Endpoint Protection

Hi

I've been reviewing the new features of SEP 12.1 and one of the most interesting features to me is the Shared Insight Cache.  My question is why is this feature targetted at VDI environments and not all environments?  Wouldn't this feature be just as useful in a physical environment (especially if I used the same image on all my clients)?

Is it the amount of generated LAN traffic that makes this unsuitable for physical environments?

 

Thanks

Robert

This came up at Vision this year and Symantec is looking into how they can leverage insight cache and other new technologies in the physical environment for future releases.

this wasa coming quickly in an MR this fall, but not quite sure it is true

The Shared Insight Cache works with physical systems today, and its fully supported.  The product is designed to reduce scan loads on virtual systems, since that is generally where the most performance gains can be made. 

In addition, bandwidth is less of an issue with virtual systems, because its generally local to the host or datacenter.  For physical systems, its potentially much more of an issue.  Each full scan will use something in the region of 25-40MB of bandwidth - if you put your clients on a slow link from your SIC server, its going to be very slow.

I submitted the following as an Idea a few days ago:

https://www-secure.symantec.com/connect/ideas/shared-insight-cache-physical-environments

In a nutshell, can we leverage the GUP logic so that SEP Clients will automagically pick a SIC in their LAN if one exists, so that SICs can be implemented in physical environments while also trying to minimise the bandwidth usage?

EDIT: Please vote for the idea if you think it'll be handy!

We can't leverage that functionality at the moment, but its something we are looking at for the future.

Thanks Paul, thats what I was looking for.

I agree with the above poster that this functionality would be useful if it could be integrated in to a GUP.

Would you say integrated into a client (like the GUP), or keep it a seperate component, but have it managed through the SEPM and be able to find it in a similar way to the GUP?

...ideally, I'd like to see it integrated into the SEP Client and fully manageable from the SEPM Console.

As the SEP client is also able to asses memory usage, it would be useful if the SEPM could notify administrators if a SEP-as-SIC was low on memory.

great！！