I’ve just finished a guide to Microsoft’s Forefront Client Secuity 2007. It’s based on the current public beta release.
No one can reasonably argue against the need to deploy anti virus software. It’s been common practice for many years. Recently, the need for a solution to other forms of malware, i.e. spyware, has become apparent. Leading vendors introduced solutions that worked, and in some cases, worked very well indeed.
But recently, we’ve seen things change. The need for anti malware solutions has not abated. Far from it, there’s a bigger need than ever. Unfortunately we’ve seen some of the major players in the anti malware market lose sight of what they should be doing. Instead of giving us a reliable anti malware solution with simple deployment, reliable updates and dependable reporting they’ve decided to give us frequently changing all-in-one security solutions. They end up being unreliable and hence insecure, too complex to configure and in some cases buggy to the point where agents on computers no longer function correctly.
I’ve recently had the *ahem* pleasure of working with the latest version of the product from the largest player in the anti malware market. Their product used to be seen as a market leader but it soon became clear to me that in the case of this Synful product, the cure was worse than the disease. Unfortunately, my experience was not unique. On chat forums I noticed that many were in agreement with my findings. Many others were also unhappy with their experiences with a McScanner from another vendor.
In 2003, Microsoft purchased a Romanian anti-virus company called GeCAD. Microsoft also purchased an anti spyware company called Giant in 2004. Soon afterwards we saw the beta release of a standalone antivirus product that would eventually become known as Defender. But there was no word about an anti virus solution for quite some time. Some bits of information were released or leaked out. We heard there would be a corporate solution. It would be controlled via group policy. Updates would be deployed via WSUS.
Defender was released as a standalone product as a free download for XP and as an included feature with Vista. Our first glimpse of the Microsoft anti spyware engine was in Microsoft Antigen 8.0 in the summer of 2006 which was quickly updated to Forefront Security for Exchange. Then we saw the beta release of the home security solution called OneCare which included anti spyware and antivirus defences. Obviously, given the time that had passed since the initial purchase in 2003, Microsoft had been doing some serious development and engineering.
Finally, in the end of 2006 at IT Forum in Barcelona, we saw the first public beta release of Forefront Client Security (FCS). FCS would be the corporate solution from Microsoft for defending Microsoft networks against malware threats.
With much fanfare, Microsoft representatives proudly presented their product. I watched webcasts and read updates. I quickly signed up for the beta and read documentation. It was pretty clear to me that Microsoft had listened to the market and heard what people wanted from an anti malware solution. I kept hearing the same messages for Microsoft about FCS, over and over again:
- It was simple. There is no need to have more than one dialog box to define agent policy.
- It reused available technologies we are familiar with. It uses group policy to distribute agent policy and WSUS to approve and distribute updates.
- It is reliable. There is no need for an anti malware solution to be a firewall, an intrusion detection system, a kettle, a kitchen sink, etc.
- It produces timely and accurate status information in simple and accessible ways.
It all sounds amazing. It sounds perfect. But is it all too good to be true? The rest of this document will be spent looking at the product. I’ll be looking at the below while giving my opinions:
- System requirements.
- Architecting the solution.
- Deploying the solution.
- Usage of the solution.
For the purposes of this document I have been using the latest public build of FCS (beta 2) on Windows 2003 R2 with Windows XP SP2 in a VMware environment. I have also downloaded and installed the pre-requisites, including WSUS (2.0)
The document continues …