What criteria do you use for evaluating Client-Side / Endpoint security products?

Question

What features are important to you in client-side AV and Firewall products?

Who benefits from these features? Managment, the end user, helpdesk.

Are there features that are being 'sold' by the vendor, or managment, that provide no real value in your perspective?

Answer 1

Here are some criteria that I use:

• Functionality --- does it actually work?
• Usability --- Can it be used by our users? Has the company done any formal user testing? Can we get the results of those studies?
• Vendor Reputation --- these tools can do a lot of damage if they are buggy or have security holes. How well do we know and trust the vendor? Why?
• Documentation --- does it exist?
• Manageability --- are there centralized facilities for reporting and control?
• Vendor Protection --- if the vendor screws up, what happens to my organization?

Answer 2

1) Footprint. We already run a number of things on the client so we want them to be as lean as possible. Where possible we stick with the same vendor since they are more likely to combine agents and lower the overall footprint.

2) Dependencies. The more we install on the client the more we have to juggle when things upgrade or delay upgrades. A common thing is to see if this requires a specific version of Java or .Net.

3) Management of the software. Can it tie into anything we already own for management? Does it integrate with other systems for layered security? Or is it just another silo?

We are big proponents of having as few vendors as possible and helping them refine their products over time to meet our needs. In the end I think these things help everyone. The end users get something that works well and is unobtrusive; the help desk gets something that doesn't break as often, the IT analyst gets something that integrates with what they already know and Management gets a generally less expensive product since we usually get bulk license discounts (for owning a lot of software from that same vendor).

Sometimes we get software that doesn't do everything we want, but we are okay with that if the vendor is honest and willing to implement the other features. It's not uncommon for our IT shop to be told something can't be done by the vendor that built a product, then prove them wrong. Because of that we don't expect most off the shelf software to do everything we can think up or plan to do with it; but if the vendor is willing to work with us we'll gladly be their pilot site.