PC Protection

Organizations seeking greater flexibility in the protection of endpoints
should consider the Trend Micro Enterprise Security for Endpoints Advanced
software suite, which secures PCs, Macs, Linux boxes and smartphones by guarding
against malware.

End-User Advantages

Like most manufacturers of anti-malware programs, Trend Micro compares a
file's binary contents with various patterns that are signatures of
malware. But scanning against all of those patterns can slow performance.

Trend Micro has introduced two new features to offload a portion of that
processing from endpoints and move it to the data center. The first, called
File Reputation, pushes some of that intensive scanning back to a server.
My workstation did a quick analysis of a test file, sending key parts back
to a server to determine whether the file was infected.

The second feature, Smart Query Filter, serves as a whitelist by allowing
a workstation to determine whether a file is infected before it even talks
to the server.

I tested the product on Windows XP, Windows 7, Windows 2003 and Windows 2008,
but Trend Micro also works with Mac OS, popular Linux distributions and Novell
NetWare.

Why It Works for IT

Enterprise Security for Endpoints Advanced integrates with Microsoft Windows
Active Directory, allowing administrators to craft policies for different
Organizational Units (which could represent different types of servers or
workstations).

The endpoint security product also offers web protection. Every time a user
accesses a new website, the software checks the URL against a list of suspect
websites; if it finds a match, the user is prevented from accessing that site.
To test this feature, I disabled the phishing filter in Internet Explorer
and navigated to the Microsoft Contoso phishing test site, which Trend Micro
blocked. I even went so far as to test some of the phishing attack e-mails
in my junk e-mail bin, and it caught every one.

The product also comes with role-based administration, which allows IT to
delegate some operations to Tier-1 or help-desk support. System administration
is granular almost to a fault -- just about every element in the graphical
user interface can be controlled.

There's also a plug-in architecture that allows users to add functionality
to the endpoints from a central console. For example, say a new zero-day exploit
has recently come out that is triggered by a website whose URL is more than
1,000 characters in length. You can simply instruct the clients to reject
any URL over 1,000 characters until the pattern file comes out that protects
against that particular exploit, all from the central console.

Disadvantages

Enterprise Security for Endpoints Advanced includes a mobile client that
comes with standard malware protection and a firewall, but it doesn't
yet support the Apple iPhone.

Also, the Active Directory policy integration considers only computer objects
in Active Directory, not users. Hence, you can't deploy a policy based
on the user who has logged onto the system, only on the system itself. However,
this issue likely affects only users who are in a shared computer environment.

You may also find that the software does not work properly on Novell Open
Enterprise Server platforms. Trend Micro's support staff has worked
through these issues and can assist you.