December 04, 2012, 3:55 PM — Windows security tools may be good enough for home users, but can they meet the needs of the enterprise? Recently, my company's desktop team has been looking at Microsoft's built-in security software, with the idea that we should consider using those alternatives instead of commercial security software.
The desktop group is (finally) getting around to building a Windows 7 image for my company's desktop and laptop computers (yes, I know; it's about time). As part of this, the team is suggesting that we consider using Forefront, Windows Firewall and Bitlocker for antivirus, firewalling and encryption capabilities instead of the commercial products we now use with Windows XP. Why? Mainly because these tools are free and can be built into the image without as much work and testing as would be required with third-party software. The question is, are these tools as good as the commercial ones?
First, there's Forefront. This is antivirus software that is classically signature-based, like others. Is there really much differentiation among signature-based antivirus products? In my mind, the two key factors are effectiveness (how extensive is the malware signature database?), responsiveness (how quickly does the vendor turn around signature files for newly released, zero-day malware?) and manageability (how efficiently can administrators remotely install and manage clients and cleanup activities?). We currently have a top-tier antivirus product that works well and has had a good track record in my company's environment. That includes a typical less-than-24-hour response to zero-day malware, of which we do see a lot -- my company has an extensive presence in Asia, where much of the malware that gets onto our systems originates. I'm not particularly excited about giving up a perfectly good experience for an unknown quantity just because it's free.