Friday, August 10, 2007

Some thoughts on Security software

In the small network I run I have 3 servers and about 35 workstations, and several remote users. I use the F-Secure Small Business Suite to keep it safe currently. I have been using F-Secure on our network since 2004. I had read many reviews of it which had been mainly positive. When you install it the first thing you will notice is many programs running in the background on your computer. If you aren't running a fairly powerful computer with plenty of RAM you will notice a major performance hit. I recently uninstalled it on a workstation and noticed after reboot I had gained about 120MB of free RAM. That's a pretty substantial hit to the resources of a computer without enough RAM installed. This brings me to some thoughts on security software in general. All users need security software (anti-virus, anti-spyware, and firewall) installed, the main question is one between finding the best protection and finding the software that does not make your computer feel unusable. F-Secure is a highly rated piece of software and rightly deserves it's rating. It uses multiple scanning engines of which Kaspersky is one. That is why when you read reviews you will find them close together. But using those multiple engines gives quite a hit to the resources. I also believe in layering your security software so if one layer misses another can kick in and find the problem before it causes any problems. F-Secure covers the basics with a anti-virus, anti-spyware, firewall and the newly added anti-rootkit protection. Also when running the Suite you get HIPS (host intrusion protection system) which is another layer of protection. All of this works fairly well, but many of the workstations I have to support are not running full P4's but Celeron P4's with minimal RAM (512MB). On those machines they go from quite usable to very slow. Anyway, sorry to keep going on but now to the point. There has to be a balance in the protection, and that is what I am considering. I am going to be testing CounterSpy Enterprise in the coming weeks. This will have it's VB100 rating by the time I am ready to purchase. I have already done some testing on files F-Secure flagged and sure enough CounterSpy also found the same files (testing done via VirusTotal which uses CounterSpy as one of it's scanning engines). They totally redid their code base last year and early this year and it shows. They built it to serve both functions and soon it officially will. I find it amazing that Sunbelt software could do this, but I think it's just the sort of thing the anti-malware market needs. From everything I have read Sunbelt is quite responsive to all their customers needs; something that has been sorely lacking in the anti-malware market. I find many of the bigger companies are very slow to respond to customer problems with their software; I am hoping as I take the plunge with Sunbelt software this will be a thing of the past. As I start the testing of CounterSpy Enterprise I will share my findings here. That's it for now.