Does McAfee support vShield Endpoint?

[vmsf]

We are planning on using vShield Endpoint for our View deployment. Does anyone know if McAfee provides support for Endpoint?

[AndreTheGiant]

Seems yes:

http://www.vmware.com/files/pdf/vmworld/security-media-backgrounder-en.pdf

But not yet.

Andre

[vmsf]

Thanks Andre.

Do you know when will it be supported?

[AndreTheGiant]

I've no idea (I do not work for McAfee).

I only hope that this time the product will be released soon... With the VMsafe all vendors have make annouce to support... but no product was released.

Andre

[dlinkadsfa]

Macfee does have beta going on, i am sure they will announce something at their conference in October.

[DwayneL]

i did notice macfee was disconnecting some of our session with PCoIP in View 4.01, so sooner they better is right. If you are using 8.77i make sure to clean the GUID from the product. Macfee offers a bat script to do this for you.




-Dwayne Lessner

[RickBoyett]

A McAfee rep gave us a presentation last week. He only had a few details about their Endpoint product but said it was going to be announced on Oct 1st.

We shall see.

[marco_van_es]

McAfee annouced McAfee Management for Optimized Virtualized Environments (MOVE).

It sounds similar to vShield Endpoint: "a lightweight endpoint component communicates to the McAfee MOVE virtual appliance to broker the anti-virus processing on behalf of each virtual machine desktop" but as I understand it doesn't use VMware vShield.

Maybe McAfee will release a vShield product Q1 2011?

[jefft201110141]

Hey Guys,

Currently Trend is the only vendor with a commercially available vShield Endpoint offering called Deep Security.

You can find out more info at:

http://us.trendmicro.com/us/products/enterprise/datacenter-security/deep-security/

and download a trial version at:

http://www.trendmicro.com/download

Feel free to ping me if you have any questions.

Cheers,

Jeff

[Vodder]

Hi Jeff,

In relation to this then, I am right in thinking not only do you need the VMware vShield Endpoint licenses you will also need the license from Trend (or whoever in the future)?

We were quoted for a client at academic prices $1000 including 1 year support per 25 VMs. I don't know what Trend charges for the Security appliance (SVA) as referenced in the admin guide but this could get rather expensive.

In the end though this client actually got the endpoint licenses free in a promo but it would appear it's all irrelevant without buying the Trend SVA as well?

Cheers

Tim

[Vodder]

It appears that you do need both; I understand the logic just wish it had been a bit clearer.

Sorry to hijack the thread but hopefully that helps someone else out.

[jefft201110141]

Hey Tim,

You are correct. vShield Endpoint deployments will require vShield Endpoint as well as Trend Micro Deep Security licenses.

vShield Endpoint is a loadable kernel module that manages communication between VMs and the Deep Security Virtual  Appliance

(DSVA) in offloading anti-malware functionality.

vShield licenses are included with VMware View Premiere which will help lower costs in some cases. Trend also offers academic pricing

and we would be happy to set up a call to discuss if your interested.

Cheers,

Jeff

[Vodder]

Thanks Jeff, we'll hit up our channel contacts

[admin]

A vShield Endpoint integrated solution was announced on April 4th 2012:

http://www.mcafee.com/us/about/news/2012/q2/20120404-01.aspx

"McAfee today announced a new agentless deployment option for McAfee Management for Optimized Virtual Environments (MOVE)  AV solution which provides comprehensive defenses against all types of  physical and virtual attacks through a single high performance console.  In addition McAfee MOVE AV is designed to integrate with VMware vShield™ Endpoint and offers businesses standardized security across all major  hypervisors enabling complete security management and delivery for  virtualized environments."

[Mdove]

I've been using now for a couple of weeks.

You can obtain the trial version from http://www.mcafee.com/apps/downloads/free-evaluations/default.aspx?region=us&pid =16650

I’ve built a pool of TimeBomb VMs using task scheduler and EICAR test virus.  When triggered I get a bit of latency till the log in eOP reports it but it’s captured and cleaned on the VM right away.  I don’t like that the IP address that is reported in the log is from the SVA and the VM.  I’m looking into that as I’m no ePO expert.

Remember ALWAYS Practice Safe Computing

[vmsf]

Any performance testing results you can share i.e. how much cpu\mem\IO improvement can be achieved?

[Mdove]

No improvement stats as I only ran the agentless solution.  I'd be open to doing some more testing, time permiting.  Help me out here, what did you have in mind?  What would be the most helpful stats to have?