Endpoint security products aid in client defense

F-Secure provides an excellent Web-based reporting module for generating graphs on a number of data points, including virus infections, general alerts, system status and attack details. Reports can be exported to a variety of formats including CSV, HTML and XML .

Sygate provides some log viewers and a mechanism for generating graphs from the logs in the database. It also includes the ability to view statistics on client status by group or individual system, which lets you see which clients have not reported in for a while that may require investigation. We would like to see reports generated for this information.

Check Point includes a reporting section, but it generally is just providing query results from the logs. We would like to be able to create graphs and summary reports, and export to PDF or another format. Print views are available in HTML, but they only show the query results displayed onscreen, not all of the results. We also would like to see options for custom reports and the ability to generate reports from the client status monitor information.

Symantec does not include any reporting functionality. If the client is online, you can remotely view the local client logs. InfoExpress includes a Web reporting console, but it needs to provide more information and options. The reports generated are minimal and did not provide a way to export them.

Conclusions

From an attacker's perspective, a client endpoint system is a viable path of attack into a company. Therefore, the ability to defend these systems and the ability to centrally manage and monitor their defenses are important components of any network defense strategy.

While these products offer significant defensive capabilities, depending on which defenses are important in a network, the state of the art is not at the level where it offers a sufficient level of resilience against the state of the state of the attackers. Improvements in reporting and management, improvements in containment techniques and improvements in the types of attacks the products detect are needed.