Fast and Effective Endpoint
Security for Business 2012
Comparative Analysis
August 2012

Document: Fast and Effective Endpoint Security for Business – Comparative Analysis
Authors:
M. Baquiran, D. Wren
Company: PassMark Software
Date:
22 August 2012
Edition:1
File:
Fast and Effective Endpoint Security for Business 2012 - Ed1.docx

Fast and Effective Endpoint Security for Business

PassMark Software

Table of Contents
TABLE OF CONTENTS......................................................................................................................................... 2
REVISION HISTORY............................................................................................................................................ 3
REFERENCES...................................................................................................................................................... 3
INTRODUCTION ................................................................................................................................................ 4
RATINGS AND SUMMARY ................................................................................................................................. 5
RATING CATEGORIES ................................................................................................................................................ 6
STAR RATING DESCRIPTION ....................................................................................................................................... 6TASK DESCRIPTION ........................................................................................................................................... 7
HARDWARE ENVIRONMENTS...................................................................................................................................... 7
PRODUCTS AND VERSIONS TESTED .............................................................................................................................. 8PERFORMANCE BENCHMARK RESULTS ............................................................................................................. 9
ESET ENDPOINT SECURITY .............................................................................................................................. 15
KASPERSKY ENDPOINT SECURITY .................................................................................................................... 18
MCAFEE TOTAL PROTECTION FOR ENDPOINT ................................................................................................. 21
SOPHOS ENDPOINT PROTECTION 10 ............................................................................................................... 27
SYMANTEC ENDPOINT PROTECTION 12.1 ....................................................................................................... 30
TREND MICRO OFFICESCAN 10.6 ..................................................................................................................... 33
DISCLAIMER AND DISCLOSURE ....................................................................................................................... 36
DISCLAIMER OF LIABILITY......................................................................................................................................... 36
DISCLOSURE ......................................................................................................................................................... 36
TRADEMARKS........................................................................................................................................................ 36
CONTACT DETAILS .......................................................................................................................................... 36
APPENDIX A – PERFORMANCE METHODOLOGY .............................................................................................. 37

Comparative Analysis
Edition 1

Page 2 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Revision History
Rev
Edition 1

Revision History

DateFirst edition of the document.
Performance charts and comparative reviews added.

6 August 2012

References
Ref #Document

AuthorDate

AV Comparatives

22 Dec 2011

AV Comparatives

10 April 2012

AV Comparatives

15 Nov 2011

Virus Bulletin

18 Jul 2012

Nico Cuppen Software-

AV Comparatives - Summary Report 2011
Current Edition: December 20111

The information in the most recent version of this report by
AV Comparatives was used to determine the effectiveness ofreviewed business security solutions.
AV Comparatives - On-Demand Comparatives
Current Edition: March 2012, Last Revision: 10 April 20122

The information from the most recent version of this reportby AV Comparatives was used to determine the effectivenessof reviewed business security solutions.
AV Comparatives – Retrospective/ProActive Test
Current Edition: Aug 2011, Last Revision: 15 November 2011

3

Information from Retrospective/ProActive Test reports by AV
Comparatives was used in determining the effectiveness ofreviewed business security solutions.
VB100 Test Results

4

Overall test results obtained by VB100 were used indetermining the effectiveness of reviewed business security
solutions.

5

A tool used to monitor the amount of inbound and outboundnetwork traffic for the Update Size metric.

Network Traffic Monitor v2.01

Comparative Analysis
Edition 1

Page 3 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Introduction
Endpoint protection is no longer an optional security measure for businesses. In this technology driven age,every business is now susceptible to the damages caused by malware (ranging from productivity loss toconfidential and financial data theft), and endpoints have become the most vulnerable and targeted point of
attack.
While there have been improvements in network security in recent years through better adoption andunderstanding of firewalls and intrusion prevention, endpoints have become particularly prone to security
breaches. This is largely due to the fact that they have become more exposed -- not only are people working
increasingly from laptops outside of the office, but the prevalence of web-based applications (in the form of Web2.0) have brought about a greater level of interaction with external websites than ever before. As such, theendpoint has become the weakest link in an enterprises' overall security strategy, and a successful attack at theendpoint may not only reveal the data stored there but also provide the key to gain unauthorized access to therest of the network.
There are a large number of solutions available from vendors, and the challenge for businesses is to now
determine which security solution is the most effective at mitigating the threat of malware, while minimizing
implementation cost and impact to existing business functions and workflow.
This report presents a comparative analysis on the performance, effectiveness and usability of seven security
solutions from some of the world's most respected security vendors. In this report, PassMark Software evaluatedthe following business security products:








ESET Endpoint Security
Kaspersky Endpoint Security
McAfee Total Protection for Endpoint
Microsoft System Center 2012 Endpoint Protection
Symantec Endpoint Protection 12.1
Sophos Endpoint Protection 10.0
Trend Micro OfficeScan 10.6

Comparative Analysis
Edition 1

Page 4 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Ratings and Summary
Passmark Software has given each security product a rating which reflects its overall performance, ease of use, design, features and level of excellence in that category.
Categories represent major functions or feature sets common to the sphere of business security. These ratings represent PassMark Software’s subjective views andexperiences in installing, configuring and use of business security products to manage endpoints.
The following table summarizes ratings in all categories for all products evaluated:
ESET

Kaspersky

McAfeeMicrosoft

SophosSymantec

Trend Micro

Overall Rating
Installation & Configuration
Migration
Policy Defaults & Policy Management
Client Installation
Interface Design
Client & Remote Management
Updates
Effectiveness
Performance

Comparative Analysis
Edition 1

Page 5 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Rating Categories
The table below describes the criteria and factors which were considered for each business security solution ineach category to determine a rating. Evaluation categories were determined prior to testing and were chosen as
a set of expected features or functions which define business security products.
Category
Overall Rating
Installation & Configuration

Category Description
The rating for this category is calculated as an average of all other ratings, with all categories carrying
equal weight.
This category evaluates the speed and relative ease of the installation and configuration process of server
components, including the quality and accuracy of documentation, the ability to install pre-requisites andthe level of installer integration.

Migration

This category rates the relative ease and simplicity of product migration from previous vendor solutionsor third-party software solutions. Extra consideration is given to vendors who have documented themigration process well.

Default Policies & Policy
Management

This category considers whether the policies created by default during product installation ‘make sense’
from a management perspective, taking into account whether different default choices are available. It
also covers ease of use, flexibility and granularity of policy management.

Client Installation

This category evaluates the simplicity and ease of client installation, taking into account the speed of
deployment and the level of impact of installation on endpoint users.

Interface Design

This category rates the design of the server console’s user interface for responsiveness, intuitiveness,consistency and functionality.

Client Management &Remote Management

This category assesses the flexibility and functionality of client management from the server console,taking into account the level of automation in executing tasks, report viewing, organization and creationof groups, the depth of configuration options available to administrators, and the level of support
provided for administrators to access the management console from a remote terminal.

UpdatesThis category rates the level of configuration required to enable the management server to update acentral repository, as well as the ease of deployment to and the timeliness of retrieval by endpoint
machines.

EffectivenessThis category rates the anti-malware effectiveness of a security product based on information fromrecently published material at reputable, third-party testing sites. The sources we have used for thiscategory are VB100 and AV Comparatives.

PerformanceThis category assigns an overall rating based on a security product’s performance over seventeen
performance benchmark tests conducted by PassMark Software.

Star Rating Description
The table below explains the general significance of ratings relative to product performance, usability andfunctionality.
Star Rating--

Rating Description
Unsupported – This category was not supported by the business security solution. Support was not documented in
product guides, the online knowledgebase or help files.
Very Poor – The security solution offered very limited performance in this category. Products with this rating hadsparse or inaccurate documentation, extremely poor usability, or technical issues which severely hampered
product stability, usability and functionality.
Poor – The security solution had inadequate or basic performance in this category, as a result of poor usability orfunctionality. Some products with this rating had bugs which hampered product performance in this category.
Average – The security solution had adequate performance in this category with some room for improvement.
Good – The security solution provides good performance in this category area with useful features and good
documentation.
Exceptional – The security solution provides outstanding performance in a category area, with unique, thoughtful
or well-designed features that streamline usability or functionality and excellent documentation.

Comparative Analysis
Edition 1

Page 6 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Task Description
PassMark Software has conducted performance benchmark testing and subjective comparative analysis on theoverall ease of use, speed and effectiveness on seven (7) business security software products.

Hardware Environments
The following hardware platforms were used in conducting our comparative analysis and performance tests, andare intended to represent a typical server and business deployment:

Server Machine Specification
The following machine ran a virtual machine in which the server components of the security software
were installed:
Operating System:
CPU:
Motherboard:
RAM:
HDD:

Windows 7 x64
AMD Phenom II x4 940 (Quad Core)
Gigabyte GA-MA790XT-UD4P
4 x 4GB PC3-10600 1333MHz DDR3 Memory (16GB in total)
Western Digital Caviar Green WD10EADS 1TB Serial ATA-II

Virtual Machine Specification
Operating System:
RAM:

Windows Server 2008 R2 64-bit (for Daily Network Traffic test)
Windows Server 2003 R2 SP2 32-bit (for all other performance tests)
1-2 GB (depending on the product’s requirements)

Client Machine Specification
Operating System:
CPU:
Video Card:
RAM:
HDD:

Comparative Analysis
Edition 1

Windows 7 Ultimate x64
Intel Core i7 920 @ 2.67GHz
nVidia GeForce 8800 GT
6 GB
500 GB

Page 7 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Products and Versions Tested
Product Name

Server Component and Version

Client Component and Version

Remote Administrator:
ESET Endpoint Security

v5.0.119.0

ESET Endpoint Security:

ERA Maintenance Tool:

v5.0.2122.1

v5.0.119.0
Kaspersky Endpoint Security

Kaspersky Security Center:

Kaspersky Endpoint Security:v9.2.69v8.1.0.646
VirusScan Enterprise + AntiSpyware
Enterprise:v8.8

McAfee Total Protection
for Endpoint

ePolicy Orchestrator:
v4.6.0

SIteAdvisor Enterprise Plus:
v3.0.0
Host Intrusion Prevention:
v8.0.0Microsoft System Center 2012
Endpoint Protection

Microsoft System Center 2012:

Symantec Endpoint
Protection

Endpoint Protection Manager:
v12.1.1000.157 RU1Symantec Endpoint Protection:

Sophos Enterprise Console:

Sophos Endpoint Security and Control:

v5.1.0.1839

v10.0

Trend Micro OfficeScan Server:

Trend Micro OfficeScan client:v10.6 Build 1062v10.6.1062

2.2.903.0

Antimalware Client 3.0.8410.0

v12.1.1000.157 RU1Sophos Endpoint Protection Advanced
EditionNote: All performance metrics except for
Daily Network Traffic were tested on theEnterprise Edition. Since this version is nolonger supported by Sophos, the remainderof the review was conducted on the
Advanced Edition.

Trend Micro OfficeScan 10.6

Comparative Analysis
Edition 1

Page 8 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Performance Benchmark Results
The following performance categories have been selected as ‘real-life’ metrics which may impact heavily on
endpoint system performance and responsiveness. These benchmarks allow the comparison of the level ofimpact that business security software products may have on endpoint machines. Products with good
performance will have less impact on business activities, workflow and productivity.
A more detailed description of the methodology used can be found in Appendix A – Performance Methodology.

Client Install Size
Protect endpoints without filling up disk space
Newer versions of products often have increased disk
space requirements, ensuring disk space remains criticalfor endpoint systems. Endpoint clients with a larger
installation footprint may be consuming more disk spacethan necessary.
This metric measures the total additional disk spaceconsumed by the endpoint client after installation and amanual update. Our final result is measured in megabytes(MB).

Trend Micro

141.01

Microsoft

175.83

Sophos364.96

ESET

379.42Average445.89McAfee476.39Symantec

608.62

Kaspersky
0 MB

975.01200 MB 400 MB 600 MB 800 MB 1,000 MB1,200 MB

Client Memory usage During System Idle
Have more system resources to perform tasks
Extensive memory (or physical RAM) usage by security
products have significant impact on endpoint system
performance and cause more reliance on hard disk drives,
which have slower read and write speeds than RAM.
Business security products which use more memory willvisibly slow performance on affected endpoints.
This metric measures the total additional memory usage
by the endpoint machine during a period of system idle
where an endpoint security product has been installed. Our
final result is measured in megabytes (MB), and calculated
from an average of forty (40) samples.

ESET

118.65Kaspersky

193.41

Average

210.43

Trend Micro

213.99Microsoft

221.63

McAfee229.65

Sophos231.18

Symantec
0 MB

Comparative Analysis
Edition 1

264.4950 MB

100 MB 150 MB 200 MB 250 MB 300 MB

Page 9 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

On Access Scan Time
Perform everyday tasks fasterOn Access scanners are constantly monitoring a system forsuspicious behavior. They are activated any time a
program interacts with resources in memory or over the
network. The performance of frequently carried out tasks
can be impacted significantly by the overhead required toscan these tasks.
This metric measures the total additional time taken tobrowse a set of websites and open and close a set of MS
Office documents, where an endpoint security product has
been installed. Our final result is measured in seconds (s),and calculated from an average of five (5) samples.

Trend Micro

6.16

Symantec

7.23

ESET

9.10

McAfee11.78

Microsoft

12.60

Kaspersky

24.69

Average

26.49

Sophos113.87

0s

20 s

40 s

60 s

80 s

100 s

120 s

Memory Usage During On Access Scan
Have more system resources when performing everydaytasks
As above, On Access scanners can affect a systems
performance during everyday tasks. Products with On
Access scanners that use more memory may affect asystems ability to multitask and slow down memory
intensive operations.
This metric measures the additional memory usage during
the running of a script that automatically browses theinternet, and open and close a set of MS Office documents,
where an endpoint security product has been installed.

Microsoft

118.22

McAfee183.26

ESET

190.77

Trend Micro

217.38Average

225.53

Sophos249.13Kaspersky

284.66

Symantec

335.310 MB

File copy time for small files

100 MB

200 MB

McAfee48.89

Symantec

49.12

ESET

49.60

Kaspersky

49.67

300 MB

400 MB

Copy your documents more quickly
Transferring files between devices and drives is a common
activity undertaken by endpoint users. File copy times may
be negatively affected by poor performance of businesssecurity products functionality, such as file scanning or
heuristics.
This metric measures the total time taken to copy a set ofsmall files between directories, where an endpoint security
product has been installed. Our final result is measured inseconds (s), and calculated from an average of five (5)samples.

Average

56.83

Microsoft

57.95

Sophos

61.56

Trend Micro

81.01

0s

Comparative Analysis
Edition 1

20 s

40 s

60 s

80 s

100 s

Page 10 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

File copy time for large files

PassMark Software

Sophos

121.57

Copy your media files more quickly
Copying large files between directories may similarly beaffected by poor performance of anti-malware
functionality in business security products.
This metric measures the total time taken to copy a set oflarge files between directories, where an endpoint security
product has been installed. Our final result is measured inseconds (s), and calculated from an average of five (5)samples. Our final result is measured in megabytes (MB),and calculated from an average of forty (40) samples takenover a period of 2 minutes.

Symantec

122.23

McAfee123.75Microsoft

124.77

Average

125.17

Trend Micro

127.75

ESET

127.97

Kaspersky

128.15118 s

Boot Time

120 s

122 s

124 s

Microsoft

126 s

128 s

130 s

28.59

Spend less time waiting for your computer to start
Many business software suites create start up tasks andprocesses, causing machine boot times to take significantly
longer. End users can do little but wait for their machine tobecome responsive. Better performing products will haveless of an impact on boot time.
This metric measures the time taken to boot the machine
where an endpoint security product has been installed. Our
final result is measured in seconds (s) and calculated froman average of five (5) samples.

McAfee

31.12

ESET

31.88

Sophos

32.65

Average

33.76

Kaspersky

35.84

Trend Micro

37.66

Symantec

38.60

0s

Machine restart time

10 s

20 s

30 s

Trend Micro

79.60

ESET

83.20

Microsoft

84.00

McAfee84.00

Sophos

87.20

40 s

50 s

Reduce the time needed to restart your computer
Extra system resources consumed by processes andservices created by security software may delay shut downtime and the restart cycle of endpoint machines.
This metric measures the time taken to restart the machine
where an endpoint security product has been installed. Our
final result is measured in seconds (s) and calculated froman average of five (5) samples.

Symantec

91.40

Average

91.54

Kaspersky

131.400sComparative Analysis
Edition 1

20 s

40 s

60 s

80 s

100 s

120 s

140 s

Page 11 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

File Copy, Move, & Delete

PassMark Software

McAfee22.09

Copy, move, and delete files more quickly
Security products need to monitor system activity every
time a file is moved, copied, or deleted. The time required
to carry out these tasks can be greatly increased by poorly
performing security products.
This metric measures the total time taken to copy, moveand delete a set of files of various formats between
directories, where an endpoint security product has been
installed. Our final result is measured in seconds (s) andcalculated from an average of five (5) samples.

Symantec

24.57

ESET

24.61

Kaspersky

24.80

Microsoft

31.26

Average

31.44

Sophos36.18

Trend Micro

56.55

0s

Network Throughput

10 s

20 s

Microsoft

9.87

McAfee

10.17

30 s

40 s

50 s

60 s

Quickly download and transfer files across the network
Files are often transferred, accessed, and downloaded
across networks, but not without inspection from installed
security software. Download speeds can be significantly
decreased by poorly performing security products.
This metric measures the total time taken to download asample set of binary files from another location in the
network. Our final result is measuredin seconds (s) andcalculated as an average of five (5) samples.

Trend Micro

10.95

Sophos

11.36

Average

14.57

ESET

15.90

Symantec

15.93

Kaspersky

27.84

0s

Full System Scan

ESET

5s

10 s

15 s

20 s

25 s

30 s

36

Quickly determine the health of your system
Running a full system on-demand scan on an endpoint isnecessary in order to thoroughly check hard drives andrunning programs for security threats. Ideally, it isperformed on endpoints periodically (e.g. once per week)
and is typically a rather lengthy task. Products with poorly
performing scanning algorithms can inconveniently andunnecessarily increase the scan time.
This metric measures the total time taken to run a fullsystem scan on an endpoint. The scan is carried out three(3) times. Our final result was taken as an average of boththe initial scan time and the average subsequent scantime.

Symantec
Kaspersky

59
66

Average79

Trend Micro82

McAfeeSophosMicrosoft

88
94
125

0 min 20 min 40 min 60 min 80 min 100 min 120 min 140 min

Comparative Analysis
Edition 1

Page 12 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Memory Usage during Full System Scan
Reduce memory usage when carrying out a full system
scan
Full system scans can be resource demanding and long induration, thus memory usage should be minimized so that
other tasks and processes may still function without
system performance being slowed significantly.
This metric measures the additional memory usage during
the running of full system scan on an endpoint. Our final
result is measured in megabytes (MB) of data, and is taken
as an average of forty (40) samples taken over 40 minutes.

PassMark Software

ESET

239.60Trend Micro

311.21

Microsoft

330.51

Average345.02

Kaspersky

351.11

Sophos371.09Symantec

391.05

McAfee420.590 MB

Daily network traffic

100 MB

ESET

0.40

Microsoft

5.31

Kaspersky

8.84

200 MB

300 MB

400 MB500 MB

Minimize impact on the corporate network
All security solutions require the latest signatures andengine updates in order to provide managed networks thebest possible protection against malware. However, not all
security software is equal, with some products performing
incremental updates and others downloading much more.
This metric measures the total daily inbound and outboundtraffic as a result of security software engine and signature
updates to the repository on the server machine. Our final
result is measured in megabytes (MB) and is calculated as
an average of fifteen (15) days of data.

Symantec

25.57

Average

32.73

McAfee47.69

Sophos

57.16

Trend Micro

84.18

0 MB

Management Server Installation Size

20 MB

ESET

0.35

McAfee1.09

Kaspersky

2.20

40 MB

60 MB

80 MB

100 MB

Reduce server disk usage on your management server
Ensuring the health and performance of the management
server machine is essential for properly maintaining andmonitoring dependent endpoint systems. Management
server software disk space usage should be minimized inorder to allow room for database collections and logging,important updates such as virus signature definitions, aswell as other programs and files required by the server.
This metric measures the total additional disk spaceconsumed by the management server software (including
the management console) after installation and a manual
update. Our final result is measured in gigabytes (GB).

Trend Micro

3.27

Sophos

3.77

Average

4.94

Symantec

9.14

Microsoft
0 GB

Comparative Analysis
Edition 1

14.78

2 GB

4 GB

6 GB

8 GB 10 GB 12 GB 14 GB 16 GB

Page 13 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Server Memory Usage during System Idle
Have more system resources for your server to maintainand monitor endpoints
Extensive memory (or physical RAM) usage bymanagement servers during idle can have significant
impact on the security of dependent endpoints. Servers
need to have enough resources available for receiving andresponding to virus alerts, carrying out scheduled tasks, aswell as monitoring and maintaining the health of
endpoints across the network.
This metric measures the total additional memory usage
by the server machine during a period of system idle wherean endpoint security server product has been installed. Our
final result is measured in megabytes (MB) and calculated
from an average of forty (40) samples.
Note: Microsoft System Centre was omitted from this comparison
as it did not support the test environment.

Server Memory Usage During On
Demand Scan
Scan on your entire system faster
Running an on-demand scan on endpoints via the server isfrequently performed in order to check for security threatsin hard drives and programs across the network.
Management Servers that require more resources per
endpoint will not be capable of handling as many
endpoints and may require additional servers to help
handle the load.
This metric measures the total additional memory usage
by the server when carrying out an on demand scan on an
endpoint. Our final result is measured in megabytes (MB)and calculated from an average of forty (40) samples.
Note: Microsoft System Centre was omitted from this comparison
as it did not support the test environment.

Comparative Analysis
Edition 1

PassMark Software

ESET

6.67

Kaspersky

164.99Sophos318.17

Average344.51

McAfee440.64

Symantec

509.42

Trend Micro

627.160 MB

ESET
Kaspersky
Average

100 MB 200 MB 300 MB 400 MB 500 MB 600 MB 700 MB

22.05

327.84446.97

Sophos516.42

McAfee532.39Symantec
Trend Micro

569.30713.840 MB 100 MB 200 MB 300 MB 400 MB 500 MB 600 MB 700 MB 800 MB

Page 14 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

ESET Endpoint
Security

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation
Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance Pros Very little system impact on endpoint andserver machines (fastest, best overall
performance)
 Initial Setup and configuration took only a
few minutes
 Low traffic overhead for updates
 Policy , client, and role Management is
flexible and granular Organized and efficient interface design
 Cons Update repository is not setup automatically Web interface serves as a dashboard only

Comparative Analysis
Edition 1

PassMark Software

Installation and Configuration

4.5/5

Installing ESET Remote Administrator Server andConsole was an extremely quick and easy process.
The setup of ESET Remote Administrator (ERA)
installs two separate components, the ERA Server(ERAS) and Console (ERAC). Quite impressively, thesetup of both took us only a few minutes in total tocomplete. The installation wizard requires little
input from the user, and all necessary components
are automatically installed, including the built-in
Microsoft Access database. Password setup, updateparameters and other security options can be set
post installation, and no additional configuration orrestart is required to launch the console.
For testing, we installed ERAC to the same servermachine as ERAS, so that the console connected tothe server automatically. Otherwise, the console
can be conveniently installed to a different
machine, for e.g. the administrator’s PC, in whichcase it is required to enter the ERA Server name or
IP address during advanced setup of the console.
Support for platforms and pre-requisites iswidespread, in which ERAS and ERAC support
Windows 2000 and higher on 32-bit, and Windows
XP and higher on 64-bit. Other than the built-in
database, SQL, MySQL and Oracle are also
supported.
Documentation is clear, with relevant and logicallyordered headings. Network diagrams are given to
help illustrate basic and more elaborate enterpriseenvironments. In addition to a basic installation,
advanced installations where multiple servers are
required and cluster mode installation are also
covered.

Migration from Previous Solutions
ERA 5.0 supports migration from previous versions(4.x, 3.x), which is performed simply by installingthe current version over the previous version.
However, migration over versions 1.x and 2.x
requires migration to 3.x or 4.x first, and thenmigration to 5.0 can be performed.
The steps involved in migrating to ERA 5.0 are
similar to that of performing a clean install of ERAC
and ERAS. Database migration is optional, and a
backup is created by default incase a rollback isrequired. This saves administrators having to run
the backup themselves, which we saw wasnecessary for other products. Clients can be
upgraded automatically from some versions,although policies are not automatically migrated.
They can however, from Version 4.2 and after, bePage 15 of 44
22 August 2012

4/5

Fast and Effective Endpoint Security for Business

PassMark Software

manually and exported and imported to create a
new policy.

finding their way around the process without
needing to refer to the documentation. Once
initiated, the client module took us only a few
minutes to install on the endpoint machine, and nomachine restart was required for functional
protection.

Documentation in the ERA user guide is sufficientand covers basic information, although would
benefit from having a dedicated section on
migration, as related information was interspersed
within the ERA Installation section. ESET provides a“Rip and Replace” service for US & Canada
customers which is applicable to ERA v2.0 andhigher and a range of competing solutions.

Default Policies & Policy Management
4.5/5
The ERA Policy Manager and Configuration Editor
are highly efficient tools for viewing and setting
policies. Policy variables are arranged in tree form,
making them easy to locate and configure, and canbe marked and/or reverted to default settings
individually. A product filter allows administrators
to switch quickly between policies, and a handy text
search allows for quick location of items.
Default policies are created on installation and are
set reasonably, with server updates being regular,
prompting for computer restarts being turned on,
cleaning levels set to medium, and more advanced
options turned off. Some values are set to 0 to
indicate that default settings will be used, although
this default value is not displayed in the Editor.
There is only one default server and client policy,
but new policies can be based on and merged fromexisting policies, and existing policies can beimported and exported.

Client Installation

4/5

To perform a remote push task, the administrator
must first create an installation package byimporting the .msi file of the endpoint solution. In
the Package Manager, installation packages areorganized neatly by platform and package type,product info is displayed, xml configuration files canbe imported, and created packages can be saved
for later use. ERA also supports creation
deployment of custom installation packages from
non-ESET applications if it is available as an .msi file.
Running a quick search task displays computers on
the network (Windows network, IP Address, andActive Directory searches are supported), and apush installation can be performed simply by rightclicking the endpoint and selecting the appropriatetask. The push installation wizard links to a list of
endpoint requirements in the help file, such as
TCP/IP protocol, simple file sharing disabled, andremove registry service enabled, most of which
would already be satisfied on a typical enterprise
endpoint machine. To bypass these requirements, a
direct installation can be performed, which is moresuitable for small computer networks. A tip in the
ERAC clients tab advises that clients will connect
automatically and be visible in the ERA Console
simply by configuring Remote Administration
window in the client’s setup.
For larger computer networks, client deployment
can be performed with Active Directory
Synchronization, or by creating custom groups.
Both of these methods are documented clearly andin detail.

Interface Design

Screenshot 1: ESET Endpoint Security (Client)

Client Installation of ESET Endpoint Security (EES) iseasy and intuitive via remote push, so that any
technically inclined user should have no trouble
Comparative Analysis
Edition 1

4/5

The ERA Console uses a traditional Windowsinterface, which looks professional, neat, and feels
responsive. What it lacks in fancy and flashy
graphics, it makes up for in consistency and being
quick and intuitive to navigate. Main areas of theconsole are quickly accessible from the tabs
(Clients, Event Log, Scan Log, Tasks, Reports, etc.)
which span the bottom of the UI. There are 10
different log categories, which might have been
better organized as a single tab with a category
filter perhaps, or have an option to hide certain
tabs. Most tabs share a standard layout, with a left
side menu with display filtering options and theright side showing status information and log
Page 16 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

entries. Important data such as errors, warnings,
and importance level are viewable at a glance. At
times the interface may feel quite compact, but thisalso means that less is hidden.
The ERA web dashboard uses an AJAX based
interface that is customizable and aestheticallypleasing. Windows can be reorganized, and graphs
are tastefully colored with pastel gradients fills.
The EES interface is simple but well laid out andorganized. Icons are colorful and suitable. 6 maintabs in the left-hand menu include Protection
Status, Computer Scan, Update, Setup, Tools, andHelp and support, making actions and information
easily accessible.

Client Management & Remote
Management

Updates
4.5/5

The ERA Console offers complete functionality via
remote management, and can be connected to the
ERA Server with minimal effort (e.g. using IP, server
name). There is no license limit on the number of
ERA Consoles and Servers installed on a network,
which is convenient for larger enterprise setupsthat may require multiple servers andadministrators.
The User Manager allows for creating and defining
ERAC users with little effort. Permissions include
configuration
andexecutionofGroupManagement, Policy Management, Remote Install,
On-Demand Scan Task, Update, and Run Scheduled
Task, among many others.
On-demand scans, client configuration tasks,
updates, and quarantine tasks can be administeredusing the ERA Console. Tasks can be easily createdand configured, applied to target workstations via aright-click, and scheduled to run immediately or ata later time. Reporting is highly customizable andcovers an extensive list of criteria (e.g. Clients
Report, Scans Report, Quarantine Report, Server
Database Load). Report templates can be saved,
imported, exported, previewed, scheduled andtargeted to a specific folder or the server database.
In addition to the server console, the web
dashboard provides a convenient means of remotemonitoring. New dashboard templates can becreated and configured, imported and exported
from both the web dashboard and the server
console.

Comparative Analysis
Edition 1

Screenshot 2: ESET Remote Administrator Console (Server)

4/5

Setting up the ERA server updates requires ausername and password given by ESET. The
remaining default settings are reasonable, with theupdate server being set to automatic, and updates
being checked for every 60 minutes. It is not madeclear how often or under what circumstancesclients check for updates based on the scheduler.
Creating an “update mirror” is an optional
configuration, in which client workstations
download updates from the ERA Server via the local
network as opposed to downloading updates
directly from the internet to save on bandwidth. It
would be ideal if enabling the update repository
was created automatically by default, as was thecase with other products we tested.

Effectiveness

4.5/5

The most recent AV-Comparatives Summary
Report, dated December 2011, ESET was placed as
one of the 5 Top Rated Products of 2011, out of 20
products tested, awarded to products that achieveda “very high standard” in all tests. In their latest File
Detection Test Report, AV Comparatives assigned
the highest grade (ADVANCED+) to ESET NOD32 intheir most recent On-Demand and Retrospective
tests, dated August 2011. In the On-Demand File
Detection of Malicious Software test, ESET achievedthtotal detection rate of 97.6%, ranking 9 out of 15nd
products, and 2 out of 18 products in the False
Positives test, returning “very few FPs”.
Overall, ESET products have had a total of 74
successes with only three misses since their
inclusion in VB100 testing, giving them a success
rate
of
96%.

Page 17 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Kaspersky Endpoint
Security

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation
Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance Pros Initial configuration was quick and easy Wizard-based configuration eases
administrators into management
 Relatively low traffic overhead for updates
 Policy and Client management is flexible
 One-click reporting with custom template
creation Cons Performance is only average (large client
installation size, slow On-Access scanning) Documentation is thorough but could beorganized better
Comparative Analysis
Edition 1

PassMark Software

Installation and Configuration

4/5

Installing Kaspersky Security Centre (KSC) 9.2 wasstraightforward and quick, with the setup Wizard
installing both the Administration Server andConsole components in less than 5 minutes. Setup iscompleted in one major stage, and necessary
prerequisites, including MS SQL Express, Microsoft.NET Framework 2.0, Windows Installer 3.1 andMicrosoft
Data
AccessComponents
2.8
automatically if required. We conducted installation
on a machine that only required MS SQL Express to
be installed, so setup may have otherwise takenmuch longer, requiring restarts after installing
Microsoft components.
Once the setup Wizard completes, the Quick Start
Wizard appears, prompting for the Administrator toenter product activation details, which can beconveniently done later. Once complete, the productupdates and no further restart is required to begin
using the Administration Console. Like the setup
Wizard, the Quick Start Wizard is transparent;
informing the Administrator of every action it istaking, for e.g. creating default tasks and policies,
and showing filenames as they are being
downloaded during the update. The update took awhile to complete (more than 20 minutes), but could
be finished in the background by clicking ‘Next’.
Documentation is split into four separate .pdf
documents, an Administrator, Getting Started,
Implementation, and User Guides. This makes it
somewhat difficult to locate required information,and confusing as there is a significant amount ofcontent overlap as well as cross-referencing
between documents.

Migration from Previous Solutions
Upgrading from Kaspersky Administrator Kit (KAK)
8.0 to KSC 9.0 is documented clearly in 8 relatively
simple steps, including creating a backup using theprovided klbackup utility, installing KSC 9.0, anddeploying an upgrade to migrate clients. The process
does not require uninstalling KSC 9.0 or the clientanti-virus separately, and all Administration Serverdata and settings are carried over when installed on
the same computer where the previous version of
Administration Server was installed.
Migrating to KSC 9.0 from previous versions of KAK
8.0 is not mentioned in the same document, but is
not impossible as there are instructions available for
migrating to KAK 8.0 from version 6 or higher inseparate documentation. Thus migration fromearlier versions may involve two major steps, i.e.
migration to KAK 8.0 and then to KSC 9.0.
Page 18 of 44
22 August 2012

4/5

Fast and Effective Endpoint Security for Business

When deploying client software, administrators are
given the option to automatically remove
incompatible third-party security software.

Default Policies & Policy Management
4.5/5
On installation, KSC creates a single default policy for
Kaspersky Endpoint Security (KES) 8.0. Default policy
settings were reasonable, with all basic Anti-Virusfeatures being enabled at the recommended
medium security level. Separate policies for KSC
Administration Server and KSC Network Agent canbe created easily in a few clicks using the default
settings in the New Policy Wizard.
Policy configuration options are extensive, covering
all necessary basics, as well as more advanced areas,
including defining of events types, grouping rules,
and rights to protected resources (e.g. System files,
Services). One useful feature is enabling a particular(stricter) policy to activate automatically at the onsetof a ‘Virus outbreak’ event, in which a user-defined
number of detected viruses has been exceeded
within a specified time period. Policy behaviour isthoroughly documented, covering hierarchicalinheritance and ambiguous scenarios (e.g. when apolicy is deleted all settings are retained until
manually altered).
A conversion wizard can be used for making policies
of earlier versions of Kaspersky Lab applications
usable with more current versions. This is useful forpolicies that were not automatically upgraded
during migration, for example, because they were
imported later from another Administration Server.

PassMark Software

minutes. During deployment, the console displayeda progress bar and status text, which is reassuring towatch, but like most products the endpoint
installation continued in the background after thetask had ‘completed’ on the server side.
The documentation outlines installation options andinstructions clearly in steps, with some steps being
simplified and explained in later sections. While thismeans that the instructions are in-depth, it would be
convenient if hyperlinks to relevant sections in the
document were given to avoid the reader having tosearch for them.
As part of Kaspersky Endpoint Security Suite, we
installed KES 8.0 to the endpoint, but similar to
ESET’s product, the deployment process is applicable
not just to a range of Kaspersky Security products,
but also to some non-Kaspersky applications as well.
Another useful feature is the automatic installationof applications to new computers when they areadded to an administration group.
Besides remote deployment, client installation is
also possible by first creating a Stand-Alone package
using KSC, which can then be sent via email, placedin a shared folder or on a web server. These
packages can then be installed locally on an
endpoint, which makes this method more suitable
for smaller networks.
Instructions on configuring a connection between alocally installed client and the Administration Server
were found separately in the Implementation Guide
under Local Installation of Applications. This process
involves the installation of a couple of additional
components (Network agent, and control plug-in),which would be more convenient if done
automatically using a wizard, or if these components
can be added to a custom created install package.

Interface Design

4.5/5

Being built on Microsoft Management Console, the
KSC interface looks uncluttered and well organized.
A directory tree in the left pane provides a means ofquick navigation, and window layout is visuallyconsistent within categories, and related windows
are well linked.
Screenshot 3: Kaspersky Administration Kit 9.2 (Server)

Client Installation

4/5

Client deployment is made simple using the Remote
Installation Wizard, which follows the Quick Start
Wizard. We were able to complete the process of
deploying a single client was completed within fiveComparative Analysis
Edition 1

The server dashboard shows a colorful summary of
Deployment, Computer management, Protection,
Virus Scan, Update, and Monitoring statuses, withlinks for further details. The dashboard could
perhaps benefit from having a representative icon
for each category. Reports display 3-d like bar chartsand pie charts, and red and green traffic lights areused to indicate a Critical and OK status respectively,
Page 19 of 44
22 August 2012

Fast and Effective Endpoint Security for Businessamong other color conventions. The client interface
is aesthetically pleasing, appropriately sized andsimple, having two main tabs, Protection andControl and Settings.

Client Management & Remote
Management

4/5

As with ESET’s product, the KSC Administration
Console can be installed on a separate computer tothe Administration Server for remote management.
While online documentation indicates that KSC
supports configuration of permissions (e.g. accessprivileges, remote installation, editing of hierarchy
settings) for different roles, we could not find any
obvious way to do this from the management
console.

PassMark Software

Updates

4/5

By default, an Update task is scheduled to run clients
whenever updates are downloaded to therepository. Server Update default settings are set tocheck for updates from Kaspersky’s Update server
every hour, which is reasonable.
As with strict policy application, an update task can
be configured to execute On “Virus Outbreak”.
While updates were highly configurable and flexible,
it would have been useful to also have updates as
being defined by policies.

One-click group creation makes it easy to create
complex structures for larger networks. Group
creation can also be automated by importing
existing structures in Active Directory, Microsoft
Windows Domains and Workgroups, or from a text
file.
A wide range of filters can be applied whensearching for managed computers, includingdomain, IP range, application, status, andapplication.
Unmanaged
computers
areautomatically discovered in the Windows network,
Active Directory, specified subnets, or can be
manually searched for using NetBIOS name, DNS
name, IP, or IP range. Discovered computers arethen listed in the directory tree, as they would be in
Windows Explorer. Unassigned computers can be
automatically assigned to administration groups bydefining rules. As mentioned above, applications (inour case KES 8.0 and KSC 9.0) can be selected to be
automatically installed on client computers in agroup.
Under reports and notifications, 16 default reports(Error, Protection status, Deployment and Viruses
reports to name a few) templates covering mainareas of concern are generated upon viewing.
Additional templates can be created and date
ranges, presentation, and automated delivery can be
configured. Like ESET’s product, there is a webbased console to monitor server and client activities.
According to online support, this component was
only recently made commercially available (since 14
June 2012), so it was not included in the packagethatwetested
in
May
2012.

Comparative Analysis
Edition 1

Screenshot 4: Kaspersky Endpoint Security8 (Client)

Effectiveness4.5/5

In their latest Summary Report dated December
2011, AV Comparatives awarded Kaspersky an
ADVANCED+ grade for all tests, including theRetrospective, and Removal tests. Kaspersky AntiVirus was thus hailed as "Product of the Year" for2011, placing it first overall out of 20 products.
In their most recent File-Detection Test Report,
Kaspersky excelled in On- Demand Detection of
Malicious Software, achieving a Total Detection rateof 99.3%, placing them 3rd out of 20 competitors. In
the False positives test, they placed 5th out of 20,
with "few FP's".
Kaspersky passed the VB100 test 71 times and failed
23 times, resulting in a 75% success rate.

Page 20 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

McAfee Total
Protection for
Endpoint

PassMark Software

Installation and Configuration

3/5

The installation of McAfee ePolicy Orchestrator(ePO) 4.6.0 was a much longer process than that of
ESET and Kaspersky’s products, taking around 30
minutes to complete. The process was notparticularly smooth, requiring that setup berestarted after required prerequisites were installed.
In addition, we ran into an error specific to Windows
Server 2008 R2. We were at least provided with anerror code, and McAfee having thorough online
documentation meant that a quick search online
gave us a solution which required changing a specificregistry value.
Most software prerequisites are installed
automatically (SQL Server 2005 Express, unless a
Supported SQL Server is already installed, C++
Redistributables). .NET Framework 2.0 or later isrequired if installing SQL Server 2005 Express, but is
not installed automatically and requires that Setup
be cancelled and an appropriate package is acquired
and installed manually.

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation
Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance Pros Management console uses only a webbased console, which is sometimes
difficult to navigatend Low system impact (2 best performanceout of 7 products tested) Cons Documentation is thorough but could beorganized better Configuration options are generally
limited or hidden

Comparative Analysis
Edition 1

Detailed step-by-step installation instructions can befound online in the ePolicy Orchestratior 4.6.0
Software Installation Guide. The documentation iswell formatted and ordered, with appropriate
indentation and labelling, and defined typographicalconventions and icons that help make the document
more readable.

Migration from Previous Solutions
Upgrading ePO is outlined in the ePO 4.6.0
Installation Guide, available online. It advises in thesection summary that ePO version 4.6.0 can be
migrated to from version 4.0 Patch 8, version 4.5
Patch 3, or an earlier version of 4.6.
The migration process is relatively straightforwardand does not require uninstalling previous software
versions. Backing up of the SQL database can bedone either manually, or using the McAfee provided
DBBAK
utility.
Fordifferent
components(Orchestrator Server, Orchestrator Cluster Server,
Remote Agent Handlers), a corresponding upgrade
wizard is provided.
McAfee also provides separate knowledgebase
articles detailing supported, unsupported products,
and various backup procedures, which arecomprehensive but sometimes redundant. Despite
this, documentation is generally clear and easy tofollow.
Policy Migration for some component versions (e.g.
VSE 8.7i to 8.8) of ePO policies is supported using
the ePolicy Orchestrator Migration Tool.
Page 21 of 44
22 August 2012

3.5/5

Fast and Effective Endpoint Security for Business

Default Policies & Policy Management
2.5/5
Upon installing ePO, several default policies are
created, including 3 policies for McAfee Agentlabeled "McAfee Default”, having one for eachcategory, General, Repository, and Troubleshooting.
Similarly, there are another 3 policies labeled "MyDefault" and a "Large Organization Default" policy.
The policy catalog displays policies by product andcategory. “McAfee Default” and “My Default”
policies were provided for VirusScan Enterprise (VSE)
8.8 for 11 different categories. We found thesecategories to be quite specific (e.g. On-Access
General Policies, On-Access High-Risk Processes
Policies, Buffer Overflow Protection Policies and On
Delivery Email Scan Policies). We feel that this could
have been organized better for simpler
management, for example it is probably notnecessary to have 4 different On-Access policies,
which could have been combined as one.

PassMark Software

The deployment process can be conducted byfollowing a Guided Configuration. This involves 5
steps, Software Selection, System selection, Policy
Configuration, Software Updating, and Software
Deployment. System selection can be done either
manually, or by Active Directory Synchronization.
The system selection task was difficult to use,requiring domain login credentials before
enumerating the list, and creating an empty list
several times. It would be clearer if the target
systems were selected or searched for first, and thencredentials were required, as most other products
have done.

Screenshot 6: McAfee VirusScan Enterprise 8.8 (Client)

Policies can be edited, renamed, duplicated, deleted,
exported, and shared easily, except for McAfee
Default policies, which can only be duplicated. New
policies can also be created and configured in a few
clicks, but the web console makes this feel a bit slow
and cumbersome. Policies were sufficient forprotection, with all alerts and basic features being
enabled.

We found that while the Guided Configuration
indicated success, this was not necessarily the case.
For e.g. if the target endpoint login details wereincorrect, the deployment appears to continue andonly displays an error when the task status ischecked.
In the VSE 8.8 documentation, a standalone
installation as well as a table of command-line
parameters to configure installation is given,
although there is no clear indication of whether it ispossible to manage the endpoint from ePO after
running these local installation methods.

Interface Design

Screenshot 5: McAfee ePolicy Orchestrator (Server)

Client Installation

3/5

To prepare client software components for
deployment, it is required to first install a set of zip
files for the required software as extensions to ePO,as well as check them in to the Main Repository, sothat the software can be deployed, managed, andintegrated with ePO. It would be easier if only one ofthese tasks, i.e. checking in or installing as anextension, was required (for e.g. if checking in thesoftware also automatically installed it as anextension).
Comparative Analysis
Edition 1

3/5

McAfee uses an AJAX based web console whichlooks fancy but feels clunky and slow to respond attimes. Shades of blue and grey for buttons, graphics,
and text make the interface look consistent andprofessional, but somewhat cold. Icons are used toillustrate tabs, although some are a bit too vague
and abstract to be helpful, for e.g. a screen with aribbon marker is used for to illustrate the Policy
Assignment Rules tab.
A drop down main menu and some shortcuts(Dashboards, System Tree, Queries & Reports, andPolicy Catalog) make up the navigation bar along the
top. The drop down menu is not really ideal, having
menus within menus. Naming and terminology
sounds sophisticated but is sometimes confusing
and not immediately obvious. There are several
dashboard templates to view summarized
information, including Audit, Thread Events, Product
Page 22 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Deployment, Trends, and an ePO Summary. Client
softwarecomponents,
includingVirusScan
Enterprise and McAfee agent, are functionally welldesigned but look plain and outdated.

Client Management & Remote
Management

4/5

Administration is performed from a web-based
console, so management can be performed
remotely from anywhere on the network. Role
based management is possible, in which user
accounts can be created and configured andpermission sets can be applied to users to allow ordeny access to specific areas of management.
Creating and scheduling client tasks can be
performed fairly easily in the Client Task Catalog
window, although the range of deployable tasks isquite limited. The client antivirus component (VSE
8.8) has only two tasks listed in the client task
catalog, On Demand Scan, and Restore from
Quarantine, probably because functionality is split
amongst several products. Tasks can be first createdand configured, and then assigned, or added as an
assigned task for a node (or group) in the systemtree. From the system tree, endpoints can be leftclicked to view details (System Properties, installed
products, threat events) or right-clicked to have atask executed on them.
In the Queries & Reports window, pie charts andstatistics are generated for different queries (e.g.
Malware Detection History, Failed Product
Deployment in the Last 24 Hours), and reports canbe manually created by dragging, dropping, andediting widgets from the toolbox (Image, Query
Table, and Text). Report Properties can also beedited, and saved as .pdf files. Having a customizable
presentation is nice, but some administrators may
find that they prefer reports to be generated
automatically.

Updates

PassMark Software

newly-added repositories", which is disabled bydefault.
There is very little support for configuring updates
for the client antivirus component (VSE 8.8). One
option is to "Disable default AutoUpdate taskschedule", which is unchecked by default. However,according to online support, this is a one way
process and can't be reversed once checked. The
only other option we could find was to apply apassword to the VirusScan AutoUpdate feature.
Perhaps there should be a separate AutoUpdate
policy that features a more complete range ofoptions.

Effectiveness

3.5/5

McAfee achieved relatively good ratings in the latest
AV Comparatives Summary Report, dated December
2011. They were awarded an ADVANCED+ and
STANDARD rating in the Aug 2011 On-Demand andNov 2011 Removal test respectively. McAfee
received a GOLD award for having the lowest false
positives for 2011.
In the latest File-Detection Test Report, dated March
2012, McAfee obtained a Total Detection Rate of
98.6% in the AV Comparatives On-Demand
Detection of Malicious Software Test, placing them
5th out of 20 competitors.
In previous VB100 tests, McAfee has achieved a totalof 51 passes and 24 fails (a 68% success rate), withthe most recent failure being a WildList miss in 2010.

2/5

In the Server Task Catalog, updating the master
repository is enabled to be carried out daily at 1
a.m., which is much less frequent than otherproducts (which scheduled this every hour). This task
checks available updates for all products that havebeen checked into the Master Repository. Specificproducts can be updated by initiating a "Schedule
Pull" or "Pull Now" task.
Updates are configured by editing the McAfee Agent
Update policy, although options are limited. In the
McAfee Agent Update Repository policy, there is an
option to "Automatically allow clients to accessComparative Analysis
Edition 1

Page 23 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Installation and Configuration

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation
Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance








Pros
Interface is elegant and familiar
SCCM is used for a wide range of purposes
Performance is fairly goodCons
Provided and online documentation is
scarce and very poorly organized Installation is very difficult, requiring many
prerequisites and hotfixes
 Most administration tasks are not intuitiveand convoluted to carry out

Comparative Analysis
Edition 1

1/5

Microsoft's solution (SCEP 2012) is the mostcomplex and intricate of the products tested, taking
no less than 5 hours to complete (not including
troubleshooting). Endpoint Protection is part of the
System Center 2012 environment, which in turn,comprises of 7 components: Orchestrator, Virtual
Machine Manager, App Controller, Operations
Manager, Configuration Manager, Service Manager
and Data Protection Manager. Microsoft attempts
to simplify this by providing a "Unified Installer"utility for the SC2012 environment but the
fragmented component-based design inevitably
leads to difficult troubleshooting due to the many
points of failure.
Inconveniently, System Center 2012 does notsupport Windows Server 2003, so we had to instead
perform installation on Windows Server 2008 (R2).
There are strict integration requirements withmany other Microsoft packages such as SQL Server,
SQL Server Reporting Services, varying versions of
the .NET Frameworks, Analysis Management
Objects, PowerShell, Windows Update Services andActive Directory. This means that, unlike some ofthe other products tested which provided built-in
update services or internal databases (that camepreconfigured and customized to suit their needs),
SC2012 required finicky configuration of eachexternal service it utilizes. While this design may
have been aimed to "slot in" to a Microsoft
dominant enterprise Intranet environment (thatwould already have these Microsoft services wellconfigured and fine-tuned), the benefits arecurtailed by the strict version prerequisites of eachcomponent. One jarring example is that SCSM 2012
requires SQL Server 2008 SP2 or SQL Server 2008
R2, but it does not support SQL Server 2012, andwould require a rollback of your SQL Server toaccommodate.
Microsoft's solution had the largest number ofsoftware pre-requisites. Furthermore, the installers
did not come with any of the pre-requisites, andrequired all components to be individually sourced
online (there was no page of links), separately
downloaded
andmanually
installed.
Documentation was largely provided throughMicrosoft TechNet. Information was scattered and
not well-linked, with related topics hard to find.
Some steps were missing and often ambiguous. The
documentation in general was difficult to follow,
requiring more elaborate guides that were
informally provided in the Microsoft forums or
blogs.
Page 24 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Migration

PassMark Software

1/5

There have been several vastly different (andincompatible) enterprise security offerings fromMicrosoft.
Microsoft's earlier solution, Forefront Client
Security (supported from 2007 to 2010) runs on acustom version of Microsoft Operations Manager
2005, while the new Endpoint Protection 2012 ispart of the System Center 2012 platform. Being
completely different beasts, there is officially no
direct upgrade path from this solution.
A migration between these two would require
manually documenting the settings for all policies
you want to preserve, before unapproving all the
FCS installation packages via WSUS (Windows
Server Update Service) and effectively uninstallingthem from all clients, and then proceeding with aclean installation of the System Center 2012
platform. This "completely from scratch" approach
is obviously costly and the most cumbersome
migration process of all products tested.
The more recent offering of Forefront Endpoint
Protection 2010 (supported from 2010 to 2012) wasa part of SCCM 2007, but it does not integrate with
SCCM 2012. As such, to upgrade to the latest
offering (Endpoint Protection 2012), you must
upgrade the System Center platform. Due to thenumber of different components that make up the
SC2012 platform, each component needs to beevaluatedindividuallyforeligibility
andcompatibility with existing components. Needlessto say, this is not a simple task and a complete
upgrade can take days of preparation in a large
network.
Each component has an elaborate upgrade path.
Simpler installations will be able to utilize theupgrade wizards, but multiple-server scenarios will
require more effort. In the case of the Operations
Manager, the latter is catered for with an "Upgrade
Helper Management Pack" which will help discover
the servers and agent-managed computers in the
SCOM management group, in addition tomonitoring the upgrade progress. Some of thecomponents support "in-place" upgrades, such as
Operations Manager and Configuration Manager,
but as in the case of the latter, they may be limitedtoDistribution
Pointsonly.

Default Policies & Policy Management1.5/5
A default installation of SCEP 2012 comes with 25
template policies that can be imported anddeployed. These are well selected and range from"Default", "High Security", "Std Desktop" to"Performance optimized".
Most products have several options to manage
client groups from within security solution, but
Microsoft Forefront Client Security relies solely on
the use of existing Windows server infrastructure to
manage endpoints, such as through Group Policy
Management (GPM) and the Active Directorydomain. Endpoint machines must be organized into
groups or Organizational Units (OU) within the
Active Directory Domain before Forefront Client
Security policies can be deployed and enforced.
Forefront Client Security policy management
appears somewhat basic, with limited options forsecurity management. The apparent lack of
granular control is surprising given the product’s
complexity and intended large-scale corporate
audience. Deployed policies do not come into
enforcement until the Group Policy refresh takes
place, which may take hours. Administrators canmanually force an update by issuing a commandthrough the command prompt on endpoint
machines, but Forefront Client Security does notprovide this functionality.

Client Installation

1/5

Once the System Center 2012 environment isproperly setup, the SCEP client can be deployed via
the Default Client Setting for Endpoint Protection.
This setting enables or disables all SCEP clients on
the managed machines.
Once again, the disadvantages of a solution which
relied on so many different components became
evident during our deployment. There was nocentralized logging system so error messages were
scattered and difficult to correlate from one
module to another. Often, many modules are
involved, and it was difficult to determine the cause
or even investigate the symptom of the problem
resulting in very difficult troubleshooting, not tomention the lack of clear documentation.

Interface Design

4/5

The SCEP client interface is almost identical toForefront Endpoint Protection 2010. It isappropriately simple and readable, with featuresgrouped under four tabs. Its consistency with theComparative Analysis
Edition 1

Page 25 of 44
22 August 2012

Fast and Effective Endpoint Security for BusinessWindows 7 look-and-feel and integration with
Windows Action Center makes it one of the more
approachable and familiar to use.

PassMark Software

to be ultimately restricting compared to the otherremote management features offered bycompeting solutions.

Updates

1/5

Unfortunately, there were no update policies
created by default. We had to manually configure
Configuration Manager Software Updates to deliverdefinitions to clients using the less-than-intuitiveand generic “Automatic Deployment Rules” which isused for all other deployments in System Center
2012.

Screenshot 7: Microsoft Endpoint Protection 2012 Client

The server-side interface is a part of System Center2012 Configuration Manager which uses an elegant
and sophisticated layout. Users of other recent
Microsoft products (such as Office 2010) will be
comfortable and familiar with navigation devices
such as the ribbon bar. The integration of the
security features amidst other System Centerfeatures makes it a little harder to filter out
unrelated details if your primary focus is onprotection. However it can be useful when using
SCCM to monitor other aspects of a network.

This involved the use of a complicated procedure(documented as 25 steps in TechNet), with many
irrelevant features needing to be bypassed orworked around, such as the need to construct a“Property Filter” and “Search Criteria” by modifying
a SQL-like query and running through a selection of
windows and check boxes, simply to specify that wewant definition updates and not updates for the“Bing Search Bar” or other Microsoft products. Thisis doubly confusing when the Product filter needed
to be selected turns out to be “Forefront Endpoint
Protection 2010” which is the name of thepredecessor solution, and there is no choice for thecurrent “Endpoint Protection 2012”. This naming
mistake (or design oversight) is also part of theofficial 2012 documentation so one presumes
Microsoft has no intention to fix or change this in
the near future.

Effectiveness

Screenshot 8: Microsoft System Center 2012 Configuration
Manager (Server)

Client Management & Remote
Management

2/5

Configuration Manager “clients” can be installed
and deployed on multiple machines, so remotemanagement is possible. The terminology issomewhat
misleading,but
deployinga“Configuration Manager client”, as Microsoft calls
it, is equivalent to installing another server
manager console. However, given the complexity of
System Center, this is not always practical, e.g.
there are bound to be difficulties installing the
SCCM “client” to the target machine. We found thisComparative Analysis
Edition 1

4/5

Microsoft achieved ADVANCED ratings in the 2011
On-Demand, Retrospective, and Removal tests inthe latest AV Comparatives Summary Report, dated
December 2011. However, in the latest File
Detection Test Report, Microsoft came last out of
20 products in the On-Demand Detection of
Malicious Software Test, obtaining a total detection
rate of 93.1%. This also meant that, on the other
hand, Microsoft came first in the False Positives
tests, detection zero FP's.
In the VB100 tests, Microsoft Forefront has passed
in all 16 tests it was entered in. Overall, Microsoft
has obtained a total of 27 successes and only 2 fails,
giving them a success rate of 93%.

Page 26 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Sophos Endpoint
Protection 10

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation
Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance








Pros
Documentation is very clear and in-depthInterface is familiar and intuitive to use
Migration is fairly automatedCons
Performance is only average (large client
installation size, slow On-Access scanning No web console for monitoring and/or
management

PassMark Software

Installation and Configuration
Installing Sophos Enterprise Console Advanced isfairly straightforward, but requires someprerequisite Microsoft software (SQL Server 2008
Express unless SQL Server 2005 Express or later isalready installed, .NET Framework 3.5 SP1 or later,and Microsoft Message Queuing) which areinstalled automatically during setup. Systemproperty checking for the above prerequisites
performed automatically by the installer was
helpful prior to setup, and wasted no time in having
to restart the installer (which was not the case for
McAfee’s product). Setup and configuration was
clear, although required fields were not correctly
marked, instead providing an error when clicking‘Next’.
Due to all the required prerequisites, setup waslengthy and required restarts in between
prerequisite installation stages. Using the default
settings, the entire setup process took us aroundhalf an hour to complete, including a mandatory
restart before opening the Console.
Documentation is in-depth, well organized andlogically ordered. The installation process is
described over 20 main topics that can be thoughtof as setup stages, including console server
preparation and installation, server configuration,
creation of policies, preparation and protection of
endpoint machines, and post installation steps.

Migration from Previous Solutions
The Sophos Endpoint Protection upgrade process iscomplex but thoroughly documented, withextensive details on user account requirements andsecurity policies. There are potential complicationsin the process with maintaining software
subscriptions and updating policies from previous
version. In spite of this, the documentation
provides a systematic approach to handling theseobstacles.
Unfortunately, supported versions to migrate fromare not listed in the documentation. Instead, theenterprise console installer of the newer version
provides advice on whether or not migration fromthe currently installed version is possible after
checking if system requirements are satisfied.
On the client side, upgrades to Sophos Endpoint
Security and Control 10.0 are possible only fromversions 9.0, 9.5 and 9.7. Upgrades are also possible
from Sophos Anti-Virus 7 and Sophos Client Firewall
1.5. Endpoint computers can be upgraded gradually(allowing you to evaluate new versions before

Comparative Analysis
Edition 1

3/5

Page 27 of 44
22 August 2012

4/5

Fast and Effective Endpoint Security for Business

upgrading all computers) or completely in one step.
The latter process can be performed simply byconfiguring the Software Subscriptions window,
allowing the Console to download updates that willthen be used to upgrade the endpoint software
automatically. Another convenient migration
feature is that the Sophos client Installer also
removes third-party software automatically.

Default Policies & Policy Management4/5
Default policies are created on installation for all
policy categories, which includes Updating, Antivirus and HIPS, Firewall, NAC, Application control,
Data control, Device control, Tamper Protection,
Patch, and Web control. Policies can be managed
from the left window when viewing Endpoints, andare helpfully organized in a tree. Policy
configuration options are sufficient, covering mostimportant areas. Some policy categories only
contained a few variables (e.g. toggle tamper
protection) and could have been merged withanother category.
By default, there is no scheduled scan set in theAnti-virus and HIPS policy. Creating a scheduled
scan is simple, although the default settingsschedule the scan for every weekday at 9am, which
would be inconvenient for users.

PassMark Software

The documentation outlines some specificrequirements that must be met before deployment(e.g. the Remote Registry service must be started),but most of these would be satisfied on a typical
workstation. The remaining deployment process
takes only a few steps using the Protect Computers
Wizard. Additional product components can bechecked for inclusion in the deployment, and an
option is given to automatically remove third-party
security software, although this feature requires
some manual configuration and a local restart.

Interface Design

4/5

Screenshot 10: Sophos Enterprise Console (Server)

The Sophos Enterprise Console interface is both
functional and aesthetically pleasing, despite using
more adventurous colors such as pink, purple andorange. Graphics are simple, but modern andstylish.
The dashboard can be toggled on or off, in which it
takes up the top half of the main screen. The
Endpoints/Update managers button allows forquick switching between Endpoints and Update
managers windows, although we found that whenswitching between the two views, the buttonchanges size, which throws off the navigation bar
by a bit.

Screenshot 9: Sophos Endpoint Security and Control (Client)

Client Installation

3.5/5

Like most other products we tested, main methodsof endpoint discovery are covered, including
Windows Network, IP/Subnet and Active Directory.
Before client deployment can be performed, therequired software must first be downloaded fromthe management console by entering thecredentials provided by Sophos, and connecting to
the vendor's server. When we tried to download
the required software, the vendor’s server was
initially unresponsive and required a few attempts
to connect to.
Comparative Analysis
Edition 1

The client software launches an unnecessarily large
window that shows a lot of empty white space,although this can be resized. The layout(particularly the navigation bar and left-hand menu)
and icons are very reminiscent of Windows Explorer
in XP, which makes it feel familiar but a little
outdated for most.

Client Management & Remote
Management

3/5

Role-based access to the administrator console canbe used to assign Windows users and groups toPage 28 of 44
22 August 2012

Fast and Effective Endpoint Security for Businessspecific roles. An example of this, given in the
documentation, is a help desk engineer who can
perform updates but not configure policies. There
are 4 preconfigured roles, System Administrator,
Administrator, Helpdesk, and Guest. Roles can beedited created and defined by the System
Administrator.
Client management can be performed in theendpoints tab, which displays a list of managed andunmanaged computers, with separate tabs for
Status, Computer details, and each policy category.

PassMark Software

In the latest AV Comparatives File-Detection Test
Report, Sophos ranked 4th out of 20 products in the
On-Demand Detection of Malicious Software Test,
achieving a total detection rate of 98.9%. However,they ranked 9th out of 20 in the False Positives
Test, with around a fair number of false positives.
In the VB100 tests, Sophos has achieved a total of
61 passes and 18 fails, giving them a success rate of77%.

Group structures can be created in one click, andconfigured after creation. Active directory
containers can also be imported and used as agroup structure. Alternatively, groups can besynchronized with Active Directory containers.
The Report Manager creates comprehensive andhighly configurable reports using the Report wizard.
Similar to other products, the report can also bescheduled for creation and automatic emailing.

Updates

4/5

The default updating policy has the client check the
manager server every 10 minutes for newly
downloaded updates, which is probably more
frequent than necessary (most products wereviewed had this feature set to 4 hours, or had afeature to trigger updates when they are available).
Sophos Update Manager enables automatic
updating from either a Sophos server or a server on
your network, and distributes the downloaded
security software to a suitable location for
installation on endpoints, which will then update
automatically when configured to do so. In more
complex networks, additional update managers canbe installed to a remote location, allowing for
updates from one office location to be distributed
to other office locations which have limited or slow
external Internet connection.
Sophos subscriptions can be added and configured
to download specific versions for different
platforms. The settings offer a useful option forenabling automatic upgrading of software when it is
no longer supported by Sophos.

Effectiveness

3.5/5

Sophos were given average ratings in the latest AV
Comparatives Summary Report, dated December
2011, being awarded an ADVANCED, STANDARD,
and STANDARD score in the On-Demand,
Retrospective, and Removal 2011 tests respectively.
Comparative Analysis
Edition 1

Page 29 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Symantec Endpoint
Protection 12.1

PassMark Software

Installation and Configuration

4/5

Installing the Symantec Endpoint Protection 12.1
management server and console is verystraightforward. The wizard-based setup provides
brief explanations of key features and minimal
input is needed from the user, with only a few fields
being marked as required. Setup progress through 3stages (Installation, Server Configuration, andProduct Migration) is shown, and administrators
are advised when a particular step (e.g. databasecreation and initialization) may take some time.
Once the Installation wizard completes, theManagement
ServerConfiguration
Wizardautomatically starts, offering options for a default
or custom configuration type, using a disasterrecovery file, and an email address for notifications
and reports etc. The default setup process was not
long, taking us around 10 minutes to complete.
Unlike other products we reviewed, setup was
entirely standalone, and was thus smoother andintegrated, not requiring any external installer
packages to be run.

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation

Support for different platforms (Windows 8, XP,
Server 2003, Server 2008 and more) and databasesystems are well covered. By default, the SEP
embedded database is included in installation, withsupport for up to 5,000 clients. For larger networks
with up to 50,000 clients, Microsoft SQL Server(2000 SP4 or later, 2005 SP2 or later, 2008) is
supported and can be installed prior to setup, butthere are specific configuration requirements tofollow. SEP also offers support for both Mac (OSX
10.5/10.6 and OSX Server 10.5/10.6) and Windows
clients.

Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance Pros Web console (in addition to the desktop
console) allows for remote monitoringand management Migration is highly automated and well
documented
 Interface looks pleasant and is intuitive touse Cons Performance is only average (Highmemory usage, installation size and boottime on client)Comparative Analysis
Edition 1

The documentation explains the entire setup
process in 11 simple steps, with hyperlinks torelated sections within the document where
necessary.

Migration from Previous Solutions
Symantec provides a well designed migration path,involving minimal steps compared to otherreviewed products. Backing up of the database ismade simple with the included one-click backup
tool. Migration of both the management server andendpoint clients is wizard based, uninstallation ofprevious versions does not require any extra steps,
and all legacy settings are detected and maintained.
Migration is possible from the a wide range ofSymantec endpoint products, including Symantec
AntiVirus Corporate Edition 9.x and 10.x, SEP SBE
12.0, and SEP 11.x. Clients can be upgraded in a
Page 30 of 44
22 August 2012

4.5/5

Fast and Effective Endpoint Security for Business

number of ways, including an AutoUpgrade (anAutomatic
UpgradeWizard),configuring
LIveUpdate settings to permit product updates, anda local installation. As we saw with other reviewed
products, the Client Deployment Wizard provides
an option for automatically uninstalling existing
security software.
Documentation is relevant and well presented,
frequently using tables to compare and summarize
information, for e.g. a feature map between 11.x
and 12.1 clients shows improvements fromprevious versions. Symantec also offers migration
assistance through their Endpoint Security service.

PassMark Softwareshows the deployment status using a progress bar
in real time, which is reassuring for theadministrator, although the response from theclient side took longer than the completion
confirmation from the console, which was the casefor most products. Completing client installation
requires a restart which can be executed from the
management server at any convenient time. The
entire process was short, taking less than 5
minutes.

Default Policies & Policy Management4.5/5
During installation, default policies are created foreach category, Virus and Spyware Protection,
Firewall, Intrusion Prevention, Application andDevice Control, LiveUpdate, and Exceptions. By
default, three different Virus and Spyware policies
are defined (Balanced, High Security, and High
Performance), and one policy is defined for eachremaining category, with the balanced policy
appropriately being used by default.
Antivirus policy settings are conveniently split into
two sections, Windows Settings and Mac Settings,
although there are naturally less than half theoptions under Mac Settings than there are underWindows Settings.
Policies management is intuitive, and configuration
is fairly granular. Policies can be edited, deleted,assigned to specific groups, replaced, copied,
pasted, exported and imported quite easily. A list ofpolicy components helps organize objects used for
defining policies (e.g. Scheduled Scan Templates,
Management Server Lists, and Network Adaptors).

Client Installation

4.5/5

Remote deployment is very straightforward using
the Client Deployment Wizard, which explains
options and provides links for further help at eachstep. Installation options include Web link andemail, Remote push, and Save package, in which
the endpoint is automatically linked to the
management server. Another option is to install thesoftware as an unmanaged client, which must be
managed separately, and may be useful forcomputers which are not always connected to the
local network. It would be useful if there was a way
to configure the management server to discoverunmanaged clients so that they can be potentiallychanged to managed clients.

Screenshot 12: Symantec Endpoint Protection (Client)Interface Design

4/5

The SEP Manager interface is well designed, being
visually welcoming and intuitive to use. Colors areappropriate to the company’s logo, using mainly
yellow and blue. A navigation bar on the left
contains nicely sized and illustrated buttons thatlink to main areas (Home, Monitors, Reports,
Policies, Clients, and Admin). Fitting color
conventions are used, with green denoting
good/up-to-date, red denoting that Attention isrequired/out-of-date. The ThreatCon security
Response box shows a spectrum that ranges fromgreen to read, to indicate normal to extreme threat
levels. However, when we tested this product In
Windows Server 2003, charts and graphics in themain pane did not appear, leaving a white space inplace of them. There was no indication of whether
we required a particular plugin for example, torender these graphics. We also found that the
management console was sometimes slow to startup and login to.
The web console is almost identical to the console,in both function and layout, with some colors beingslightly different. While this is not the case for the
web-console, font type and size in the Manager
console was slightly inconsistent.
The client user interface looks clean, andprofessional, although appears to have been
simplified since the previous versions, perhaps
indicating a focus on lightness and performance.

Like Kaspersky's product, the Management Console
Comparative Analysis
Edition 1

Page 31 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Client Management & Remote
Management

4/5

Since the web console shares the samefunctionality as the management console, remotemanagement from anywhere on the network is
possible, sparing administrators the need to install
the management console software on additional
workstations.
Role based administration is well supported, where
3 default administrators can be created (System
Administrator,
Administrator,
and
LimitedAdministrator). System Administrators have fullaccess and permissions, as do Administrators, but
only within a single domain. Limited Administrators
configuration is flexible, configurable rights within awide range of areas (View reports, Manage groups,
Remotely run commands, Site rights, Manage
installation packages, Manage policies).
Group structures can be easily created by entering
at least a name, and Active Directory structures canbe imported and synchronized. Location specificpolicies and settings, as well as policy inheritancecan be applied to groups.
Tasks can be easily carried out by right clicking
target endpoints and selecting the appropriate
action. While these functions cover basic actions,
including Scan and Update Content, some are
unique to the software’s (e.g. Enable Auto-Protect,
Enable Download Insight). Unlike most products wereviewed, there is no way to create a scheduled or
conditional task.

PassMark Softwareinternet bandwidth. Unlike most products, there
was no parameter for the frequency of server
update checks. Clients are by default scheduled tocheck for updates every 4 hours, with a retry timeof 2 hours. There is a useful download
randomization option to reduce the load on theserver (or on the internet connection).
In the LiveUpdate content policy editor, security
definitions and signatures can be included or
excluded in updates, or specific revisions can bechosen. One interesting feature is the use of aGroup Update Provider, in which a client that
downloads content from the management server
passes this content on to other clients.
We found SEPM’s update options to be moresophisticated and extensive than most products
without being too difficult to configure andunderstand.

Effectiveness

4/5

Symantec achieved solid ratings in the latest AV
Comparatives Summary Report dated December
2011, being awarded an ADVANCED rating in the
Aug 2011 On-Demand Test, and ADVANCED+ ratingin the Nov 2011 Removal Test.
In the VB100 tests, Symantec has performed
respectably, having achieved 57 passes and 8 fails,
giving it a success rate of 88%. They have not failed
the test since August 2009, having been tested
successfully every year since then.

Screenshot 11: Symantec Manager Console (Server)

Updates

4.5/5

Updates are controlled by Symantec’s LiveUpdate
utility. Server settings are configured to use boththe management server and the default Symantec
LiveUpdate server to provide updates for clients.
Enabling both is not really necessary and may waste
Comparative Analysis
Edition 1

Page 32 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

Trend Micro
OfficeScan 10.6

PassMark Software

Installation and Configuration
Setup was fairly easy, taking less than 15 minutes tocomplete, although configuration requires a bit
more attention compared to other products. During
setup, the administrator is prompted to enter in
Activation Codes for three services, Antivirus,
Damage Cleanup Services which is optional, and
Web Reputation and Anti-spyware. Trend Micro
had emailed us 4 different activation codes fordifferent product components that did not matchthe service names, which was a bit confusing, but
we eventually resolved to use the main OfficeScan
code for all three services.
We kept all the default settings, so Apache Web
Server 2.0 was installed as the IIS web server option
was grayed out, although this can be enabled byfirst enabling the IIS web server in Windows
settings

Review Summary
Overall Rating
Installation & Configuration
Migration
Default Policies & Policy
Management
Client Installation
Interface Design
Client Management &Remote Management
Updates
Effectiveness
Performance Pros Light weight product (low client installationsize) Documentation is thorough in covering
complex scenarios, especially on migrationand client installation
 Cons Configuration is generally limited andsettings are sometimes difficult to find
 Very high file copy time on endpoints
 Very high network usage

Comparative Analysis
Edition 1

There are two main client configurations that canbe set during installation, a smart scan andconventional scan. The default installation uses asmart scan configuration for clients, but this can bechanged afterwards.
The installation guide covers considerations formore complex setups, such as using an IIS web
server for IPV6 support, and firewall positioning
within the network. Diagrams are used to illustrate
a basic as well as multiple site network
configurations.
Upon starting the web console, we had somedifficulty logging in as Active-X would not install.
Using the given error number, we found a solution
online which required manually running a regsvr32
command on specific trend micro .dll and .ocx files,
which was inconvenient. During later use, we ran
into problems with the console informing us thatsome the OfficeScan master service has stopped,
which happened intermittently. We suspect thatthe installation may not have run correctly, or
required further configuration.
Documentation is extensive, provides useful links
within the document, and is well formatted, using atable to outline font conventions to assist thereader. A glossary table outlines basic terminology,
some of which are specific to OfficeScan, which isuseful for administrators who are just starting out.
It is also a nice change to see terminology organized
as clearly and simply as possible, as productspecific naming and wording can quickly become aconfusing mess, as we have seen for otherproducts.
Page 33 of 44
22 August 2012

3.5/5

Fast and Effective Endpoint Security for Business

Migration

4/5

OfficeScan 10.6 supports upgrades from OfficeScan
8.0 SP1 and OfficeScan 10.x. Migration is
documented in acute detail in the Installation andUpgrade Guide. A 4 step process is outlined forbacking up the database and configuration files
before upgrading, which is a bit more complicatedthan other products we reviewed, requiring
stopping the Office Master Service and backing up alist of files manually.
Upgrading the server can be performed either
locally or manually. There are 4 main upgrade
options to choose from. Two of these options
involve upgrading the server by installing 10.6 overthe previous version. Once the server component is
upgraded, connected Clients are upgraded to
OfficeScan 10.6 gradually (for larger networks), or
automatically, depending on whether or not
automatic update was disabled prior to the server
upgrade.
Clients can also be upgraded from 10.x and 8.0 SP1
to 10.6 by moving them to an OfficeScan 10.6
server, in which case specific actions must be taken
depending on the popularity of either client
configuration amongst the clients. The last upgrade
method involves upgrading the update agents.

PassMark Software

there were 5 already defined) could be created,managed, and assigned to specific profiles orgroups. Despite the emphasis on firewall
management, the default firewall policy is set tothe lowest security level.

Client Installation

4/5

Client Installation Methods are outlined thoroughly
in the Administrator’s Guide. A helpful tablesummarizes each installation method (of which
there are 8) outlining several deployment
considerations, such as whether it is suitable formass deployment, bandwidth consumption level,
and whether it requires user intervention.
Client Installation methods include a web install(instructions and a link to the installer are sent to
endpoint users via email), a client package
deployment (through Active Directory or Microsoft
SMS), and remote installation. Computers can besearched for by name or conduct an Advanced
Search (by IP range, Platform, platform,architecture, and domain). We conducted a remote
installation, which was quick and easy, taking only a
few minutes.

While it is good to have a range of options tochoose from, some migration methods are a bit
convoluted and require careful attention to detailwhich may be overwhelming for less experienced
administrators.

Default Policies & Policy Management 2/5
Policy/Settings management is somewhat confusing
and not particularly intuitive. Client settings are
configured in the client management area, where
the Settings tab opens a menu linking to Scan
Settings, Web Reputation Settings, Update Agent
Settings, Device Control Settings, and so on.
Settings can also be imported and exported,
although it was not clear as to whether or not they
could be applied to specific groups. Most settings
only show options to either “Apply to All Clients” or“Apply to Future Domains Only”. Security settings
were generally set to low (out of low, medium andhigh) for internal clients and medium for externalclients (those which are not connected to the
OfficeScan server), which is fair. We feel that these‘settings’ could have been better organized andmanaged as policies.
While this was not possible for most client
management settings, Firewall policies (of which
Comparative Analysis
Edition 1

Screenshot 6: Trend Micro OfficeScan (Client)Interface Design

3/5

Like McAfee’s product, the management console
interface is web-based and thus feels a bit slow andunresponsive at times. The layout is neat and wellcomposed, with a navigation bar on the left linking
to main areas including Networked Computers,
Updates, Logs and Tools.
While the interface is well laid out, it could benefit
from a more interesting color scheme. Some fancier
graphics, including pie charts and maps displayed in
the Smart Protection Network widgets, wereanimated, allowed for user interaction, and thus
required Adobe flash. As with ESET’s web
Page 34 of 44
22 August 2012

Fast and Effective Endpoint Security for Businessdashboard, widgets can be added to the dashboard,
shuffled around and resized. The map widgets wereamusing, highlighting countries in red anddisplaying a score for threat sources andthreatened users as the cursor hovers over them.
The client software launches a relatively small
window. The interface is quite simple and looks
bland and outdated. As with the web console, theclient interface would benefit visually from more
use of color.

PassMark Software

administrator. Client user notifications can be
reworded, although not much more can be
configured (e.g. if and under what circumstances
they appear). A security compliance report can besent via email at scheduled times, although there is
no immediate way to preview the report. Client
task coverage is only basic; a Scan Now, Client
Uninstallation, and Spyware/Grayware Restore task
can be performed on selected clients, but there isno obvious way to schedule them.

Updates

4/5

Updates for the OfficeScan server are by default
carried out hourly, applying to all networked
computer components (Antivirus, Anti-spyware,
Damage Cleanup Services, Firewall and Behavior
Monitoring Components). These components andfeatures within them can be excluded from the
update. Current version and last update status foreach is shown clearly in a table on the dashboard.

Screenshot 7: Trend Micro OfficeScan (Server)

Client Management & Remote
Management

3.5/5

Clients are managed via a web console, so it caneasily be accessed from anywhere on the network.
Role based administration is supported, providing
two built-in role types (Administrator and Guest) to
select from, although there seemed to be no otheroptions for defining custom roles, despite options
for importing and exporting roles.
A dashboard on the main summary page displays
important information on Client Connectivity,
Security Risk Detections, Outbreaks, and Client
Updates. One nice feature was that when we ran aserver update, update progress was displayed forindividual endpoint software components.
Client details and statuses are displayed efficiently
in the Client management tab. Client tree view canbe changed to Update view, Antivirus view, Firewall
view, among others, showing important
information for each client. Client groups can becreated, either using Active Directory, DNS domain,or administrator defined Custom client groups,
although setting this up was confusing.

Clients can be configured to use an Event-triggered
and/or Schedule-based update. By default,schedule-based updating is set to weekly, every
Sunday. However, we think that it would makemore sense to instead have event-triggered
updating enabled for when the OfficeScan server
has downloaded a new component. A one-click
manual update can also be carried out on both theserver and client components.

Effectiveness

3.5/5

Trend Micro performed well in the latest AV
Comparatives Summary Report, obtaining an
ADVANCED rating for the Removal Test and an
ADVANCED+ rating in the 2011 On-Demand Test. In
the March 2012 File Detection Test Reporthowever, Trend Micro ranked 3rd last out of 20
competitors, with a Total Detection Rate of 95.6%
for the On-Demand Detection of Malicious
Software Test. They also ranked 2nd last out of 20
in the False Positives tests, returning "very many
FP's".
Trend Micro has had limited testing in the VB100
results. It has been entered only 27 times, passing
16 times, giving them a success rate of 59%. The
last test occurred in April 2008, where they failed
with 3 WildList misses and 2 false positives.

Like Kaspersky, virus outbreak parameters can be
specified (in detections per hour), and when
triggered will send a notification to theComparative Analysis
Edition 1

Page 35 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Disclaimer and DisclosureThis report covers selected Enterprise Security products that were available at the time of testing. Version
numbers of software reviewed within this document are provided in the “Product Versions Tested” section ofthis report. With the exception of the performance test results and product effectiveness which are quantitative
measures, the product reviews herein represent PassMark Software’s subjective opinions and experiences ininstalling, configuring or operating each product. The metrics included in this report were selected by ESET LLC,
and the production of this report was funded by ESET LLC.

Disclaimer of Liability
While every effort has been made to ensure that the information presented in this report is accurate, PassMark
Software Pty Ltd assumes no responsibility for errors, omissions, or out-of-date information and shall not beliable in any manner whatsoever for direct, indirect, incidental, consequential, or punitive damages resulting
from the availability of, use of, access of, or inability to use this information.

Disclosure
Trademarks
All trademarks are the property of their respective owners.

Contact Details
PassMark Software Pty Ltd
Suite 202, Level 2
35 Buckingham St.
Surry Hills, 2010
Sydney, Australia
Phone + 61 (2) 9690 0444
Fax
+ 61 (2) 9690 0445
Web
www.passmark.com

Comparative Analysis
Edition 1

Page 36 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Appendix A – Performance Methodology
Client Image Creation
After installation of the client image, the following Windows services/features were disabled to minimize theimpact of Windows background activity and ensure the consistency of test results:
 Windows SuperFetch – Disabled for all tests. Re-enabled to allow boot time optimization functionality, andfor boot and restart time tests.
 Microsoft Search Indexer – Disabled for all tests.
 Windows Sidebar – Disabled for all tests.
 Windows Defender – Disabled for all tests.
 Windows Updates – Initially, Windows updates will be installed. Prior to baseline tests, Windows Updates
will be disabled and remain for the duration of testing.
After installation of each security product on the endpoint machine, variability of client activity has been limited
by disabling client product updates and automatic or scheduled scans.
Adobe Flash Player, Microsoft Word, Microsoft PowerPoint, and Microsoft Excel will also be installed on
endpoint machines prior to testing, in order to facilitate the On Access Scan Time tests.

Install size (Endpoint & Server)
Description

This metric measured the total additional disk space consumed by the endpoint client and the
management server components after installation.

Test Tool(s)OSForensics (formerly OSCheck)
By: PassMark Software
OSForensics can be used to capture and compare
signatures of disks, folders and files. Filecomparisons can be made between two signatures
to determine newly created files, modified ordeleted files.
Screenshot 8: PassMark OSForensics

Methodology










ResultOSForensics was used to take an initial disk signature prior to each installation to establish abaseline value.
The client component of the security product was installed on the endpoint machine.
Where possible, the package was installed via the network, i.e. deployed from the server
component through the network to the client machine. Deploying through the network more
adequately reflects a user’s ‘real’ installation experience.
Where applicable, PassMark has selected default options during client installation.
After installation, PassMark will initiate a manual update for the client software and thenrestart the endpoint machine to clear away temporary files.
After the manual update and machine restart, a second disk signature was taken.
Disk signatures were compared using OSForensics to discover the size and amount of files
added or modified during client installation.
The above steps were also applied to the server machine, but with the management server
software being installed instead.

The final result was calculated as the total size of additional files and changes in modified files (files
that were larger) after client installation, manual update and machine restart.

Boot time (Endpoint)
Description

Comparative Analysis
Edition 1

This metric measured the time taken to boot the machine, where an endpoint security product wasPage 37 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

installed.
Test Tool(s)xbootmgr and xperf
by: Microsoft
These tools are available from the Windows Performance Toolkit version 4.6 (as part of theMicrosoft Windows 7 SDK, obtainable from the Microsoft Website). Xbootmgr was used to optimize
the boot process, as well as to benchmark the time taken to boot the machine. Xperf was used toparse the detailed boot traces outputted by xbootmgr.

Methodology









ResultNetwork connections were disabled prior to and during this test to ensure consistent results
and minimize network interference.
The Windows service SuperFetch will be enabled prior to testing, in order for boot optimization
to function correctly. This process is disabled for the rest of testing to minimize background
activity.
Prior to boot time testing, xbootmgr was used to perform boot time optimization using thecommand “xbootmgr.exe -trace boot –prepSystem”. Optimization ensures consistent results.
After boot optimization, the benchmark test was conducted using the command "xbootmgr.exe-trace boot -numruns 5”.
The xbootmgr command boots the system five times in succession, taking detailed boot traces
for each boot cycle.
xperf was used to parse the boot traces and obtain the BootTimeViaPostBoot value. This value
reflects the amount of time it takes the system to complete all (and only) system startup
processes.

Our final result is measured in seconds (s) and calculated from an average of five (5) samples.

Machine Restart Time (Client)
Description

This metric measured the time taken for the machine complete the entire restart cycle. We
measured the time taken from the execution of a “Restart” command from within the operating
system, through shutdown and system startup, to when the operating system becomes
responsive to user interaction.

Test Tool(s)Rebooterby: PassMark Software
A test utility developed by PassMark software
which measured the time taken to complete a
restart cycle starting from the operating
system. Rebooted can be downloaded from our
website at:
http://www.passmark.com/products/rebooter.
htm
Screenshot 9: PassMark Rebooter

MethodResultComparative Analysis
Edition 1

Network connections were disabled prior to and during this test to ensure consistency andminimize network interference.
Prior to this test, we executed the boot time test. Prior to the boot time test, xbootmgr.exe
was used to perform boot time optimization to ensure consistent results. The effects of
optimization were in effect during the Restart Time test. SuperFetch was also enabled forthis test and for boot optimization to function correctly.
Rebooter was used to restart the machine from the operating system and measure the time
taken to complete each restart cycle.
The machine was restarted five times to obtain five test results.

Our final result was measured in seconds (s) and calculated from an average of five (5) samples.

Page 38 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

File Copy Performance – Large Set of Small Files (Endpoint)
Description

Test Tool

This metric will measure the time taken to copy a large set of small files between directories on
the endpoint machine.
CommandTimer
by: PassMark Software
A command line utility developed by PassMark software which measures and logs the time
taken to perform a task in a command prompt.

Method

Test File(s)At the start of each test cycle, the machine will be left to idle for five minutes to minimize
the impact of startup or background processes.
CommandTimer will measure the amount of time taken to copy a large set of small files toanother directory on a local drive using the xcopy command.
This test will be performed five times with a machine restart between each cycle.

A file set 659 MB in size, with over 821 files.
This file set is intended to represent a large set of small files found on an average user PC. It
includes a range of file formats such as Windows system files (DLL, EXE, CPL, UCE, etc), image
files (GIF, JPG, PNG), movie files (AVI, WM, RM), music files (MP3), Office documents (PPT, PPTX,DOCX, DOC, XLS) and PDFs.

Result

The final result is calculated as an average of five test results.

File Copy Performance – Small Set of Large Files (Endpoint)
Description

Test Tool

This metric will measure the time taken to copy a small set of large files between directories on
the endpoint machine.
CommandTimer
by: PassMark Software
A command line utility developed by PassMark software which measures and logs the time
taken to perform a task in a command prompt.

Method

Test File(s)At the start of each test cycle, the machine will be left to idle for five minutes to minimize
the impact of startup or background processes.
CommandTimer will measure the amount of time taken to copy a small set of large files toanother directory on a local drive using the xcopy command.
This test will be performed five times with a machine restart between each cycle.

A file set roughly 2.5GB in size, with over 11 files.
This file set is intended to represent a small set of large files found on an average user PC. It
includes a range of file formats such as data files (DAT), large image files (BMP, JPG), document
files (PDF, TXT), large archive files (ZIP) and installation executable files (EXE).

ResultComparative Analysis
Edition 1

The final result is calculated as an average of five test results.

Page 39 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

File Copy, Move and Delete (Endpoint)
Description

Test Tool

This metric will measure the time taken to copy, move, and delete samples of files in various
formats.
CommandTimer
A command line utility developed by PassMark software which measures and logs the time
taken to perform a task in a command prompt.

Method

Test File(s)At the start of each test cycle, the machine will be left to idle for five minutes to minimize
the impact of startup or background processes.
CommandTimer will measure the total amount of time taken to copy, move, and delete
each file in the file set.
This test will be performed five times with a machine restart between each cycle.

A file set 725 MB in size, made up of 812 files.
This file set is intended to represent a large set of small files found on an average user PC. The
file set consists of documents (26%), media files (54%), and PE files (i.e. system files) (20%).

Result

The final result is calculated as an average of five test results.

Network Throughput (Endpoint)
Description

Test Tool

This metric will measure the time taken to download a sample set of binary files of various sizes
and types over a 100MB/s network connection.
CommandTimer
by: PassMark Software
A command line utility developed by PassMark software which measures and logs the time
taken to perform a task in a command prompt.
GNU Wget
A GNU command line utility which sends a HTTP request and downloads the response to disk.

Method

Test File(s)The files will be hosted on a server machine running Windows Server 2008 and IIS 7.
At the start of each test cycle, the machine will be left to idle for five minutes to minimize
the impact of startup or background processes.
CommandTimer will measure the amount of time taken to download the sample set.
This test will be performed five times with a machine restart between each cycle.

A file set roughly 527MB in size, over 484 files.
This file set consists of two file categories: media files (74%) and documents (26%).

ResultComparative Analysis
Edition 1

The final result is calculated as an average of five test results.

Page 40 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Memory Usage during Idle (Endpoint & Server)
Description

This metric measured the total additional memory use consumed by the endpoint machine during aperiod of system idle where an endpoint security product has been installed.

Test Tool(s)SysinfoAvg
by: PassMark Software
A command-line utility developed by PassMark software which retrieved and logged memorycommit charge values (e.g. Total commit charge, Peak commit charge, etc) from Windows.

Methodology

Prior to testing, the endpoint machine was left idle for five minutes to minimize the impact ofstartup or background processes.
SysinfoAvg is configured to retrieve and log the system memory commit charge every 15
seconds for five minutes, for a total of 20 samples per test.
This test will be run on the first and fifth test cycle, for a total of two runs and 40 test samples.

Result

The final result was measured in megabytes (MB) and calculated as an average of 40 samples. Thisaverage was subtracted from the baseline to obtain the total amount of additional memory
consumed by the security solution.

Full System Scan Time (Endpoint)
Description

This metric will measure the average total time taken to run a full system scan on an endpoint
machine where an endpoint security product has been installed.

Test Tool

Stopwatch (or scan logs were applicable)

MethodResultPrior to testing, the endpoint machine was left idle for five minutes to minimize the impact
of startup or background processes.
A full system scan is initiated via the endpoint software’s interface and SysinfoAvg is started
immediately.
The scan is timed either manually with a stopwatch, or the time is taken from a reliable
record of the scan by the endpoint software.
The test is run 3 times in total.

The final result was measured in minutes (min) and is calculated as a weighted average, in which
the subsequent scans collectively have the same weighting as the initial scan.

Memory Usage during Full System Scan (Endpoint)
Description

Test Tool

This metric will measure the total additional memory use consumed by the endpoint machineduring a full system scan where and endpoint security product has been installed.
SysinfoAvg
by: PassMark Software
A command-line utility developed by PassMark software which retrieved and logged memorycommit charge values (e.g. Total commit charge, Peak commit charge, etc) from Windows.

MethodComparative Analysis
Edition 1

Prior to testing, the endpoint machine was left idle for five minutes to minimize the impact
of startup or background processes.
SysinfoAvg is configured to retrieve and log the system memory commit charge every 15
seconds for five minutes, for a total of 20 samples per test.
A full system scan is initiated via the endpoint software’s interface and SysinfoAvg is started
immediately.
This test will be run on the first and fifth test cycle, for a total of two runs and 40 test
samples.

Page 41 of 44
22 August 2012

Fast and Effective Endpoint Security for BusinessResult

PassMark Software

The final result was measured in megabytes (MB) and calculated as an average of 40 samples.
This average was subtracted from the baseline to obtain the total amount of additional memory
consumed by the security solution.

On Access Scan Time (Endpoint)
Description

Test Tool

This metric will measure the average additional time taken to run a script that automaticallybrowses a set of websites in IE and accesses three MS Office documents.
CommandTimer
by: PassMark Software
A command line utility developed by PassMark software which measures and logs the time
taken to perform a task in a command prompt.
AppTimerby: PassMark Software
An application developed by PassMark software used for automatically opening and closing anapplication and measuring the startup time.

Method

Test File(s)Prior to testing, the endpoint machine was left idle for five minutes to minimize the impact
of startup or background processes.
CommandTimer will measure the total amount of time taken to browse the set of popular
websites, and then open and close each document three times.
This test will be performed five times with a machine restart between each cycle.

A file set 659 MB in size, over 821 files.
The website set consists of the front page of 106 high traffic websites (e.g. shopping, social,news, finance and reference websites). The set of MS office documents consists of a Word
document (~10MB), a PowerPoint document (~1MB), and an excel document (~1MB).

Result

The final result was measured in seconds (sec) and is calculated as an average of five test results.

Memory Usage during On Access Scan (Endpoint)
Description

Test Tool

This metric will measure the total additional memory use consumed by the endpoint machineduring an On Access scan where an endpoint security product has been installed. (See On Access
Scan Time)
SysinfoAvg
by: PassMark Software
A command-line utility developed by PassMark software which retrieved and logged memorycommit charge values (e.g. Total commit charge, Peak commit charge, etc) from Windows.

MethodPrior to testing, the endpoint machine was left idle for five minutes to minimize the impact
of startup or background processes.
SysinfoAvg is configured to retrieve and log the system memory commit charge every 15
seconds for five minutes, for a total of 20 samples per test.
The On Access Scan script is run and SysinfoAvg is started immediately.
This test will be run on the first and second test cycle, for a total of two runs and 40 test
samples.

Result

The final result was measured in megabytes (MB) and calculated as an average of 40 samples.
This average was subtracted from the baseline to obtain the total amount of additional memory
consumed by the security solution.

Comparative Analysis
Edition 1

Page 42 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

Memory Usage during On-Demand Scan Task (Server)
Description

This metric will measure the total additional memory use consumed by the server machineduring the period in which On-Demand Scan Task is being run on an endpoint client.

Test Tool

SysinfoAvg
by: PassMark Software
A command-line utility developed by PassMark software which retrieved and logged memorycommit charge values (e.g. Total commit charge, Peak commit charge, etc) from Windows.


MethodResultPrior to testing, the endpoint machine was left idle for five minutes to minimize the impact
of startup or background processes.
SysinfoAvg is configured to retrieve and log the system memory commit charge every 3
seconds for two minutes (40 samples).
This test is run once, giving a total of 40 samples. If the task finishes before 40 samples havebeen taken, the test will be rerun in order to obtain the remaining samples.

The final result was measured in megabytes (MB) and calculated as an average of 40 samples.
This average was subtracted from the baseline to obtain the total amount of additional memory
consumed by the security solution.

Daily Network Traffic (Server)
Description

This metric measures the size and frequency of updates required by a security product.

Test Tools

Network Traffic Monitor
We investigated NetLimiter and discovered its ability to monitor bandwidth was restricted to
product pre-defined processes only (e.g. iexplorer.exe). We now propose to use Network Traffic
Monitor to monitor network traffic for services and processes.

MethodComparative Analysis
Edition 1

This test will be run in parallel to other performance testing.
All server modules are installed in separate virtual machines on a single host machine. The
single host machine will require a large amount of RAM and HDD space to support this.
Process(es) used by each security product to update, poll or monitor for updates will beidentified.
Network activity for relevant process(es) will be logged until the end of the project or one

Page 43 of 44
22 August 2012

Fast and Effective Endpoint Security for Business

PassMark Software

month (30 days), whichever comes first.

ResultUpdate Size: The final result is calculated as the total amount of data downloaded by the productover 30 days.
Update Frequency: The network activity log is analyzed and the download frequency described(e.g. polling every hour, scheduled download every day, etc) over 30 days.

IssuesMicrosoft Forefront required WSUS to be synchronized in order to access updates.

Comparative Analysis
Edition 1

Page 44 of 44
22 August 2012