

Please, sorry for my poor English. It's not my native language.