Antivirus - Compliance Control

I've just been given a task to figure out the best way to verify that all our virus repositories are current.

Currently my company (we're in a 3 company merge) uses McAfee which I already have a procedure in place where a script checks the version of the dat files in each repository.

Another company (the largest) does it manually, as they have the man power to task some fool with checking the web and having him enter the info into a spreadsheet and create a ticket if there is a problem.

The 3rd company use Symantec and has no procedure for doing this and nobody tasked with making sure they are up2date.
Well now that I'm being involved, I found out yesterday that their repositories have not been updating since 8/15 and I'm the first to find out. I have fixed the problem, but I'm trying to figure out the best way for doing the check manually until I script it.

So if you go to http://securityresponse.symantec.com.../download.html you see what the numbers are for the latest version. When I look in the folder that LiveUpdate Administration Utility stores the files in, I don't see anything that has a number like on the website.

If any of you currently work with Symantec, can you point me in the right direction? Late last night was my first exposure to SAV.

I suggest you make a logical review of your processes.

All corporate AVs offer automatic update........... what the hell are you doing checking repositories for?

I would suggest something like:

Labrat...>repository.....>client

Let the AV automatically update the labrat(S) then test it then distribute to the repositories?

After that, all you need is a random audit to ensure that the system is functioning correctly?

Install the Symantec System Center on your computer, discover all your servers and manage them from there. This will tell you what versions are installed, the last scan, and the definition dates.
You will have to download the System Center from the support site (I assume you have a support agreement).

Cheers:

Quote:

---

Originally Posted by nihil

I suggest you make a logical review of your processes.

All corporate AVs offer automatic update........... what the hell are you doing checking repositories for?

I would suggest something like:

Labrat...>repository.....>client

Let the AV automatically update the labrat(S) then test it then distribute to the repositories?

After that, all you need is a random audit to ensure that the system is functioning correctly?

---

All 3 companies (different AV products) have 1 main repository, then other repositories that update from the main one. We're being required to verify that the automatic process is working properly. Mainly looking for what I found yesterday, that one of the companies is a month behind on updates while the other two are just fine.
The controlling company want this to have a manual process of somebody reviewing the versions and submitting evidence that they checked. This way if somebody doesn't check, there is somebody to blame.

We have Symantec System Center, but I have no way to script checking the updates using Symantec System Center. I'm guessing SSC uses some kind of database, but I'm not sure what kind of backend its using or where it is located.

I'm sure Nagios could be set up to set an alarm out if a node does not have the lated dat file.

McAfee ePo orchestrator can produce a report about the state of all the nodes it is installed on.

Cant help with the symantic stuff as I would not let a symantic disk in the bulding, much less let it near one of my computers...

Nokia,

You are a liar!

Quote:

---

Can't help with the symantec stuff as I would not let a symantec disk in the building, much less let it near one of my computers...

---

That is how you stop coffee rings on top of your kit..............?

:pelkgrin

Go with AVG Network edition - works best with my companies.

We use Symantec. Our users were the proverbial canaries in the coal
mine. They always let us know when our SAV server isn't pushing out
updates, until we got upgraded to 10.1.6 (what a nightmare). We here
from users constantly about the current state of AV defs, but then a
lot of them are engineers and very technically oriented. A couple even
did support in their past lives. And that can be a bad thing. Some users
have full admin rights, and one hardened his laptop so there's no remote
admin'ing the thing. Ugh, makes it tough for control freaks like me...

What versions of the products are you using? Assuming you are using a remotely current version, why not leverage the functionality built in. McAfee has ePO and Symantec has System Center. In either event, the clients should automatically be reporting that information to the server and it should be as simple as calling up the current reports.

I detailed the issue in another post and am reluctant to belabor it
anymore, except to say we are very much unstaffed onsite (two
people onsite handling support for almost 400 PC's and over 100
remote users). When the SAV server got upgraded remotely (sans
testing!), many clients weren't reporting. On top of that, there
were software conflicts that caused numerous problems and workarounds.
We're actually running three different versions of SAV right now,
managed (onsite) and unmanaged (offsite and workarounds). The
different offsite teams, haven't spent the time to learn the environment
and expect everything to work remotely. And when it doesn't, it
ends up in our laps onsite. It's a tough scene and one very much
in transition.

Yes, Symantec's control center works great if all the computers, onsite
and off, are managed (they're not!) and the environment is stable (it's
not!).

The whole problem is we are required to check it daily to be in compliance with our procedures (set by the parent company).

We have about 20 IT people for North America, 15 are user support, help desk, whatever you want to call the desktop guys. We have a lot of crap to work on, a lot of problems caused by this three way integration.

The procedure requires a manual check of the AV vendor's website for the latest version, a manual check of each server that servers and end users pull updates from, the data to be recorded into a spreadsheet, the name of the operator that checked it, and date and time.

Rather than waste the time of any of the already overwhelmed staff members we have, I will automate this process.

1.) The automated process will wget and grep the latest info from the server.
Solved.

2.) Automatically determine what version that is on each server.
Solved for McAfee, Symantec is what I was looking for help for.

3.) Send an email with the data highlighting any servers that are not current, with a url to follow to that marks the records as having been checked.
Solved.

4.) Have a simple report that I can use for evidence instead of a spreadsheet.
Solved.

I am almost done with the process, I was just looking for some knowledge from some of the very knowledgable Symantec users I know browse these forums. I am waiting on approval to access these servers that I currently do not have access to, when I get it I will finish the project.