Security Overview | Symantec Connect Community

Security Community

When Web Servers Serve Evil

Candid Wueest Symantec Employee

In the last few months, we have witnessed a rise in the number of cases of modified Web servers that inject malicious redirections into every website that it hosts. One example was the malicious Apache module (Linux.Chapro and Trojan.Apmod) that we blogged about recently. A newer example is Linux....

Posted: 13 May 2013 | 0 comments
What you need to know to migrate from 1024-bit to 2048-bit encryption

Andy Horbury Symantec Employee

I hope by now that you are aware that the Certificate Authority/Browser Forum has mandated that Certificate Authorities stop supporting 1024-bit key length RSA certificates for both SSL and code signing by the end of this year (2013). To learn more about these changes please read the CA/Browser...

Posted: 10 May 2013 | 0 comments
Desktop as a Service (DaaS) with VMware and Symantec

Mithun Sanghavi Technical Support Symantec Employee Accredited

Hello, CIOs are under increasing pressure to reduce desktop and application management costs while providing seamless and secure access to corporate resources across an array of user devices. They also realize that increased regulatory requirements coupled with a rising trend of sophisticated...

Posted: 08 May 2013 | 1 comment
Symantec Messaging Gateway 10.5 for Service Providers Pre-release Evalution

wib3rd Symantec Employee

On June 25th, 2013 Symantec will be launching the pre-release evaluation of Symantec Messaging Gateway 10.5 for Service Providers. This new version of Symantec Messaging Gateway for Service Providers (Software Edition) plans to introduce new features including. Name change from Symantec...

Posted: 06 May 2013 | 1 comment
How does your server security stack up? We want to hear from you!

Neelum Symantec Employee

According to the 2013 Verizon Breach Report data breaches affect organizations of all sizes, across all sectors with 92 percent of them attributable to outsiders and 14 percent committed by insiders. What are your top security concerns? We want to hear from you! Answer 7 questions...

Posted: 01 May 2013 | 0 comments

article comment 9 min ago

AjinBabu commented on: Deploy the SEP Client for Mac

Thums UP!!

article comment 10 min ago

AjinBabu commented on: Unmanaged Detector in SEP 12.1

Nice One Pete

discussion comment 11 min ago

Mehmood commented on: Manually create multiple internal users

Dear Ben, When the clients enrol the keys are automatically created by the Universal server. All I needed was, when a perticular client/clients is/are enroled, they directly report to the group intended, instead of the "everyone" group. If you have different Dictionaries with lists of different users, then you can add the dictionatries in the group you want before client ...

discussion comment 11 min ago

AjinBabu commented on: Top 20 Technotes for SEP 12.x - April 2012

Thanks for Posting.

discussion comment 12 min ago

SMLatCST commented on: SED requiring Administrator password on MAC Installs

I think you may have more luck if you try reposting in the below forums, as it sounds like you're asking about the rebranded PGP WDE product: https://www-secure.symantec.com/connect/security/forums/pgp-wde-mac

discussion comment 16 min ago

kintachi commented on: SEP Replication failed to submit

Still failed to submit. Done on changing heap size. Also raised a case to symantec support, and handled by advanced team.

idea comment 20 min ago

John Santana commented on: Change SEP virus Defination location

Exactly yes, me too, sometimes when the server runs out of C: drive, I delete the older two SEP definitions directory out of three available.

discussion comment 26 min ago

AjinBabu commented on: Rebuild index for local host

Hi, Rebuild Indexes To improve the connection time between the database and Symantec Endpoint Protection Manager, the management server rebuilds the database index at a scheduled time. You can perform this task manually at any time by clicking Run. It is running on DB Side. Regards Ajin

updated discussion 28 min ago

AjinBabu posted: Network Card Blocked- How to applying a policy offline

Hi All, Good Day to All...... We are using SEP 12.1 RU1 MP 1 on Win 2k8 Ent R2 Server in our environment, and recently we have applied a policy to block network cards on a Orphan machines unfortunately some of our test machines are on the same machine is on the same group, and there is a Application control policy also which will terminate all the process. Currently client is not ...

updated discussion 28 min ago

AjinBabu posted: Network Card Blocked- How to applying a policy offline

discussion comment 11 min ago

Mehmood commented on: Manually create multiple internal users

discussion comment 11 min ago

AjinBabu commented on: Top 20 Technotes for SEP 12.x - April 2012

Thanks for Posting.

discussion comment 12 min ago

SMLatCST commented on: SED requiring Administrator password on MAC Installs

discussion comment 16 min ago

kintachi commented on: SEP Replication failed to submit

Still failed to submit. Done on changing heap size. Also raised a case to symantec support, and handled by advanced team.

discussion comment 26 min ago

AjinBabu commented on: Rebuild index for local host

updated discussion 28 min ago

AjinBabu posted: Network Card Blocked- How to applying a policy offline

discussion comment 58 min ago

roman.levkin commented on: Trying to run Network Threat report, and it times out

Well, report works with new account. But is it possible to remove built-in original account then?

discussion comment 1 hour 1 min ago

Rafeeq commented on: SEP rolls back install

Hi, This should fix the issue. Simillar error try this I raised a ticket with Symantec and together we solved the problem. The first step was to examine the file C:\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.XXXX\Data\Install\Logs\SIS_INST.LOG Where identified the following event: 2013-05-13T18:59:47.741Z INFO I ...

discussion comment 1 hour 3 min ago

sven_frank commented on: PGP Universal server 3.2.1 DO's and dont's

Hi Nagaraj, for this cases you have 3 Options (all configurable via policy) WDRT (Whole Disk Recovery Token) Admin Passphrase Admin Token (ADK if specified) ==> This is not WDE Specific! Recarding ADK I would really think about it if you need it because this is a option once turned on is hard to get it really out again. All others are updable via Policy ...

discussion comment 1 hour 3 min ago

sven_frank commented on: PGP Universal server 3.2.1 DO's and dont's

article comment 9 min ago

AjinBabu commented on: Deploy the SEP Client for Mac

Thums UP!!

article comment 10 min ago

AjinBabu commented on: Unmanaged Detector in SEP 12.1

Nice One Pete

article comment 4 hours 57 min ago

John Santana commented on: Upgrade clients to SEP 12.1 by Auto upgrade feature

That could be the policy that is enforced to avoid user to disable the AV.

article comment 16 hours 14 min ago

yang_zhang commented on: Install PGP Cluster Server - Graphical Steps

Did you ever tried to run the replication manually?

article comment 22 hours 23 min ago

Anne victor commented on: Aspect-Oriented Programming and Security

Thanks for sharing complete details about AOP.I am really happy to know about it.Its a new thing to gain my knowledge . php training

article comment 22 May 2013

John Santana commented on: SAV for Linux Scanning Best Practices: A (Somewhat) Illustrated Guide

lol, did you wrote that article Mick :-)

article comment 22 May 2013

John Santana commented on: Endpoint SWAT: Utilities

Exactly is, I am curious to know it as well.

article comment 22 May 2013

John Santana commented on: Using SEPM Alerts and Reports to Combat a Malware Outbreak

Wow this is cool, thanks Mick !

updated article 21 May 2013

yang_zhang posted: Indexing remote SharePoint documents using WebDAV

With Symantec Data Loss Prevention version 11.x, you can index documents stored on a remote SharePoint server using WebDAV. WebDAV (Web-based Distributed Authoring and Versioning) is a standard that provides extensions to the HTTP 1.1 protocol, allowing users to collaboratively edit and manage files on remote Web servers. Microsoft IIS deployments that host SharePoint instances can be enabled ...

updated article 21 May 2013

yang_zhang posted: Indexing remote SharePoint documents using WebDAV

updated blog entry 1 hour 7 min ago

Candid Wueest posted: 電子メールがセキュリティの要である理由

電子メールアカウントを支配できれば、相当に大きな力を手に入れられるのではないでしょうか。他人に私的な電子メールを読まれたからといって気にしない人もいるかもしれませんが、電子メールを読まれることだけが問題なのではありません。もちろん、ハッキングしたアカウントの電子メールを嗅ぎ回って、秘密を明らかにするような攻撃はこれまでもたくさんありました。嫉妬深い配偶者が浮気の証拠を探しているとか、もっとシリアスなケースとしては産業スパイが重要な取引に関する情報を追い求めているとか、攻撃の理由はさまざまです。あるいは、ハッキングしたアカウントを利用して持ち主になりすまし、アカウントに登録されている連絡先にソーシャルエンジニアリングメッセージを送るといった攻撃もあるでしょう。現在、電子メールアカウントは単に電子メールを送受信するためだけのものではありません。Microsoft 社や Google ...

new blog entry 1 hour 39 min ago

Mathew Maniyara posted: Phishers’ New Fake Social Media Apps

Phishers are trying everything they can to improve their chances of harvesting user credentials. They are known for experimenting with different fake social media applications in a desperate move to lure users. Recently, we found a few examples of some new fake apps. In the first example, the phishing site used an image of a girl along with the Facebook Like button. After clicking the button, ...

updated blog entry 3 hours 31 min ago

Anand Muralidharan posted: Spammers Targeting Oklahoma Tornado Victims

Natural disasters, like tornadoes and earthquakes, are quite common in the United States of America. Unfortunately, the Oklahoma City suburb of Moore experienced a violent tornado on Monday, May 20, that sadly resulted in dozens of casualties. Spammers take advantage of natural disasters with luring scams and Symantec Security Response has started to observe spam messages related to this ...

updated blog entry 9 hours 35 min ago

Belinda Charleson posted: It's National Cyber Security Awareness Week - here are a few tips

It’s time to stop and take a moment to consider cyber security, says the Australian Government. Once a year, the government gets together in partnerships with industry, the community, and consumer organisations to help make people aware of basic steps they can and should do to protect their personal and financial information. This year’s theme on their Website is “Our Shared ...

updated blog entry 14 hours 45 min ago

Michael D Smith posted: Using iGoat to Explore Mobile Application Security Weaknesses

iGoat v2.0 (https://www.owasp.org/index.php/OWASP_iGoat_Project) is a program that demonstrates common iOS mobile application security weaknesses and their remediation. There are other resources that show the use of this tool. One example, https://www.owasp.org/index.php/Mobile_Top_10_2012-M1, is the OWASP Top 10 entry for Insecure Data Storage (which is the exercise we are going to ...

blog entry comment 20 hours 9 min ago

liezelgordoncielo commented on: The Password Problem: A Call for Stronger Authentication

Passwords can simply could be hacked by someone who is highly professional in attacking other system. Problem you will not able to access your own account. One thing i know is that do not use passwords that are just so simple and readable. ---------------------------------------- SIMS 3 Seasons Crack

new blog entry 22 hours 51 min ago

AnneDelarue posted: Les solutions Symantec de gestion des risques en environnement virtualisé.

Symantec™ Control Compliance Suite Standards Manager Une solution leader de l'industrie d’audit de configuration conçue pour évaluer si les systèmes sont sécurisés, configurés et patchés selon les normes. Control Compliance Suite vous permet de communiquer les risques informatiques dans des termes pertinents pour ...

new blog entry 22 hours 55 min ago

AnneDelarue posted: Les solutions Symantec de protection dans les environnements virtuels

Quels enjeux face l’explosion des environnements virtualisés Les économies incontestables, l’efficacité de la virtualisation et l’explosion du cloud transforment les services informatiques de l’entreprise. Les serveurs virtuels et les environnements de cloud computing représentent des défis pour la sécurité et la ...

updated blog entry 21 May 2013

Masato Hayashi posted: SSLサーバ証明書の2048bitへの移行について

2013年末までに1024ビットの鍵長のSSLサーバ証明書とコードサイン証明書の発行を停止するよう CA/ブラウザフォーラムが認証局に指示をしていることはすでにご存じと思います。さらに詳細な変更に関してはCA/ブラウザフォーラムの資料「パブリック証明書の発行および管理に関する基本要件v.1.1」にあるのでご確認ください。何をすべきか? 今年(2013年)に証明書が失効する顧客は、2048ビット以上の鍵長でCertificate Signing Request (CSR)生成する必要があります(ベリサインストアフロントでは、2012年9月28日(金)をもって1024ビットのCSRの受付を終了しています)。すべての1024ビット鍵長のSSLサーバ証明書は2014年にすべての業界で廃止されます。これはアメリカ合衆国の国立標準技術研究所 ...

updated blog entry 21 May 2013

Masato Hayashi posted: SSLサーバ証明書の2048bitへの移行について

download comment 4 hours 54 min ago

John Santana commented on: Latest "Tolly Certified" Test Reports for Symantec Endpoint Protection 12.1

Thanks for sharing this report Mithun !

download comment 15 hours 33 min ago

Brian81 commented on: The Sylinkreplacer tool for connecting SEP clients to a SEPM

use sylinkreplacer 12.1

download comment 16 hours 1 min ago

dimago commented on: SEP Content Distribution Monitor (for GUP health-checking)

Yes, perfect I got it. I have an user without privileges than can run sep manager...it is ok, but this tool he can not run... Is there any permission to change to allow it? My user is admin and it goes fine!!!

download comment 18 May 2013

Elisha commented on: Shrink the Symantec Endpoint Protection Manager 12.1 embedded database

The tool is looking for a table called "mt". However this table is not needed and the tool will to run fine once you click "Continue" on this error. You can safely ignore the "Table 'mt' not found" error message.

download comment 16 May 2013

John Santana commented on: Symantec Endpoint Protection 12.1 vs McAfee and Trend Micro

Many thanks Ambesh !

download comment 16 May 2013

John Santana commented on: Symantec Endpoint Protection 12.1 vs. Trend Micro Deep Security 8 Anti-virus Performance in VMware ESXi Virtual Environments for 07 May 2012

Thanks Mithun.

download comment 15 May 2013

John Santana commented on: Symantec Network Access Control Whitepapers

Thanks man !

download comment 14 May 2013

Elisha commented on: Generate LiveUpdate Policies that have many GUP Subnets

GUP mapping type comes up as subnet when using the tool, you are saying it doesn't matter if it's subnet or IP address as mapping type if the goal is to use the IP address? There is a subtle difference between using an IP address and using a subnet. The key difference is that if you use the IP address option then the clients will only try to go to that one GUP and not other ...

updated download 08 May 2013

Mithun Sanghavi posted: Symantec Endpoint Protection.cloud

Hello, Symantec Endpoint Protection.cloud is a part of Symantec.cloud Designed specifically for SMB businesses Centrally managed security for desktops, laptops and file servers Automatic system security updates Simplified management - no dedicated IT staff or hardware needed The demands on IT managers at small and medium size business are diverse and ever-growing. Trying to stay current ...

updated download 08 May 2013

Mithun Sanghavi posted: Symantec Endpoint Protection.cloud

new event 22 May 2013

Kari Ann posted: Webcast: Moving Beyond Antivirus: From Reactive to Proactive Endpoint Protection

Register Here Moving Beyond Antivirus: From Reactive to Proactive Endpoint Protection Speakers: Piero DePaoli, Director of Core Security Product Marketing Kari Ann Sewell, Endpoint Protection Product Marketing Manager Summary: Antivirus only stopped 49% of malware in 2012. Is your data safe against the malware tools being deployed by cyber-criminals? Today’s malware authors ...

updated event 21 May 2013

Jon Eyre posted: Canceled: Twin Cities Security & Compliance User Group and Capture the Flag Challenge

The Twin Cities Security & Compliance User Group and Capture the Flag Challenge has been canceled. We will work to reschedule at a later date. Sorry for any inconvenience. Please reach out to me if you have any questions. Thanks! Jon Eyre User Group Program Manager 801-995-7695

event comment 17 May 2013

Jon Eyre commented on: Chicago Security & Compliance User Group

FYI - There is a bug in the autogenerated calendar appointment. The correct time should be 12-3 p.m. CDT. We are working to fix. Sorry for the confusion.

new event 17 May 2013

Jon Eyre posted: Toronto Security & Compliance User Group Meeting - June 20

Please join us for the next Toronto Security & Compliance User Group meeting on June 20 from 9:30 a.m. to 1 p.m. at the Symantec offices. The meeting will feature a presentation on mobile security by Symantec Systems Engineer Jon Baker and a presentation on Symantec Data Loss Prevention by Symantec Principal Technical Specialist Myles Huffman. Lunch will be served! Agenda Welcome & ...

new event 15 May 2013

Jon Eyre posted: South Florida Security & Compliance User Group Meeting - June 12

Please join us for the next South Florida Security & Compliance User Group meeting on June 12 from 10 a.m. to 2 p.m. at K1 Speed Fort Lauderdale. The meeting will feature a presentation on DDoS trends and what you can do to mitigate attacks by Henry Hernandez from Fishnet Security and a presentation on PGP & Mobile Encryption by Symantec Systems Engineer Doug Felteau. Come for the ...

event comment 15 May 2013

Jon Eyre commented on: Pittsburgh Security & Compliance User Group Meeting - June 20

Due to a conflict with the VMUG, we have moved the Pittsburgh Security & Compliance meeting to June 20. Please reach out to me if you have any questions. Sorry for any inconvenience.

updated event 15 May 2013

Quoc T. posted: Symantec DLP Technical Advisory Board - Detection Improvements

As an integral part of the Symantec DLP Structured Customer Engagement Model, we are pleased to invite you to join us for our next installment of the DLP Technical Advisory Board (TAB). The Structured Customer Engagement Model consists of high impact events (both remote and face-to-face) that are scheduled throughout the calendar year to obtain your feedback on features/functions, ...

event comment 08 May 2013

cfreebourne commented on: Washington, DC Security & Compliance User Group Meeting - May 8

Attending

new event 08 May 2013

Philip Routley posted: Mobile Asia Expo 2013

Mobile is connecting the world in a dramatic and breath-taking fashion. It bridges generations, builds communities, ignites ideas and tears down the barriers which separate us. Mobile Asia Expo will accelerate this effect by showcasing the mobile trends and solutions that will transform our lives today and tomorrow. Join us in Connecting the Future! Mobile Asia Expo 2013 will include: A ...

new event 08 May 2013

Philip Routley posted: Mobile Asia Expo 2013

video comment 21 May 2013

Chetan Savade commented on: Symantec Endpoint Protection Manager 12.1 Fresh Install - Embedded Database

Hi, You can find helpful info at SSIM forum: https://www-secure.symantec.com/connect/security/forums/symantec-security-information-manager I do apologie I am not much familiar with SSIM.

video comment 15 May 2013

MaRRuT@CC commented on: SEP Content Distribution Monitor - Introduction

can you provide the HI Policy for download Graham? Is this only a Registry Entry check for the GUP functionality?

updated video 15 May 2013

Alex_CST posted: File Integrity Monitoring in a real-life scenario

This video demonstrates the usage of FIM in a non-compliance scenario.

updated video 30 Apr 2013

Aniket Amdekar posted: Group Update Providers- Part 2

This is the second video in the 2 video series for Group Update Providers. You can find the first video using the link below: https://www-secure.symantec.com/connect/videos/gro... In this video, the enhancements in Group Update Providers in the latest version RU5 are discussed. Video Length: 34:28

updated video 30 Apr 2013

DeepSight Team posted: DeepSight Early Warning Services Portal: Building Technology Lists

This is lesson 2 of the Symantec DeepSight Early Warning Services portal course. This course includes a total of seven lessons, click on a link below to access the remaining lessons. Please fill out a course evaluation once you have completed this training. Contact Symantec Technical Support at 800-342-0652 if you have a technical issue. For non-technical issues, such as ...

updated video 30 Apr 2013

DeepSight Team posted: DeepSight Early Warning Services Portal: Leveraging Alerts and Research

This is lesson 4 of the Symantec DeepSight Early Warning Services portal course. This course includes a total of seven lessons, click on a link below to access the remaining lessons. Please fill out a course evaluation once you have completed this training. Contact Symantec Technical Support at 800-342-0652 if you have a technical issue. For non-technical issues, such as ...

updated video 30 Apr 2013

DeepSight Team posted: DeepSight Early Warning Services: Creating Alerts

This is lesson 3 of the Symantec DeepSight Early Warning Services portal course. This course includes a total of seven lessons, click on a link below to access the remaining lessons. Please fill out a course evaluation once you have completed this training. Contact Symantec Technical Support at 800-342-0652 if you have a technical issue. For non-technical issues, such as ...

updated video 30 Apr 2013

DeepSight Team posted: DeepSight Early Warning Services: Utilizing DataFeeds

This is lesson 5 of the Symantec DeepSight Early Warning Services portal course. This course includes a total of seven lessons, click on a link below to access the remaining lessons. Please fill out a course evaluation once you have completed this training. Contact Symantec Technical Support at 800-342-0652 if you have a technical issue. For non-technical issues, such as ...

updated video 30 Apr 2013

DeepSight Team posted: DeepSight Early Warning Services: Customizing Reports

This is lesson 6 of the Symantec DeepSight Early Warning Services portal course. This course includes a total of seven lessons: Lesson 1: DeepSight Early Warning Services Overview - Discuss the variety of intelligence the portal provides - Set up your account and familiarize yourself with the portal - Review the analyst journals - Determine who to contact if you have a ...

updated video 30 Apr 2013

DeepSight Team posted: DeepSight Early Warning Services: Customizing Reports

idea comment 20 min ago

John Santana commented on: Change SEP virus Defination location

Exactly yes, me too, sometimes when the server runs out of C: drive, I delete the older two SEP definitions directory out of three available.

idea comment 2 hours 5 min ago

virus012 commented on: FileConnect latest changes

Agree with Shulk.

idea comment 4 hours 50 min ago

John Santana commented on: Add feature to SEPM/console to ping off-line clients

that sounds like a great Idea !

idea comment 12 hours 48 min ago

sep_tx commented on: Add more robust SEPM user account management

Have seen several submissions for AD integration of admin accoutns/roles. While I am not against this. I would like to see real role based admin groups in general. If I want to add 3 new admins I have to go through each one and set all the same settings. If I had the option of predefined roles within SEPM, I could define the nitty gritty once and simply add a new admins ...

idea comment 22 May 2013

LeighT commented on: Improving Scanning Scheduling for Symantec Endpoint Protection Manager

I agree with the Monthly scan to be able to schedule the specific day not just the 1st day of the month as this could fall on a different day every month and may be on a day that is not suitable. That said I think the scanning in SEP 12.1 is greatly improved though since SEP 11 due to the trusted cache it builds up from the initial scan. once the first scan has run which would take the ...

updated idea 21 May 2013

Georjack posted: Disable Antivirus Auto-Protect Until pc is connected to the internet

Hello, For a while i use Disable Antivirus Auto-Protect Feature, But when I activate this feature I disconnect my PC from the internet. In the list of options here are: 15 minutes, 1 hour, 5 hours, Until system restart, Permanently I suggest you to add a new option: Until pc is connected to the internet Why? Because many times, I connected the computer to the internet and forgot to activate ...

idea comment 21 May 2013

Wright1968 commented on: Show all log-types entires for a client in one list or report

Can I do a +10? This would be a HUGE timesaver. I am always struggling to find which log will contain the information I want. There are too many logs and too much ambiguity about what to expect in each log.

new idea 21 May 2013

macejh posted: SEP Intrusion Protection

My company would like to run the Intrusion Protection product on server operating systems but want to run it in Log Only mode so that it doesn’t actively block any traffic. Our plan was to log all threats and then take blocking measures, only after the threat was validated by our company's staff. We want to be extremely careful with our highly available server ...

new idea 21 May 2013

sep_tx posted: SymHelp and SEP database integration

It would be nice to see a scan action entry in the SEP database each time SymHelp is used. SymHelp is aware of installed components as indicated in the left vertical menu. Is it posisble to add a call or API that would record the execution of the SymHelp into one or more of the associated installed programs. SEP currently records different scan actions based on user initiated, ...

new idea 21 May 2013

sep_tx posted: SymHelp and SEP database integration