Endpoint Protection

Introduction

By popular demand, below is an index of my Connect articles.  Illustrated, semi-formal and mildly amusing, I hope they assist admins and individuals along their neverending quest to find a safe path in this ever more dangerous world....

Security Series

• The first article, Using SEPM Alerts and Reports to Combat a Malware Outbreak, demonstrated how to use reporting features of SEP 12.1's SONAR component to identify Suspicious files for which there were no AntiVirus signatures yet created.
• The second, Recovering Ransomlocked Files Using Built-In Windows Tools, deals with a few possible ways how to prevent and recover from one of today's most-destructive threats, should it infect your network and hold your data hostage.
• Third came Two Reasons why IPS is a "Must Have" for your Network, which illustrated how SEP's optional Intrusion Prevention System (IPS) component can help security admins keep their organization secure and track down infected computers on the network
• The Day After: Necessary Steps after a Virus Outbreak is for use after the attacks have ended.  This fourth article intends to help admins prevent further attacks and make recovery from any future infection as painless as possible.
• Killing Conficker: How to Eradicate W32.Downadup for Good gives admins the techniques they need to eliminate one of their network's most persistent pests: W32.Downadup, also known as the Conficker worm.
• Symantec Insider Tip: Successful Submissions! aims to provide advice and examples of how to get your suspicious files to the correct team, in the correct format, with all the correct information necessary for speedy processing
• All About Grayware describes software classified as “Potentially Unwanted Applications” (PUA) and Symantec’s response to them.
• SEP Times in the City: A Helpful Symantec Endpoint Protection Analogy provides an offbeat way to understand the various components that comprise the Symantec Endpoint Protection suite of security.
• Using Today's SymDiag to Combat Today's Threats illustrates how best to use the current SymHelp to identify suspicious files on a computer and get them submitted to Symantec Security Response.
• Support Perspective: W97M.Downloader Battle Plan gets down to some practical particulars on how to take a Defense in Depth approach to combat the current flood of malicious macro spam.
• Number eleven, How Premium Support Customers can Sign Up for Alerts and Notifications, illustrates how BCS customers can log in to the Customer Subscription Portal and configure their desired communications.
• Does Symantec Detect This: An Illustrated Guide to Public Hash Submission informs Enterprise customers how to use this powerful new submission method.
• For a little-known shortcut that can defeat the mustache-twirling villains who never cease trying to infect your network through your own mail infrastructure, read Delver of the Arcane Archives!
• Sequence Makes Sense.  With the cross-referencing trick illustrated in this article, you will swiftly be able to determine if your Symantec products have the definitions necessary to combat a new threat.
• Do this TODAY.  Hardening Your Environment Against Ransomware.
• The first of a mini-series on exclusions: Exceptions, Illustrated: Part One.  How to keep SEP from scanning content that you don't want detected.
• Exceptions, Illustrated: Part Two illustrates a few common situations.
• What NOT to Click.  Symantec Security Response and Technical Support are always advising end users, "Be suspicious and think before you click: Never view, open, or execute any email attachment unless you expect it and trust the sender."  What exactly do they mean?  What should mail recipients be careful about?  This article shows you.
• A mildly-amusing sequel What NOT to Click 2: The Legend of Curly's Gold will help you to recognize phishing .pdf attachments.
• Article number 20! What You Can Do About Powershell Threats
• High Noon for the Cryptominers​. Why is SEP not detecting this suspected bitcoin miner? 
• The "IT admin Johnny" mini-series continues in Who Killed Symantec Endpoint Protection?  A few tips and tricks on what to do if SEP has been mysteriously removed.
• Killing Wannacry: How to Eradicate Ransom.Wannacry for Good gives admins the techniques they need to eliminate one of their network's most persistent ransomware pests.
• In the 24th exciting episode, Support Perspective: Investigating DNS.EXE Intrusion Prevention System Events provides tips on how to track down the true source of security incidents or infections that are flagged upstream on a DNS server

Subscribe to my articles to be alerted to any new Security content!

The following are no longer maintained, but still may be useful.

Symantec AntiVirus for Linux Series

• SAV for Linux Scanning Best Practices: A (Somewhat) Illustrated Guide covers the importance of auto-protect scanning, necessary scan exclusions and how to test them
• SAV for Linux: A (Somewhat) Illustrated Guide Part 2 provides examples of the various different ways in which SAVFL can be configured (by command line, by GRC.DAT and by xsymcfg).
• SAV for Linux: A (Somewhat) Illustrated Guide Part 3 focused on how to keep SAV for Linux up-to-date.
• SAV for Linux: A (Somewhat) Illustrated Guide Part 4: SAVFL Reporter focused on how to get some data and events from those isolated, unmanaged SAVFL clients into the Symantec AV's central management and reporting tool, the Symantec Endpoint Protection Manager (SEPM).

LiveUpdate Administrator 2.x Series

• Managing LiveUpdate Administrator 2.x Space Usage
• Using IIS Logs to Check LiveUpdate Administrator 2.x Health
• How Big are Current Symantec Endpoint Protection Definitions?
• A Helpful LiveUpdate Administrator 2.x Analogy
• LiveUpdate Administrator 2.x Server Connection Recommendations
• Illustrated Guide to Configuring LiveUpdate Administrator 2.x for SMSMSE 6.5.5

 Symantec Endpoint Protection Series

• Creating Application Control Exclusions in Symantec Endpoint Protection 12.1

Symantec Mobile Security Series

• Illustrated Guide to Installing Symantec Mobile Security 7.2
• Getting to Know the Symantec Mobile Security 7.2 Client
• Upgrading Mobile Security Gateways for Symantec Mobile Security 7.2
• About Windows Mobile in Symantec Mobile Security 7.2

Conclusion

Many thanks for reading!  Please do leave comments and feedback below.