Microsoft_Security_Essentials

Microsoft Security Essentials On 23 Jun 2009 Microsoft release Microsoft Security Essentials (MSE) is a client based malware service that can run on XP, Vista, and Windows 7. MSE, competes with the likes of Symantec and other well established companies in the anti-virus market. This paper will examine the types of attacks it can protect you against, how MSE works, and its limitations. To determine were MSE stands AV-Comparative 2009 annual report will be used in conjunction with the most recent February 2010 report to extract details. AV-Comparatives are an independent, non-profit, anti-virus testing organization who has published annual reports since 2004. Their objective based testing is the basis for this report and should be reviewed prior to making your own decision. AV-Comparatives pre-screened numerous vendor products to find the top 16-20 vendors to test and MSE was one of the products selected. They then compared 16 products in 2009 report to determine how the each product affected system performance, detection, and false positive rates (AV-Comparatives, 2009). The individual tests were scored worst to best as “standard”, “advanced”, and “advanced-plus” The first test determined how well each product could detect malware using default settings. MSE scored “standard” in this test 2009 but upon further research into specifically why, AV-Comparatives updated the rating to “advanced” (AV-Comparatives, 2010). MSE while respectable missed 2% of malware compared to Symantec, malware scripts being its weakest performance at 77% detection rate. Over all MSE missed about 40,000 of 1.2 million known malware. The next test modified each programs setting to the highest level of detection. Essentials won the category because of its very low false positive rate that was a third of the NOD32 who took second place. The fact that you have to change setting from defaults, which many users never attempt, means that this is less important the first test. This means Microsoft could at any point easily change the defaults during an update and possibly win the first test also. Detection and false positives mean little if the program negatively affects accomplishing daily tasks. MSE rated “standard” in performance which was confirmed by numerous users that had posted complaints in forums. The program rated in the bottom 25% in performance which had caused some users to find a competing solution. By default the program only accomplishes a quick scan on files that have the greatest possibility to be attacked. When major releases are released the program will ask you to run a full scan, and MSE took over three times as long as Symantec to scan the files for infection. If users perfume a full scan once and it doesn’t allow them to use the machine as they could be the last full scan they ever perform. For the malware it does detect how well does MSE remove the threat' Once malware is detected you know you have a problem but no solution. How well a program is able to defeat the malware is the other half of the solution. Microsoft took third place in this category. If you consider that with more advanced viruses the product has to do much more than just delete a single file this is commendable. When viruses first appeared in the wild in the mid-eighties you had a one-on-one solution for each virus and MSE can now defeat hundreds of thousands of malware in a single package better than many of it pears. How does MSE detect and clean malware' MSE uses a database of known malware that it compares to each file on your computer, and if any of that code is detected it will isolate the file so it can be accessed. The interface will then alert you and ask if you would like to clean the file if that is an available solution or to delete the file in most cases. This is both a safeguard against false positives and to let the user know which file will no longer be available. If MSE detects code that is similar to a know malware it send that code to Microsoft for review and if found to be a new valid threat Microsoft will release this as a new profile. Microsoft pushes profile updates three times a day and then your system will scan at the normal time you have set in the MSE preferences. MSE can perform but what about cost. Essentials is free, which is great considering the packages it was compared to were paid for application most with a $30-$70 a year subscription fee. Free mean accessibility to more of the community. There are many users that to consider their data as important, they want to surf and check mail. The user cares if the machine works so will go for the cheapest easiest solution available and MSE has those characteristics. Finally I will share my opinion. MSE is dead simple and can’t be beat when comparing price versus performance. I replaced AVG-Free on my home systems back in November and have not noticed any problems or performance hits since that time. Previously I had to run several products and run scan manually. If Microsoft hadn’t been sued for anti-competitive practices this product would have more than likely been a part of Windows 7. If you aren’t running a paid anti-virus program I would add Microsoft Essentials to your short list of malware protection to research because MSE scored a 19 of a possible 24 where as the winner, Symantec scored a 22. [pic] http://www.av-comparatives.org/comparativesreviews/main-tests/summary-reports References Anti-Virus Comparative Report, February 2010 (Rep. No. 25). (2010, February). Retrieved from AV-Comparatives website: http://www.av-comparatives.org/‌images/‌stories/‌test/‌ondret/‌avc_report25.pdf Anti-Virus Comparative Report 2009. (2009, December). Retrieved from AV-Comparatives website: http://www.av-comparatives.org/‌images/‌stories/‌test/‌summary/‌summary2009.pdf ----------------------- 4