SlideShare ist ein Scribd-Unternehmen logo
1 von 9
Downloaden Sie, um offline zu lesen
#211101
                                                                                                                    February 2011
                                                                                                        Commissioned by Trend Micro, Inc.



             Trend Micro Deep Security 7.5 vs. McAfee and Symantec
                  Anti-virus Performance in VMware ESX Virtual Environments

Executive Summary                                                                         TEST HIGHLIGHTS
Server and desktop virtualization are essential elements of any IT                The Trend Micro Deep Security Virtual Appliance:
strategy that seeks to decrease capital and operational
expenditures . In the rush to implement virtualization technologies,         1    Demonstrated consistently lower demand for
                                                                                  system CPU, memory and disk I/O over traditional
many organizations simply deploy the same anti-virus solution that
is in use on their physical server and desktop systems. Because these             agent-based solutions even during periods when
traditional anti-virus solutions are not designed specifically for                the workload was designed not to stress AV
virtual environments, they can create significant operational issues
such as anti-virus (AV) storms, resource wastage and administrative
overhead, and hamper the organization’s objective of maximizing              2    Successfully avoided AV storm issues with
                                                                                  scheduled scans and pattern updates that
VM densities.
                                                                                  prevented other solutions from testing beyond
Trend Micro, Inc. commissioned Tolly to benchmark the                             25 VMs
performance within virtual environments of the Trend Micro Deep
Security solution vs. McAfee Total Protection for Endpoint and

                                                                             3
Symantec Endpoint Protection 11.0. Specifically, this testing                      Demonstrated density improvements of 29% to
evaluated the impact each solution had on host system (physical                    275% over McAfee and Symantec running test
server) resources especially as guest machine density increased to                 workloads
up to 100 virtual machines simultaneously running in a VMware ESX
4.1 environment.
Tests showed that Trend Micro Deep Security, which provides an agentless virtual appliance-based approach to anti-virus protection optimized
for virtualization, consistently consumed less CPU, RAM and disk I/O resources than the non VM-aware implementations where anti-virus
agents and processing resided in each and every Windows 7 virtual machine.
In addition to consuming 1.7 to 8.5 times the resource overhead of the Trend Micro solution in the general workload test, the traditional AV
solutions were seen to face AV storm challenges when tested at peak activities (i.e., running on-demand scans and signature updates) when
operations on 25 VMs were triggered simultaneously. Specifically, when Tolly engineers attempted to remediate the competing systems
immediately and, because the traditional solutions were not VM-aware, management station requests for, say, 25 virtual machines to run on-
demand scans or update signature files triggered all of the virtual machines to begin execution of the function simultaneously resulting in a
surge in demand on host resources such as CPU and memory.
Ultimately the savings in resource consumption afforded by Trend Micro Deep Security allows organizations to increase virtual machine
densities, i.e. the number of VMs that can be run per host, enabling capital expenditure (CAPEX) and operational expenditure (OPEX) savings
for the organization. The VM density improvement made possible because of Trend Micro’s lower resource consumption and AV storm
avoidance in the proprietary workload tests ranged from a minimum of 29% (when running a workload that did not stress AV) to a maximum
of 275% (during AV storm periods) over McAfee and Symantec




 © 2011 Tolly Enterprises, LLC                                              Tolly.com                                            Page 1 of 9
Trend Micro Deep Security 7.5                                                                                                                         #211101



                                                                        Anti-virus VMware ESX 4.1 Host Resource Consumption vs. Baseline
Tolly engineers benchmarked security
                                                                     Up to 100 Virtual Machines Running Proprietary Workload under Microsoft
system resource utilization by running
                                                                                                    Windows 7
various workloads on up to 100 virtual
                                                                                 As reported by vCenter (Lower numbers are better)
machines simultaneously. A baseline was
established by running a workload                                                                                         CPU




                                                                    % vs. Baseline
simulating various end-user functions on
systems that had no endpoint security
solution installed and measuring resource                                              40
consumption.                                                                           20
Testing included benchmarking resource                                                  0
consumption when running specific anti-                                                      25               50                           75                         100
virus tasks (on-demand scan and signature
                                                                                                           # of Virtual Machines
updates) as well as a more general user
workload with anti-virus protection present                                                                               RAM
on each virtual machine.
                                                                                       70
Anti-virus Resource Utilization with                                                   60
                                                                      % vs. Baseline




Simulated Workload (25 to 100                                                          50
Virtual Machines)                                                                      40
                                                                                       30
Figure 1 illustrates average utilization levels
of key system resources at the VMware ESX
                                                                                       20
server level when running the primary test                                             10
workload with up to 100 simultaneous                                                    0
virtual machines. (See Table 4 for individual                                                25               50                           75                         100
data points.)
                                                                                                            # of Virtual Machines
These figures include the resources used by
the virtual machines as well as, for Trend                                                                                 DISK
Micro, the resources used by the Deep
                                                                   % vs. Baseline




Security virtual appliance. See the Test                                               400
Methodology and Testbed Setup section for
details on the workloads and environment.

Both McAfee and Symantec solutions                                                     -15
required that a separate instance of the AV
                                                                                             25                 50                          75                         100
agent run in each virtual machine. Trend
Micro Deep Security required one instance                                                                    # of Virtual Machines
of its virtual appliance per host. The figure
                                                                                             Trend Micro              McAfee                      Symantec
illustrates how, at all VM density levels, and
                                                                 Note: All systems running proprietary workload in addition to scan. Baseline is proprietary
across all three resources - CPU, Memory                         workload running with no endpoint security solution installed. See report body for baseline values
and Disk Usage. Symantec and McAfee                              and detailed results. Utilization over baseline is calculated by subtracting baseline from result,
consumed 1.7 to 8.5 times the amount of                          dividing by baseline and multiplying by 100. As McAfee was unable to complete the 100 VM test,
resource overhead required by Trend Micro.1                      results for 100 were extrapolated from the 25, 50 and 75 VM tests. Average of 30 minute run. Disk
                                                                 usage results vary up to 30% and are include for reference purposes only.
                                                                 Source: Tolly, October 2010                                                                    Figure 1

1 The McAfee solution was unable to complete the 100 VM test despite multiple attempts and re-runs.. Tolly engineers extrapolated the McAfee 100 VM results from the McAfee 25, 50 and 75

VM test results.

  © 2011 Tolly Enterprises, LLC                                                                      Tolly.com                                                        Page 2 of 9
Trend Micro Deep Security 7.5                                                                                                             #211101




                            Anti-virus VMware ESX 4.1 Host Resource Consumption Overhead vs. Baseline
                                 Request On-Demand Scan of 25 Virtual Machines Running Microsoft Windows 7
                                              As reported by vCenter (Lower numbers are better)
                                                                        394
                   350             308                 400                                   2500
                   300                    274                                                                                                         2,053 2,143
                                                                     320                                                     2000
  % vs. Baseline




                                                    % vs. Baseline




                                                                                                            % vs. Baseline
                   250
                   200                                               240                                                     1500
                                                                                            183
                   150                                               160                                                     1000
                            81                                                                                                                 693
                   100
                                                                      80      32                                               500
                    50
                     0                                                 0                                                           0
                                  CPU                                              RAM                                                                Disk
                                    Trend Micro                                McAfee                                         Symantec

 Note: All systems running proprietary workload in addition to scan. Baseline is proprietary workload running with no endpoint security solution
 installed. Baseline values: Average CPU = 4,109.76 MHz, Average RAM = 7,893.28 MB, Average Disk = 1,741.23 KBps. Trend automatically runs only a
 single scan at one time. Other vendors triggered 25 simultaneous scans. Each vendor recommends various methods such as randomization for load-
 leveling on-demand scans. See report body for details. Utilization over baseline is calculated by subtracting baseline from result, dividing by baseline
 and multiplying by 100. Average of 30 minute run.

 Source: Tolly, October 2010                                                                                                                                       Figure 2


Anti-virus On-Demand Scans                                   By default, the other solutions (that are                       during the test and disk latency (not
(25 VMs) Test                                                unaware of the shared, virtual environment)                     illustrated in the figures) was noted to
                                                             attempted to initiate simultaneous scans of                     average 31 ms. With the McAfee on-
Engineers evaluated how each solution                        all 25 machines. Figure 2 provides the                          demand scan scenario, disk latency was
responded to a security management                           average resource results for those tests                        noted to average 80 ms. During the test, 14
system request to conduct a full scan on 25                  where McAfee resource consumption                               out of 25 users were not able to access their
virtual machines. Being resource intensive in                overhead was 2.8 times more than Trend                          desktops. See Table 2 for additional
nature, simultaneous scans can degrade                       Micro for CPU and 11 times for RAM.                             commentary.
overall user experience.                                     Symantec resource consumption overhead
                                                             was 2.4 times more than Trend Micro for                         Traditional solutions generally recommend
Trend Micro Deep Security was aware that it                                                                                  two approaches to avoid vir tual
                                                             CPU and 4.7 times for RAM.
was running in an environment where                                                                                          environment resource contention -
resources were shared across all VMs and                     In addition, the 25 VM data set for Symantec                    randomization and grouping. Neither of
automatically scheduled scans to run serially                and McAfee does not provide the complete                        t h e s e a p p ro a c h e s p ro v i d e s a ny
- a maximum of 1 machine running at a                        picture with respect to reliability and user                    virtualization awareness and, thus, were
time. As a result, Deep Security was able to                 experience. The surge in resource demand                        outside the scope of this test.
successfully test at 25 and 50 VMs. Based on                 from the McAfee and Symantec solutions
the resource utilization observed in these                   often degraded the user systems. In                             With randomization, an administrator can
tests, Tolly projects that the Trend Micro                   particular, neither Symantec nor McAfee                         set up the randomization period to let
solution could support a scenario of more                    solutions were able to be tested beyond 25                      endpoints run tasks with random start
than 100 VMs.                                                VMs. In the Symantec test, 2 agents lost                        times. For time consuming tasks like full
                                                             connectivity with the management server                         scan, this time period needs to be very long


 © 2011 Tolly Enterprises, LLC                                                          Tolly.com                                                            Page 3 of 9
Trend Micro Deep Security 7.5                                                                                                                     #211101



(more than a day or a week depending                               other. As a result, when facing a critical                           immediately. Also, the random tasks may
upon the host’s VM density) to increase the                        security threat, enterprise administrators                           degrade user experience if they run when
chances that client tasks won’t overlap each                       may not be able to remediate their systems                           system usage is already high.


                                              Anti-virus Solution Scalability Under VMware ESX 4.1
                                   On-Demand Scan Scenarios of Virtual Machines Running Microsoft Windows 7
                   Vendor         Product                                          Number of Virtual Machines Targeted for On-Demand Scan
                                                                                                           e                           a

                                                     25                                   50                                           75                        100

            Trend Micro,     Deep Security     Yes, completely              Yes, completely stable            Yes (projected, not                    Yes (projected, not tested)
            Inc.             7.5               stable                                                         tested)

            McAfee           Total             Yes, but with                Because of instability problems w 25 simultaneous scans, To engineers did not
                                                                                                            with                       olly
                             Protection for    stability                                                     e
                                                                            attempt greater numbers. McAfee offers a randomization optio in its client task that
                                                                                                                                        on
                             Endpoint          problems                                                      or
                                                                            could provide load distribution fo such both scheduled and m
                                                                                                                                       manually triggered tasks.

            Symantec         Endpoint Trend Yes, but with
                                             Micro                                        McAfee                              Symantec
                                                                            Because of instability problems w 25 simultaneous scans, To engineers did not
                                                                                                            with                         olly
                             Protection     stability                       attempt greater numbers. Symantec recommends configuring scheduled tasks for
                                                                                                                                         g
                             11.0           problems                        randomization. This would spread the on-demand scan reques for 100 virtual machines
                                                                                                            d                             sts
                                                                            to approximately 160 hours by deefault. Manually triggered tasks cannot have randomized
                                                                            start times.

 Note: Trend Micro is the only virtualization-aware solution tested and automatically staggers on-demand scans so that scans are performed serially.
 Source: Tolly, October 2010                                                                                                                                               Table 1


                              Anti-virus Solution VMware ESX 4.1 Host Resource Consumption vs. Baseline
                                  Request Signature Update of 50 Virtual Machines Running Microsoft Windows 7
                                               As reported by vCenter (Lower numbers are better)
                                                                                197
                   120                                  200                                    2000
                                    104
                   100                                                                                                                                                  1,558
                                                                           160                                                          1600
                                                          % vs. Baseline
  % vs. Baseline




                                                                                                                      % vs. Baseline




                    80
                                                                           120                                                          1200
                    60                                                                          75
                                                                            80          66                                                  800
                    40       29               26
                                                                                                                                                       293      377
                    20                                                      40                                                              400
                     0                                                       0                                                                0
                                    CPU                                                        RAM                                                             Disk
                                              Trend Micro                                       McAfee                                            Symantec
 Note: All systems running proprietary workload in addition to test task. Baseline is proprietary workload running with no endpoint security solution
 installed. Baseline values: Average CPU = 8,434.91 MHz, Average RAM = 14,119.62 MB, Average Disk = 2,341.41 KBps. Trend only needs to download the
 signature file to its single virtual security appliance. Other vendors triggered 25 simultaneous updates. Each vendor recommends various methods for
 load-leveling updates. See report body for details. Utilization over baseline is calculated by subtracting baseline from result, dividing by baseline and
 multiplying by 100. Average of 15 minute run.
 Source: Tolly, October 2010                                                                                                                                                 Figure 3


 © 2011 Tolly Enterprises, LLC                                                                       Tolly.com                                                         Page 4 of 9
Trend Micro Deep Security 7.5                                                                                                 #211101



With grouping, an administrator can assign           enterprise IT management more                           balancing or other reasons, administrators
VMs to different groups and schedule client          complicated. New VMs need to be allocated               have to update the group assignments
tasks by group. This approach requires               manually to groups and, if VMs get migrated             accordingly.
administrative work and makes the                    from one host to the other for load

                                                  Virtualized Anti-virus Test Environment




 Source: Tolly, October 2010                                                                                                                 Figure 4


                                                               Systems Under Test
      Vendor          Product                                       Components                                     Virtual        Implementation
                                                                                                                   Machine
                                                                                                                    Aware

    Trend         Deep Security     Trend Micro Deep Security Manager version 7.5.1378; Trend Micro Deep           Yes       Automatic, single virtual
    Micro, Inc.   7.5               Security Virtual Appliance 7.5.0.1600; Filter Driver 7.0.0.894; Default                  appliance. Agentless
                                    configuration. Assigned the pre-configured Windows Anti-Malware                            client communicates via
                                    Protection security profile.                                                              VMware vShield API

    McAfee        Total             McAfee ePolicy Orchestrator 4.5; McAfee Agent for Windows 4.5.0 Minor          No        Traditional endpoint
                  Protection for    Version 1270; McAfee VirusScan(R) Enterprise 8.7.0 Minor version 570 with                client
                  Endpoint          Hot Fix 2; McAfee AntiSpyware Enterprise 8.7 Minor version 129; McAfee
                                    Host Intrusion Prevention 7.0.0 minor Version 1070; McAfee SiteAdvisor(R)
                                    Enterprise Plus 3.0.0 Minor version 476 All with default policies. Cancelled
                                    pre-configured Full Scan and Update client tasks.

    Symantec      Endpoint          Version 11.0.6100.645                                                          No        Traditional endpoint
                  Protection 11.0                                                                                            client

   Source: Tolly, October 2010                                                                                                                      Table 2

 © 2011 Tolly Enterprises, LLC                                                     Tolly.com                                               Page 5 of 9
Trend Micro Deep Security 7.5                                                                                             #211101




Anti-virus Signature (Pattern)                    Although not used for this test, engineers
Update (50 VMs) Test                              noted that the McAfee solution included a                Trend Micro, Inc.
                                                  task for idle VMs to update their signature
Engineers evaluated how each solution             files once each day. While engineers                     Deep Security
responded to a systemwide anti-virus              cancelled this task, it was noted that the task
pattern update request. Pattern updates,          would still initiate automatically.
                                                                                                           7.5
while less resource-intensive than full scans,
are still known to create performance             As with Symantec, the resources consumed                 VMware
degradation and raise operational                 when 50 VMs are being updated                            Anti-virus
challenges especially if they are run during      simultaneously can be significant and                                               Tested
                                                                                                           Performance
regular business hours.                           engineers noted that VMware ESX system                                             October
                                                  CPU usage remained at 100% for more than                                             2010
Engineers ran the signature update scenario       10 minutes in some test runs and that the
with 50 virtual machines. Where the               entire virtualized system demonstrated
traditional solutions required that the           severely degraded performance.                      of AV efficiency on VM density. Density
signature files be updated in each virtual                                                            improvements can be calculated in various
machine, the Trend Micro solution required        VM Density (Consolidation)                          ways - (a) when AV is idle, and (b) when AV
only a single copy of the signature file that     Comparisons                                         solutions are performing immediate client
resided on the Trend Micro Deep Security                                                              tasks like on-demand scans and signature
appliance and was used for all the VMs            Most virtualization efforts calculate sizing
                                                                                                      updates.
monitored by Trend Micro. Thus, where the         based mostly on the primary VM workloads,
resource consumption of the traditional           and do not take into account the disruptive         Nominal VM density (AV idle)
solutions were notably higher in either CPU       traditional AV workload. As part of this test,
                                                                                                      Here the focus was primarily on the resource
or RAM, the Trend Micro resource                  Tolly also attempted to evaluate the impact
                                                                                                      footprint of the AV solution at rest, while the
consumption was consistently lower. See
Figure 3.                                                            VMware Performance Host Testbed Components
Engineers also noted that network security
managers implementing the Trend Micro                         Component                                      Version/Build
solution need not be concerned about
                                                     VMware ESX                         4.1.0
virtual machine’s that are “offline” during the
time that the signature update process takes
                                                     VMware vCenter Server              4.1.0 build 258902
place. With traditional implementations VMs
must be online to receive updates.
                                                     VMware View Composer Server        2.1 build 277387
As with the simultaneous on-demand scan
test, the requirement to process updates on          VMware View Connection Server      4.5.0
all 50 virtual machines at once on the
McAfee and Symantec solutions had                    VMware vShield Manager             4.1 build 310451
resource and performance implications at
the overall system level.                            Server Hardware                    2x Xeon x5680 (Hexacore) running at 3.33GHz with 192 GB
                                                                                        of DDR 3 RAM (Total of 24 logical cores)
With Symantec, most VMs triggered
                                                     Storage Area Network               HP StorageWorks MSA connected via 4GB FibreChannel
memory alarms in VMware’s vCenter
management station as Symantec’s
                                                     Guest VM Resources                 1GB RAM and 1 vCPU
signature update task fully consumed the
1GB RAM allocation in each of the machines.
                                                     Guest Operating System             Microsoft Windows 7 Enterprise
10 of 50 users’ VMware View desktops
became disconnected during this test.
                                                     Source: Tolly, October 2010                                                          Table 3

  © 2011 Tolly Enterprises, LLC                                                Tolly.com                                             Page 6 of 9
Trend Micro Deep Security 7.5                                                                                             #211101



primary workload was running but no
                                                  Anti-Virus VMware ESX 4.1 Host Resource Consumption vs. Baseline
specific AV task had been triggered. The VM
                                                 Up to 100 Virtual Machines Running Proprietary Workload under Microsoft
density improvement with the Trend Micro
                                                                                Windows 7
solution was 34.5% and 29% over Symantec
                                                             As reported by vCenter (Lower numbers are better)
for CPU and memory respectively. Similarly,
the VM density improvement was 31.4%            Number              AV Solution
                                                                           t                 ESX Host Bas
                                                                                                        seline Resource Utilization/%
and 42.4% over McAfee for CPU and               of virtual                                            Inc
                                                                                                        crease over Base
                                                                                                                       eline
memory respectively. See Table 5.               machines                                   CPU (GHz)/% RAM (GB)/% Disk (KBps)/%
True VM density (Full Scans)                    25                              Baseline   4.113 GHz        6.306 GB         1.705 KBps
Using AV idle nominal densities does not
account for the peak AV activities, which is                   Trend Micro      %          8.86%            5.94%            -13.26%
why virtualization deployments are                                              increase
                                                               McAfee           o v e r    43.04%           50.83%           191.82%
increasingly seeing “AV storms” that starve
                                                                                baseline
the ESX host and the VM workloads. As seen
in the testing, AV scans and updates are                       Symantec                    46.58%           36.63%           138.05%
resource-intensive in all three areas of CPU,
                                                50                              Baseline   8.467 GHz        11.908 GB        2.592 KBps
memory and disk usage. and it can vary
with the system and workload which
                                                               Trend Micro      %          24.65%           10.7%            38.98%
resource will become the bottleneck.
                                                                                increase
The VM density improvement with the                            McAfee           o v e r    43.02%           60.34%           393.09%
                                                                                baseline
Trend Micro solution was 106% and 114%
over Symantec for CPU and memory                               Symantec                    42.73%           37.78%           148.91%
respectively. Similarly, the VM density
improvement was 124.9% and 273.5% over          75                              Baseline   12.645 GHz       17.325 GB        3.381 KBps
McAfee for CPU and memory respectively.
                                                               Trend Micro      %          11.61%           7.79%            -11.03%
                                                                                increase
      Trend Micro Deep Security                                McAfee           o v e r    35.33%           64.57%           325.32%
                                                                                baseline

  Trend Micro has architected its                              Symantec                    39.61%           33.33%           108.22%
  Deep Security 7.5 offering to be
  "virtual machine aware." Unlike               100                             Baseline   17.197 GHz       22.468 GB        5.417 KBps
  traditional agent-based solutions
  Deep Security focuses on                                     Trend Micro      %          9.86%            12.7%            -4%
  reducing operational security                                                 increase
  issues such as anti-virus storms,                            McAfee           o v e r    33.33%           69.31%           271.43%
  resource wastage and                                                          baseline
  administrative overhead. Deep                                Symantec                    36.14%           44.31%           77.61%
  Security provides an agentless
  approach to anti-virus protection
                                                Note: Baseline values represent 30 minute test runs of a proprietary workload running with no
  optimized for virtualization that
                                                anti-virus/endpoint security solution installed. Lower percentage increases in resource
  aims to deliver faster performance,           consumption are better. In many cases, the test runs were not complete at the expiration of the
  higher VM consolidation, easier               test window. The McAfee solution was unable to complete the 100 VM test despite multiple
  manageability and faster "time to             attempts and re-runs. Tolly engineers extrapolated the McAfee 100 VM results from the McAfee
  protect" for virtualized assets.              25, 50 and 75 VM test results. Disk usage results vary up to 30% and are included for reference
                                                purposes only.
   Source: Trend Micro, October 2010
                                                Source: Tolly, October 2010                                                               Table 4


 © 2011 Tolly Enterprises, LLC                                                Tolly.com                                              Page 7 of 9
Trend Micro Deep Security 7.5                                                                                            #211101




Test Methodology and Testbed                     Primary Workload                                    VMware View clients and ran the application
Setup                                                                                                scripts.
                                                 The primary tests used a proprietary
All tests were conducted using the same          workload which, in turn, was broken down            Script activities included editing email and
hardware infrastructure and, thus, were          into three levels of activity:                      Microsoft Office documents, paging
conducted serially for each system. Table 2                                                          through Adobe PDF documents and
provides the details of the solutions under      High: 55% of the guest machines ran scripts         browsing the web. The workload did not
test, the virtual machine guest systems, and     using Microsoft Outlook, Word, Excel,               include any I/O-intensive or file copy tasks.
Table 3 provides details of the virtual          Powerpoint, Internet Explorer and Adobe             Runs were 30 minutes in length.
machine host environment for the                 Reader applications. Low: 35% of the guest
                                                 machines ran scripts using Microsoft
performance host.                                                                                    On-Demand Scan and Signature
                                                 Outlook, Word, Internet Explorer and Adobe
                                                 Reader applications. Idle: 10% of the guest
                                                                                                     Update Tests
It should be noted that the physical server
CPU consisted of 24 logical cores which          machines were booted to Windows and                 Tolly engineer launched the primary
meant that systems configured for 100            allowed to remain idle.                             workload to serve as background load and
virtual machines oversubscribed the                                                                  then assigned one full scan or update task
physical CPU resource by approximately 4:1.      This workload was used for all the tests and        from the management server to all guest
Testers noted that that, over the course of      served as the background workload for the           virtual machines under test. Runs were 15
the test, the CPU resource was not identified    on-demand scan and signature update                 minutes length.
as a bottleneck.                                 tests. Windows firewall and Windows
                                                 defender were turned off on all guest virtual       All performance results were captured from
A VMware ESXi host was used to run other         machines.                                           VMware vCenter at 20 second intervals.
infrastructure used for the test including the
various management servers required by           For the primary workload tests, Tolly
the systems under test as well as the load       engineers launched the workload which
generator systems.                               automatically logged in all users with

The Trend Micro solution was implemented
as a virtual appliance and used the VMware
                                                  VM Density Improvement - Proprietary Workload: Trend vs. Competitor
                                                                                       (Nominal Density)
API to communicate with the guest
machines. This API conducts that
                                                                                    CPU                      RAM                   DISK
communication via the virtual network
interface.                                                McAfee                    31.4%                    42.4%                236%
The other solutions were not “virtual                   Symantec                    34.6%                     29%                 174%
machine -aware” and, thus, were
implemented in the same manner as if 100
                                                     VM Density Improvement - On-Demand Scan: Trend vs. Competitor
physical Windows machines were deployed.
                                                                                            (True Density)
At the time that the test environment was                                           CPU                      RAM                   DISK
finalized, McAfee’s solution for endpoint
security in virtualized environments, McAfee              McAfee                   124.9%                    273.5%               171.6%
Management for Optimized Virtual
                                                        Symantec                   106.0%                    114.1%               183%
Environments (MOVE) was not yet available
for VMware host environments
                                                  Note: Based on resource consumption, figures in table represent the scaling/density improvement
                                                  potential of Trend Micro vs. each competitor.
All products under test were with their           Nominal density refers to systems running a load that does not stress the AV.
default anti-virus policies. Pre-configured       True density refers to a load that drives the AV solution.
scheduled full scan and update tasks were
cancelled.                                        Source: Tolly, October 2010                                                              Table 5

 © 2011 Tolly Enterprises, LLC                                                  Tolly.com                                           Page 8 of 9
Trend Micro Deep Security 7.5                                                                                           #211101




 About Tolly                                     Interaction with Competitors
 The Tolly Group companies have been
                                                 In accordance with our process for conducting
 delivering world-class IT services for
                                                 comparative tests, The Tolly Group contacted the
 more than 20 years. Tolly is a leading
                                                 competing vendors inviting them to review test
 global provider of third-party
                                                 methodology and their results prior to publication.
 validation services for vendors of IT
                                                 McAfee did not respond. Symantec responded and
 products, components and services.
                                                 worked with Tolly engineers. Symantec recommended
 You can reach the company by email at
                                                 the use of its randomization feature to distribute resource-intensive workloads
 sales@tolly.com, or by telephone at
                                                 across an extended period of time.
 +1 561.391.5610.
 Visit Tolly on the Internet at:                 For more information on the Tolly Fair Testing Charter, visit:
 http://www.tolly.com                            http://www.tolly.com/FTC.aspx




                                                        Terms of Usage
 This document is provided, free-of-charge, to help you understand whether a given product, technology or service merits additional
 investigation for your particular needs. Any decision to purchase a product must be based on your own assessment of suitability
 based on your needs. The document should never be used as a substitute for advice from a qualified IT or business professional. This
 evaluation was focused on illustrating specific features and/or performance of the product(s) and was conducted under controlled,
 laboratory conditions. Certain tests may have been tailored to reflect performance under ideal conditions; performance may vary
 under real-world conditions. Users should run tests based on their own real-world scenarios to validate performance for their own
 networks.
 Reasonable efforts were made to ensure the accuracy of the data contained herein but errors and/or oversights can occur. The test/
 audit documented herein may also rely on various test tools the accuracy of which is beyond our control. Furthermore, the
 document relies on certain representations by the sponsor that are beyond our control to verify. Among these is that the software/
 hardware tested is production or production track and is, or will be, available in equivalent or better form to commercial customers.
 Accordingly, this document is provided "as is", and Tolly Enterprises, LLC (Tolly) gives no warranty, representation or undertaking,
 whether express or implied, and accepts no legal responsibility, whether direct or indirect, for the accuracy, completeness, usefulness
 or suitability of any information contained herein. By reviewing this document, you agree that your use of any information
 contained herein is at your own risk, and you accept all risks and responsibility for losses, damages, costs and other consequences
 resulting directly or indirectly from any information or material available on it. Tolly is not responsible for, and you agree to hold Tolly
 and its related affiliates harmless from any loss, harm, injury or damage resulting from or arising out of your use of or reliance on any
 of the information provided herein.
 Tolly makes no claim as to whether any product or company described herein is suitable for investment. You should obtain your own
 independent professional advice, whether legal, accounting or otherwise, before proceeding with any investment or project related
 to any information, products or companies described herein. When foreign translations exist, the English document is considered
 authoritative. To assure accuracy, only use documents downloaded directly from Tolly.com.  No part of any document may be
 reproduced, in whole or in part, without the specific written permission of Tolly. All trademarks used in the document are owned by
 their respective owners. You agree not to use any trademark in or as the whole or part of your own trademarks in connection with
 any activities, products or services which are not ours, or in a manner which may be confusing, misleading or deceptive or in a
 manner that disparages us or our information, projects or developments.

                                                                                                               211101-uv-3-kt - 04Feb2011VerP

© 2011 Tolly Enterprises, LLC                                               Tolly.com                                            Page 9 of 9

Weitere ähnliche Inhalte

Was ist angesagt?

Hosted Virtualization
Hosted VirtualizationHosted Virtualization
Hosted Virtualizationjayallen77
 
UVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER CORE
UVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER COREUVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER CORE
UVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER COREVLSICS Design
 
Security in a Virtualised Environment
Security in a Virtualised EnvironmentSecurity in a Virtualised Environment
Security in a Virtualised EnvironmentPeter Wood
 
Net framework session03
Net framework session03Net framework session03
Net framework session03Niit Care
 
Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...
Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...
Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...Principled Technologies
 
Performance tuningtoolkitintroduction
Performance tuningtoolkitintroductionPerformance tuningtoolkitintroduction
Performance tuningtoolkitintroductionRohit Kelapure
 
09 intel v_tune_session_13
09 intel v_tune_session_1309 intel v_tune_session_13
09 intel v_tune_session_13Niit Care
 
Jtag Tools For Linux
Jtag Tools For LinuxJtag Tools For Linux
Jtag Tools For Linuxsheilamia
 
Moxa Tech White Paper - Choosing An Embedded Operating System
Moxa Tech White Paper - Choosing An Embedded Operating SystemMoxa Tech White Paper - Choosing An Embedded Operating System
Moxa Tech White Paper - Choosing An Embedded Operating SystemDigital River
 
Take the guesswork out of video surveillance with pre-validated, virtualized ...
Take the guesswork out of video surveillance with pre-validated, virtualized ...Take the guesswork out of video surveillance with pre-validated, virtualized ...
Take the guesswork out of video surveillance with pre-validated, virtualized ...Principled Technologies
 
VMware vSphere 7 Update 2 offered greater VM density and increased availabili...
VMware vSphere 7 Update 2 offered greater VM density and increased availabili...VMware vSphere 7 Update 2 offered greater VM density and increased availabili...
VMware vSphere 7 Update 2 offered greater VM density and increased availabili...Principled Technologies
 
Save IT admin time with the Dell EMC PowerEdge MX platform and OpenManage En...
Save IT admin time with the Dell EMC PowerEdge MX  platform and OpenManage En...Save IT admin time with the Dell EMC PowerEdge MX  platform and OpenManage En...
Save IT admin time with the Dell EMC PowerEdge MX platform and OpenManage En...Principled Technologies
 
Comp tia a+_session_13
Comp tia a+_session_13Comp tia a+_session_13
Comp tia a+_session_13Niit Care
 
XenDesktop 7 Blueprint
XenDesktop 7 BlueprintXenDesktop 7 Blueprint
XenDesktop 7 BlueprintNuno Alves
 
Take the guesswork out of video surveillance with pre-validated Milestone s...
Take the guesswork out of video  surveillance with pre-validated  Milestone s...Take the guesswork out of video  surveillance with pre-validated  Milestone s...
Take the guesswork out of video surveillance with pre-validated Milestone s...Principled Technologies
 

Was ist angesagt? (19)

DB2 for z/OS Solutions
DB2 for z/OS SolutionsDB2 for z/OS Solutions
DB2 for z/OS Solutions
 
Hosted Virtualization
Hosted VirtualizationHosted Virtualization
Hosted Virtualization
 
UVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER CORE
UVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER COREUVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER CORE
UVM BASED REUSABLE VERIFICATION IP FOR WISHBONE COMPLIANT SPI MASTER CORE
 
Security in a Virtualised Environment
Security in a Virtualised EnvironmentSecurity in a Virtualised Environment
Security in a Virtualised Environment
 
Net framework session03
Net framework session03Net framework session03
Net framework session03
 
Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...
Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...
Migrating server workloads to Red Hat Enterprise Virtualization on Intel Xeon...
 
Performance tuningtoolkitintroduction
Performance tuningtoolkitintroductionPerformance tuningtoolkitintroduction
Performance tuningtoolkitintroduction
 
09 intel v_tune_session_13
09 intel v_tune_session_1309 intel v_tune_session_13
09 intel v_tune_session_13
 
Jtag Tools For Linux
Jtag Tools For LinuxJtag Tools For Linux
Jtag Tools For Linux
 
Moxa Tech White Paper - Choosing An Embedded Operating System
Moxa Tech White Paper - Choosing An Embedded Operating SystemMoxa Tech White Paper - Choosing An Embedded Operating System
Moxa Tech White Paper - Choosing An Embedded Operating System
 
Take the guesswork out of video surveillance with pre-validated, virtualized ...
Take the guesswork out of video surveillance with pre-validated, virtualized ...Take the guesswork out of video surveillance with pre-validated, virtualized ...
Take the guesswork out of video surveillance with pre-validated, virtualized ...
 
Intouch 9.0 v
Intouch 9.0 vIntouch 9.0 v
Intouch 9.0 v
 
VMware vSphere 7 Update 2 offered greater VM density and increased availabili...
VMware vSphere 7 Update 2 offered greater VM density and increased availabili...VMware vSphere 7 Update 2 offered greater VM density and increased availabili...
VMware vSphere 7 Update 2 offered greater VM density and increased availabili...
 
Be2010 全功能 20100301
Be2010 全功能 20100301Be2010 全功能 20100301
Be2010 全功能 20100301
 
Save IT admin time with the Dell EMC PowerEdge MX platform and OpenManage En...
Save IT admin time with the Dell EMC PowerEdge MX  platform and OpenManage En...Save IT admin time with the Dell EMC PowerEdge MX  platform and OpenManage En...
Save IT admin time with the Dell EMC PowerEdge MX platform and OpenManage En...
 
Comp tia a+_session_13
Comp tia a+_session_13Comp tia a+_session_13
Comp tia a+_session_13
 
XenDesktop 7 Blueprint
XenDesktop 7 BlueprintXenDesktop 7 Blueprint
XenDesktop 7 Blueprint
 
Web Based Reporting
Web Based ReportingWeb Based Reporting
Web Based Reporting
 
Take the guesswork out of video surveillance with pre-validated Milestone s...
Take the guesswork out of video  surveillance with pre-validated  Milestone s...Take the guesswork out of video  surveillance with pre-validated  Milestone s...
Take the guesswork out of video surveillance with pre-validated Milestone s...
 

Andere mochten auch

Security Teams & Tech In A Cloud World
Security Teams & Tech In A Cloud WorldSecurity Teams & Tech In A Cloud World
Security Teams & Tech In A Cloud WorldMark Nunnikhoven
 
2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report
2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report
2013 Comscore Hong Kong China Taiwan Online Digital Marketing ReportAndrew Wong
 
The Perimeter Security Retreat: Fall Back, Fall Back to the Server
The Perimeter Security Retreat: Fall Back, Fall Back to the ServerThe Perimeter Security Retreat: Fall Back, Fall Back to the Server
The Perimeter Security Retreat: Fall Back, Fall Back to the ServerRahul Neel Mani
 
Trend Micro - 13martie2012
Trend Micro - 13martie2012Trend Micro - 13martie2012
Trend Micro - 13martie2012Agora Group
 
Introduction - Trend Micro Deep Security
Introduction - Trend Micro Deep SecurityIntroduction - Trend Micro Deep Security
Introduction - Trend Micro Deep SecurityAndrew Wong
 
AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...
AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...
AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...Amazon Web Services
 
Defending your workloads with aws waf and deep security
Defending your workloads with aws waf and deep securityDefending your workloads with aws waf and deep security
Defending your workloads with aws waf and deep securityMark Nunnikhoven
 
AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...
AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...
AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...Amazon Web Services
 

Andere mochten auch (8)

Security Teams & Tech In A Cloud World
Security Teams & Tech In A Cloud WorldSecurity Teams & Tech In A Cloud World
Security Teams & Tech In A Cloud World
 
2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report
2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report
2013 Comscore Hong Kong China Taiwan Online Digital Marketing Report
 
The Perimeter Security Retreat: Fall Back, Fall Back to the Server
The Perimeter Security Retreat: Fall Back, Fall Back to the ServerThe Perimeter Security Retreat: Fall Back, Fall Back to the Server
The Perimeter Security Retreat: Fall Back, Fall Back to the Server
 
Trend Micro - 13martie2012
Trend Micro - 13martie2012Trend Micro - 13martie2012
Trend Micro - 13martie2012
 
Introduction - Trend Micro Deep Security
Introduction - Trend Micro Deep SecurityIntroduction - Trend Micro Deep Security
Introduction - Trend Micro Deep Security
 
AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...
AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...
AWS Partner Presentation - TrendMicro - Securing your Journey to the Cloud, A...
 
Defending your workloads with aws waf and deep security
Defending your workloads with aws waf and deep securityDefending your workloads with aws waf and deep security
Defending your workloads with aws waf and deep security
 
AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...
AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...
AWS Summit 2013 | Singapore - Security & Compliance and Integrated Security w...
 

Ähnlich wie Tolly report: Trend Micro Deep Security 7.5 vs. McAfee and Symantec

ConsoleWorks ITFM for VMware
ConsoleWorks ITFM for VMwareConsoleWorks ITFM for VMware
ConsoleWorks ITFM for VMwareTvkearns
 
3529 v mware_solution_brochure_final
3529 v mware_solution_brochure_final3529 v mware_solution_brochure_final
3529 v mware_solution_brochure_finalVictor Diaz Campos
 
IT Security Risk Mitigation Report: Virtualization Security
IT Security Risk Mitigation Report: Virtualization SecurityIT Security Risk Mitigation Report: Virtualization Security
IT Security Risk Mitigation Report: Virtualization SecurityBooz Allen Hamilton
 
APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...
APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...
APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...Neha417639
 
Virtualization
VirtualizationVirtualization
Virtualizationvishnurk
 
Risk Analysis and Mitigation in Virtualized Environments
Risk Analysis and Mitigation in Virtualized EnvironmentsRisk Analysis and Mitigation in Virtualized Environments
Risk Analysis and Mitigation in Virtualized EnvironmentsSiddharth Coontoor
 
Cloud Computing_Unit 1- Part 2.pptx
Cloud Computing_Unit 1- Part 2.pptxCloud Computing_Unit 1- Part 2.pptx
Cloud Computing_Unit 1- Part 2.pptxVivek Shelke
 
Virtualization and cloud Computing
Virtualization and cloud ComputingVirtualization and cloud Computing
Virtualization and cloud ComputingRishikese MR
 
E-TECH.pptx
E-TECH.pptxE-TECH.pptx
E-TECH.pptxEthel80
 
Virtualization meisen 042811
Virtualization meisen 042811Virtualization meisen 042811
Virtualization meisen 042811Morty Eisen
 
V Mware Workstation 6 Ivnua
V Mware Workstation 6 IvnuaV Mware Workstation 6 Ivnua
V Mware Workstation 6 Ivnua-
 
Alexandru Catalin Cosoi
Alexandru Catalin CosoiAlexandru Catalin Cosoi
Alexandru Catalin Cosoiprincescorpio
 
Trend micro v2
Trend micro v2Trend micro v2
Trend micro v2JD Sherry
 
Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7
Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7
Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7Principled Technologies
 
Processor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-V
Processor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-VProcessor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-V
Processor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-VBlesson Babu
 
Securing virtualization in real world environments
Securing virtualization in real world environmentsSecuring virtualization in real world environments
Securing virtualization in real world environmentsArun Gopinath
 
All About Virtualization
All About VirtualizationAll About Virtualization
All About VirtualizationEMC
 
Virtualization VMWare technology
Virtualization VMWare technologyVirtualization VMWare technology
Virtualization VMWare technologysanjoysanyal
 
IBM PowerVM Virtualization Technology on IBM POWER7 Systems
IBM PowerVM Virtualization Technology on IBM POWER7 SystemsIBM PowerVM Virtualization Technology on IBM POWER7 Systems
IBM PowerVM Virtualization Technology on IBM POWER7 SystemsIBM India Smarter Computing
 

Ähnlich wie Tolly report: Trend Micro Deep Security 7.5 vs. McAfee and Symantec (20)

ConsoleWorks ITFM for VMware
ConsoleWorks ITFM for VMwareConsoleWorks ITFM for VMware
ConsoleWorks ITFM for VMware
 
3529 v mware_solution_brochure_final
3529 v mware_solution_brochure_final3529 v mware_solution_brochure_final
3529 v mware_solution_brochure_final
 
IT Security Risk Mitigation Report: Virtualization Security
IT Security Risk Mitigation Report: Virtualization SecurityIT Security Risk Mitigation Report: Virtualization Security
IT Security Risk Mitigation Report: Virtualization Security
 
APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...
APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...
APznzaamT18LaGRvfDd3vc6XGHHoq2hlFqHYsO9vYeEQXTa-sAm9oMvLFaeBQkqdEEa1z4UJVAboW...
 
Virtualization
VirtualizationVirtualization
Virtualization
 
Risk Analysis and Mitigation in Virtualized Environments
Risk Analysis and Mitigation in Virtualized EnvironmentsRisk Analysis and Mitigation in Virtualized Environments
Risk Analysis and Mitigation in Virtualized Environments
 
Cloud Computing_Unit 1- Part 2.pptx
Cloud Computing_Unit 1- Part 2.pptxCloud Computing_Unit 1- Part 2.pptx
Cloud Computing_Unit 1- Part 2.pptx
 
Virtualization and cloud Computing
Virtualization and cloud ComputingVirtualization and cloud Computing
Virtualization and cloud Computing
 
E-TECH.pptx
E-TECH.pptxE-TECH.pptx
E-TECH.pptx
 
Virtualization meisen 042811
Virtualization meisen 042811Virtualization meisen 042811
Virtualization meisen 042811
 
V Mware Workstation 6 Ivnua
V Mware Workstation 6 IvnuaV Mware Workstation 6 Ivnua
V Mware Workstation 6 Ivnua
 
Virtualization 101
Virtualization 101Virtualization 101
Virtualization 101
 
Alexandru Catalin Cosoi
Alexandru Catalin CosoiAlexandru Catalin Cosoi
Alexandru Catalin Cosoi
 
Trend micro v2
Trend micro v2Trend micro v2
Trend micro v2
 
Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7
Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7
Multi-feature VDI comparison: VMware Horizon View 5.2 vs. Citrix XenDesktop 7
 
Processor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-V
Processor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-VProcessor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-V
Processor Virtualization Comparison VMWare ESXi vs Microsoft Hyper-V
 
Securing virtualization in real world environments
Securing virtualization in real world environmentsSecuring virtualization in real world environments
Securing virtualization in real world environments
 
All About Virtualization
All About VirtualizationAll About Virtualization
All About Virtualization
 
Virtualization VMWare technology
Virtualization VMWare technologyVirtualization VMWare technology
Virtualization VMWare technology
 
IBM PowerVM Virtualization Technology on IBM POWER7 Systems
IBM PowerVM Virtualization Technology on IBM POWER7 SystemsIBM PowerVM Virtualization Technology on IBM POWER7 Systems
IBM PowerVM Virtualization Technology on IBM POWER7 Systems
 

Mehr von UNIT4 IT Solutions

UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!
UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!
UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!UNIT4 IT Solutions
 
Bring Your Own Device, er is geen weg terug
Bring Your Own Device, er is geen weg terugBring Your Own Device, er is geen weg terug
Bring Your Own Device, er is geen weg terugUNIT4 IT Solutions
 
Het Nieuwe werken en IT Consumerization
Het Nieuwe werken en IT ConsumerizationHet Nieuwe werken en IT Consumerization
Het Nieuwe werken en IT ConsumerizationUNIT4 IT Solutions
 
Deepsecurity & VDI beveiliging, maximale beveiliging en optimale performance
Deepsecurity & VDI beveiliging, maximale beveiliging en optimale performanceDeepsecurity & VDI beveiliging, maximale beveiliging en optimale performance
Deepsecurity & VDI beveiliging, maximale beveiliging en optimale performanceUNIT4 IT Solutions
 
Desktopvirtualisatie met VMware View, de laatste ontwikkelingen
Desktopvirtualisatie met VMware View, de laatste ontwikkelingenDesktopvirtualisatie met VMware View, de laatste ontwikkelingen
Desktopvirtualisatie met VMware View, de laatste ontwikkelingenUNIT4 IT Solutions
 

Mehr von UNIT4 IT Solutions (6)

UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!
UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!
UNIT4 Business Collaborator: het nieuwe samenwerken aan projecten!
 
Bring Your Own Device, er is geen weg terug
Bring Your Own Device, er is geen weg terugBring Your Own Device, er is geen weg terug
Bring Your Own Device, er is geen weg terug
 
Het Nieuwe werken en IT Consumerization
Het Nieuwe werken en IT ConsumerizationHet Nieuwe werken en IT Consumerization
Het Nieuwe werken en IT Consumerization
 
Deepsecurity & VDI beveiliging, maximale beveiliging en optimale performance
Deepsecurity & VDI beveiliging, maximale beveiliging en optimale performanceDeepsecurity & VDI beveiliging, maximale beveiliging en optimale performance
Deepsecurity & VDI beveiliging, maximale beveiliging en optimale performance
 
Desktopvirtualisatie met VMware View, de laatste ontwikkelingen
Desktopvirtualisatie met VMware View, de laatste ontwikkelingenDesktopvirtualisatie met VMware View, de laatste ontwikkelingen
Desktopvirtualisatie met VMware View, de laatste ontwikkelingen
 
UNIT4 Hybrid Computing
UNIT4 Hybrid ComputingUNIT4 Hybrid Computing
UNIT4 Hybrid Computing
 

Kürzlich hochgeladen

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfEnterprise Knowledge
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxKatpro Technologies
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilV3cube
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationMichael W. Hawkins
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountPuma Security, LLC
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking MenDelhi Call girls
 

Kürzlich hochgeladen (20)

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...Workshop - Best of Both Worlds_ Combine  KG and Vector search for  enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptxFactors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path MountBreaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 

Tolly report: Trend Micro Deep Security 7.5 vs. McAfee and Symantec

  • 1. #211101 February 2011 Commissioned by Trend Micro, Inc. Trend Micro Deep Security 7.5 vs. McAfee and Symantec Anti-virus Performance in VMware ESX Virtual Environments Executive Summary TEST HIGHLIGHTS Server and desktop virtualization are essential elements of any IT The Trend Micro Deep Security Virtual Appliance: strategy that seeks to decrease capital and operational expenditures . In the rush to implement virtualization technologies, 1 Demonstrated consistently lower demand for system CPU, memory and disk I/O over traditional many organizations simply deploy the same anti-virus solution that is in use on their physical server and desktop systems. Because these agent-based solutions even during periods when traditional anti-virus solutions are not designed specifically for the workload was designed not to stress AV virtual environments, they can create significant operational issues such as anti-virus (AV) storms, resource wastage and administrative overhead, and hamper the organization’s objective of maximizing 2 Successfully avoided AV storm issues with scheduled scans and pattern updates that VM densities. prevented other solutions from testing beyond Trend Micro, Inc. commissioned Tolly to benchmark the 25 VMs performance within virtual environments of the Trend Micro Deep Security solution vs. McAfee Total Protection for Endpoint and 3 Symantec Endpoint Protection 11.0. Specifically, this testing Demonstrated density improvements of 29% to evaluated the impact each solution had on host system (physical 275% over McAfee and Symantec running test server) resources especially as guest machine density increased to workloads up to 100 virtual machines simultaneously running in a VMware ESX 4.1 environment. Tests showed that Trend Micro Deep Security, which provides an agentless virtual appliance-based approach to anti-virus protection optimized for virtualization, consistently consumed less CPU, RAM and disk I/O resources than the non VM-aware implementations where anti-virus agents and processing resided in each and every Windows 7 virtual machine. In addition to consuming 1.7 to 8.5 times the resource overhead of the Trend Micro solution in the general workload test, the traditional AV solutions were seen to face AV storm challenges when tested at peak activities (i.e., running on-demand scans and signature updates) when operations on 25 VMs were triggered simultaneously. Specifically, when Tolly engineers attempted to remediate the competing systems immediately and, because the traditional solutions were not VM-aware, management station requests for, say, 25 virtual machines to run on- demand scans or update signature files triggered all of the virtual machines to begin execution of the function simultaneously resulting in a surge in demand on host resources such as CPU and memory. Ultimately the savings in resource consumption afforded by Trend Micro Deep Security allows organizations to increase virtual machine densities, i.e. the number of VMs that can be run per host, enabling capital expenditure (CAPEX) and operational expenditure (OPEX) savings for the organization. The VM density improvement made possible because of Trend Micro’s lower resource consumption and AV storm avoidance in the proprietary workload tests ranged from a minimum of 29% (when running a workload that did not stress AV) to a maximum of 275% (during AV storm periods) over McAfee and Symantec © 2011 Tolly Enterprises, LLC Tolly.com Page 1 of 9
  • 2. Trend Micro Deep Security 7.5 #211101 Anti-virus VMware ESX 4.1 Host Resource Consumption vs. Baseline Tolly engineers benchmarked security Up to 100 Virtual Machines Running Proprietary Workload under Microsoft system resource utilization by running Windows 7 various workloads on up to 100 virtual As reported by vCenter (Lower numbers are better) machines simultaneously. A baseline was established by running a workload CPU % vs. Baseline simulating various end-user functions on systems that had no endpoint security solution installed and measuring resource 40 consumption. 20 Testing included benchmarking resource 0 consumption when running specific anti- 25 50 75 100 virus tasks (on-demand scan and signature # of Virtual Machines updates) as well as a more general user workload with anti-virus protection present RAM on each virtual machine. 70 Anti-virus Resource Utilization with 60 % vs. Baseline Simulated Workload (25 to 100 50 Virtual Machines) 40 30 Figure 1 illustrates average utilization levels of key system resources at the VMware ESX 20 server level when running the primary test 10 workload with up to 100 simultaneous 0 virtual machines. (See Table 4 for individual 25 50 75 100 data points.) # of Virtual Machines These figures include the resources used by the virtual machines as well as, for Trend DISK Micro, the resources used by the Deep % vs. Baseline Security virtual appliance. See the Test 400 Methodology and Testbed Setup section for details on the workloads and environment. Both McAfee and Symantec solutions -15 required that a separate instance of the AV 25 50 75 100 agent run in each virtual machine. Trend Micro Deep Security required one instance # of Virtual Machines of its virtual appliance per host. The figure Trend Micro McAfee Symantec illustrates how, at all VM density levels, and Note: All systems running proprietary workload in addition to scan. Baseline is proprietary across all three resources - CPU, Memory workload running with no endpoint security solution installed. See report body for baseline values and Disk Usage. Symantec and McAfee and detailed results. Utilization over baseline is calculated by subtracting baseline from result, consumed 1.7 to 8.5 times the amount of dividing by baseline and multiplying by 100. As McAfee was unable to complete the 100 VM test, resource overhead required by Trend Micro.1 results for 100 were extrapolated from the 25, 50 and 75 VM tests. Average of 30 minute run. Disk usage results vary up to 30% and are include for reference purposes only. Source: Tolly, October 2010 Figure 1 1 The McAfee solution was unable to complete the 100 VM test despite multiple attempts and re-runs.. Tolly engineers extrapolated the McAfee 100 VM results from the McAfee 25, 50 and 75 VM test results. © 2011 Tolly Enterprises, LLC Tolly.com Page 2 of 9
  • 3. Trend Micro Deep Security 7.5 #211101 Anti-virus VMware ESX 4.1 Host Resource Consumption Overhead vs. Baseline Request On-Demand Scan of 25 Virtual Machines Running Microsoft Windows 7 As reported by vCenter (Lower numbers are better) 394 350 308 400 2500 300 274 2,053 2,143 320 2000 % vs. Baseline % vs. Baseline % vs. Baseline 250 200 240 1500 183 150 160 1000 81 693 100 80 32 500 50 0 0 0 CPU RAM Disk Trend Micro McAfee Symantec Note: All systems running proprietary workload in addition to scan. Baseline is proprietary workload running with no endpoint security solution installed. Baseline values: Average CPU = 4,109.76 MHz, Average RAM = 7,893.28 MB, Average Disk = 1,741.23 KBps. Trend automatically runs only a single scan at one time. Other vendors triggered 25 simultaneous scans. Each vendor recommends various methods such as randomization for load- leveling on-demand scans. See report body for details. Utilization over baseline is calculated by subtracting baseline from result, dividing by baseline and multiplying by 100. Average of 30 minute run. Source: Tolly, October 2010 Figure 2 Anti-virus On-Demand Scans By default, the other solutions (that are during the test and disk latency (not (25 VMs) Test unaware of the shared, virtual environment) illustrated in the figures) was noted to attempted to initiate simultaneous scans of average 31 ms. With the McAfee on- Engineers evaluated how each solution all 25 machines. Figure 2 provides the demand scan scenario, disk latency was responded to a security management average resource results for those tests noted to average 80 ms. During the test, 14 system request to conduct a full scan on 25 where McAfee resource consumption out of 25 users were not able to access their virtual machines. Being resource intensive in overhead was 2.8 times more than Trend desktops. See Table 2 for additional nature, simultaneous scans can degrade Micro for CPU and 11 times for RAM. commentary. overall user experience. Symantec resource consumption overhead was 2.4 times more than Trend Micro for Traditional solutions generally recommend Trend Micro Deep Security was aware that it two approaches to avoid vir tual CPU and 4.7 times for RAM. was running in an environment where environment resource contention - resources were shared across all VMs and In addition, the 25 VM data set for Symantec randomization and grouping. Neither of automatically scheduled scans to run serially and McAfee does not provide the complete t h e s e a p p ro a c h e s p ro v i d e s a ny - a maximum of 1 machine running at a picture with respect to reliability and user virtualization awareness and, thus, were time. As a result, Deep Security was able to experience. The surge in resource demand outside the scope of this test. successfully test at 25 and 50 VMs. Based on from the McAfee and Symantec solutions the resource utilization observed in these often degraded the user systems. In With randomization, an administrator can tests, Tolly projects that the Trend Micro particular, neither Symantec nor McAfee set up the randomization period to let solution could support a scenario of more solutions were able to be tested beyond 25 endpoints run tasks with random start than 100 VMs. VMs. In the Symantec test, 2 agents lost times. For time consuming tasks like full connectivity with the management server scan, this time period needs to be very long © 2011 Tolly Enterprises, LLC Tolly.com Page 3 of 9
  • 4. Trend Micro Deep Security 7.5 #211101 (more than a day or a week depending other. As a result, when facing a critical immediately. Also, the random tasks may upon the host’s VM density) to increase the security threat, enterprise administrators degrade user experience if they run when chances that client tasks won’t overlap each may not be able to remediate their systems system usage is already high. Anti-virus Solution Scalability Under VMware ESX 4.1 On-Demand Scan Scenarios of Virtual Machines Running Microsoft Windows 7 Vendor Product Number of Virtual Machines Targeted for On-Demand Scan e a 25 50 75 100 Trend Micro, Deep Security Yes, completely Yes, completely stable Yes (projected, not Yes (projected, not tested) Inc. 7.5 stable tested) McAfee Total Yes, but with Because of instability problems w 25 simultaneous scans, To engineers did not with olly Protection for stability e attempt greater numbers. McAfee offers a randomization optio in its client task that on Endpoint problems or could provide load distribution fo such both scheduled and m manually triggered tasks. Symantec Endpoint Trend Yes, but with Micro McAfee Symantec Because of instability problems w 25 simultaneous scans, To engineers did not with olly Protection stability attempt greater numbers. Symantec recommends configuring scheduled tasks for g 11.0 problems randomization. This would spread the on-demand scan reques for 100 virtual machines d sts to approximately 160 hours by deefault. Manually triggered tasks cannot have randomized start times. Note: Trend Micro is the only virtualization-aware solution tested and automatically staggers on-demand scans so that scans are performed serially. Source: Tolly, October 2010 Table 1 Anti-virus Solution VMware ESX 4.1 Host Resource Consumption vs. Baseline Request Signature Update of 50 Virtual Machines Running Microsoft Windows 7 As reported by vCenter (Lower numbers are better) 197 120 200 2000 104 100 1,558 160 1600 % vs. Baseline % vs. Baseline % vs. Baseline 80 120 1200 60 75 80 66 800 40 29 26 293 377 20 40 400 0 0 0 CPU RAM Disk Trend Micro McAfee Symantec Note: All systems running proprietary workload in addition to test task. Baseline is proprietary workload running with no endpoint security solution installed. Baseline values: Average CPU = 8,434.91 MHz, Average RAM = 14,119.62 MB, Average Disk = 2,341.41 KBps. Trend only needs to download the signature file to its single virtual security appliance. Other vendors triggered 25 simultaneous updates. Each vendor recommends various methods for load-leveling updates. See report body for details. Utilization over baseline is calculated by subtracting baseline from result, dividing by baseline and multiplying by 100. Average of 15 minute run. Source: Tolly, October 2010 Figure 3 © 2011 Tolly Enterprises, LLC Tolly.com Page 4 of 9
  • 5. Trend Micro Deep Security 7.5 #211101 With grouping, an administrator can assign enterprise IT management more balancing or other reasons, administrators VMs to different groups and schedule client complicated. New VMs need to be allocated have to update the group assignments tasks by group. This approach requires manually to groups and, if VMs get migrated accordingly. administrative work and makes the from one host to the other for load Virtualized Anti-virus Test Environment Source: Tolly, October 2010 Figure 4 Systems Under Test Vendor Product Components Virtual Implementation Machine Aware Trend Deep Security Trend Micro Deep Security Manager version 7.5.1378; Trend Micro Deep Yes Automatic, single virtual Micro, Inc. 7.5 Security Virtual Appliance 7.5.0.1600; Filter Driver 7.0.0.894; Default appliance. Agentless configuration. Assigned the pre-configured Windows Anti-Malware client communicates via Protection security profile. VMware vShield API McAfee Total McAfee ePolicy Orchestrator 4.5; McAfee Agent for Windows 4.5.0 Minor No Traditional endpoint Protection for Version 1270; McAfee VirusScan(R) Enterprise 8.7.0 Minor version 570 with client Endpoint Hot Fix 2; McAfee AntiSpyware Enterprise 8.7 Minor version 129; McAfee Host Intrusion Prevention 7.0.0 minor Version 1070; McAfee SiteAdvisor(R) Enterprise Plus 3.0.0 Minor version 476 All with default policies. Cancelled pre-configured Full Scan and Update client tasks. Symantec Endpoint Version 11.0.6100.645 No Traditional endpoint Protection 11.0 client Source: Tolly, October 2010 Table 2 © 2011 Tolly Enterprises, LLC Tolly.com Page 5 of 9
  • 6. Trend Micro Deep Security 7.5 #211101 Anti-virus Signature (Pattern) Although not used for this test, engineers Update (50 VMs) Test noted that the McAfee solution included a Trend Micro, Inc. task for idle VMs to update their signature Engineers evaluated how each solution files once each day. While engineers Deep Security responded to a systemwide anti-virus cancelled this task, it was noted that the task pattern update request. Pattern updates, would still initiate automatically. 7.5 while less resource-intensive than full scans, are still known to create performance As with Symantec, the resources consumed VMware degradation and raise operational when 50 VMs are being updated Anti-virus challenges especially if they are run during simultaneously can be significant and Tested Performance regular business hours. engineers noted that VMware ESX system October CPU usage remained at 100% for more than 2010 Engineers ran the signature update scenario 10 minutes in some test runs and that the with 50 virtual machines. Where the entire virtualized system demonstrated traditional solutions required that the severely degraded performance. of AV efficiency on VM density. Density signature files be updated in each virtual improvements can be calculated in various machine, the Trend Micro solution required VM Density (Consolidation) ways - (a) when AV is idle, and (b) when AV only a single copy of the signature file that Comparisons solutions are performing immediate client resided on the Trend Micro Deep Security tasks like on-demand scans and signature appliance and was used for all the VMs Most virtualization efforts calculate sizing updates. monitored by Trend Micro. Thus, where the based mostly on the primary VM workloads, resource consumption of the traditional and do not take into account the disruptive Nominal VM density (AV idle) solutions were notably higher in either CPU traditional AV workload. As part of this test, Here the focus was primarily on the resource or RAM, the Trend Micro resource Tolly also attempted to evaluate the impact footprint of the AV solution at rest, while the consumption was consistently lower. See Figure 3. VMware Performance Host Testbed Components Engineers also noted that network security managers implementing the Trend Micro Component Version/Build solution need not be concerned about VMware ESX 4.1.0 virtual machine’s that are “offline” during the time that the signature update process takes VMware vCenter Server 4.1.0 build 258902 place. With traditional implementations VMs must be online to receive updates. VMware View Composer Server 2.1 build 277387 As with the simultaneous on-demand scan test, the requirement to process updates on VMware View Connection Server 4.5.0 all 50 virtual machines at once on the McAfee and Symantec solutions had VMware vShield Manager 4.1 build 310451 resource and performance implications at the overall system level. Server Hardware 2x Xeon x5680 (Hexacore) running at 3.33GHz with 192 GB of DDR 3 RAM (Total of 24 logical cores) With Symantec, most VMs triggered Storage Area Network HP StorageWorks MSA connected via 4GB FibreChannel memory alarms in VMware’s vCenter management station as Symantec’s Guest VM Resources 1GB RAM and 1 vCPU signature update task fully consumed the 1GB RAM allocation in each of the machines. Guest Operating System Microsoft Windows 7 Enterprise 10 of 50 users’ VMware View desktops became disconnected during this test. Source: Tolly, October 2010 Table 3 © 2011 Tolly Enterprises, LLC Tolly.com Page 6 of 9
  • 7. Trend Micro Deep Security 7.5 #211101 primary workload was running but no Anti-Virus VMware ESX 4.1 Host Resource Consumption vs. Baseline specific AV task had been triggered. The VM Up to 100 Virtual Machines Running Proprietary Workload under Microsoft density improvement with the Trend Micro Windows 7 solution was 34.5% and 29% over Symantec As reported by vCenter (Lower numbers are better) for CPU and memory respectively. Similarly, the VM density improvement was 31.4% Number AV Solution t ESX Host Bas seline Resource Utilization/% and 42.4% over McAfee for CPU and of virtual Inc crease over Base eline memory respectively. See Table 5. machines CPU (GHz)/% RAM (GB)/% Disk (KBps)/% True VM density (Full Scans) 25 Baseline 4.113 GHz 6.306 GB 1.705 KBps Using AV idle nominal densities does not account for the peak AV activities, which is Trend Micro % 8.86% 5.94% -13.26% why virtualization deployments are increase McAfee o v e r 43.04% 50.83% 191.82% increasingly seeing “AV storms” that starve baseline the ESX host and the VM workloads. As seen in the testing, AV scans and updates are Symantec 46.58% 36.63% 138.05% resource-intensive in all three areas of CPU, 50 Baseline 8.467 GHz 11.908 GB 2.592 KBps memory and disk usage. and it can vary with the system and workload which Trend Micro % 24.65% 10.7% 38.98% resource will become the bottleneck. increase The VM density improvement with the McAfee o v e r 43.02% 60.34% 393.09% baseline Trend Micro solution was 106% and 114% over Symantec for CPU and memory Symantec 42.73% 37.78% 148.91% respectively. Similarly, the VM density improvement was 124.9% and 273.5% over 75 Baseline 12.645 GHz 17.325 GB 3.381 KBps McAfee for CPU and memory respectively. Trend Micro % 11.61% 7.79% -11.03% increase Trend Micro Deep Security McAfee o v e r 35.33% 64.57% 325.32% baseline Trend Micro has architected its Symantec 39.61% 33.33% 108.22% Deep Security 7.5 offering to be "virtual machine aware." Unlike 100 Baseline 17.197 GHz 22.468 GB 5.417 KBps traditional agent-based solutions Deep Security focuses on Trend Micro % 9.86% 12.7% -4% reducing operational security increase issues such as anti-virus storms, McAfee o v e r 33.33% 69.31% 271.43% resource wastage and baseline administrative overhead. Deep Symantec 36.14% 44.31% 77.61% Security provides an agentless approach to anti-virus protection Note: Baseline values represent 30 minute test runs of a proprietary workload running with no optimized for virtualization that anti-virus/endpoint security solution installed. Lower percentage increases in resource aims to deliver faster performance, consumption are better. In many cases, the test runs were not complete at the expiration of the higher VM consolidation, easier test window. The McAfee solution was unable to complete the 100 VM test despite multiple manageability and faster "time to attempts and re-runs. Tolly engineers extrapolated the McAfee 100 VM results from the McAfee protect" for virtualized assets. 25, 50 and 75 VM test results. Disk usage results vary up to 30% and are included for reference purposes only. Source: Trend Micro, October 2010 Source: Tolly, October 2010 Table 4 © 2011 Tolly Enterprises, LLC Tolly.com Page 7 of 9
  • 8. Trend Micro Deep Security 7.5 #211101 Test Methodology and Testbed Primary Workload VMware View clients and ran the application Setup scripts. The primary tests used a proprietary All tests were conducted using the same workload which, in turn, was broken down Script activities included editing email and hardware infrastructure and, thus, were into three levels of activity: Microsoft Office documents, paging conducted serially for each system. Table 2 through Adobe PDF documents and provides the details of the solutions under High: 55% of the guest machines ran scripts browsing the web. The workload did not test, the virtual machine guest systems, and using Microsoft Outlook, Word, Excel, include any I/O-intensive or file copy tasks. Table 3 provides details of the virtual Powerpoint, Internet Explorer and Adobe Runs were 30 minutes in length. machine host environment for the Reader applications. Low: 35% of the guest machines ran scripts using Microsoft performance host. On-Demand Scan and Signature Outlook, Word, Internet Explorer and Adobe Reader applications. Idle: 10% of the guest Update Tests It should be noted that the physical server CPU consisted of 24 logical cores which machines were booted to Windows and Tolly engineer launched the primary meant that systems configured for 100 allowed to remain idle. workload to serve as background load and virtual machines oversubscribed the then assigned one full scan or update task physical CPU resource by approximately 4:1. This workload was used for all the tests and from the management server to all guest Testers noted that that, over the course of served as the background workload for the virtual machines under test. Runs were 15 the test, the CPU resource was not identified on-demand scan and signature update minutes length. as a bottleneck. tests. Windows firewall and Windows defender were turned off on all guest virtual All performance results were captured from A VMware ESXi host was used to run other machines. VMware vCenter at 20 second intervals. infrastructure used for the test including the various management servers required by For the primary workload tests, Tolly the systems under test as well as the load engineers launched the workload which generator systems. automatically logged in all users with The Trend Micro solution was implemented as a virtual appliance and used the VMware VM Density Improvement - Proprietary Workload: Trend vs. Competitor (Nominal Density) API to communicate with the guest machines. This API conducts that CPU RAM DISK communication via the virtual network interface. McAfee 31.4% 42.4% 236% The other solutions were not “virtual Symantec 34.6% 29% 174% machine -aware” and, thus, were implemented in the same manner as if 100 VM Density Improvement - On-Demand Scan: Trend vs. Competitor physical Windows machines were deployed. (True Density) At the time that the test environment was CPU RAM DISK finalized, McAfee’s solution for endpoint security in virtualized environments, McAfee McAfee 124.9% 273.5% 171.6% Management for Optimized Virtual Symantec 106.0% 114.1% 183% Environments (MOVE) was not yet available for VMware host environments Note: Based on resource consumption, figures in table represent the scaling/density improvement potential of Trend Micro vs. each competitor. All products under test were with their Nominal density refers to systems running a load that does not stress the AV. default anti-virus policies. Pre-configured True density refers to a load that drives the AV solution. scheduled full scan and update tasks were cancelled. Source: Tolly, October 2010 Table 5 © 2011 Tolly Enterprises, LLC Tolly.com Page 8 of 9
  • 9. Trend Micro Deep Security 7.5 #211101 About Tolly Interaction with Competitors The Tolly Group companies have been In accordance with our process for conducting delivering world-class IT services for comparative tests, The Tolly Group contacted the more than 20 years. Tolly is a leading competing vendors inviting them to review test global provider of third-party methodology and their results prior to publication. validation services for vendors of IT McAfee did not respond. Symantec responded and products, components and services. worked with Tolly engineers. Symantec recommended You can reach the company by email at the use of its randomization feature to distribute resource-intensive workloads sales@tolly.com, or by telephone at across an extended period of time. +1 561.391.5610. Visit Tolly on the Internet at: For more information on the Tolly Fair Testing Charter, visit: http://www.tolly.com http://www.tolly.com/FTC.aspx Terms of Usage This document is provided, free-of-charge, to help you understand whether a given product, technology or service merits additional investigation for your particular needs. Any decision to purchase a product must be based on your own assessment of suitability based on your needs. The document should never be used as a substitute for advice from a qualified IT or business professional. This evaluation was focused on illustrating specific features and/or performance of the product(s) and was conducted under controlled, laboratory conditions. Certain tests may have been tailored to reflect performance under ideal conditions; performance may vary under real-world conditions. Users should run tests based on their own real-world scenarios to validate performance for their own networks. Reasonable efforts were made to ensure the accuracy of the data contained herein but errors and/or oversights can occur. The test/ audit documented herein may also rely on various test tools the accuracy of which is beyond our control. Furthermore, the document relies on certain representations by the sponsor that are beyond our control to verify. Among these is that the software/ hardware tested is production or production track and is, or will be, available in equivalent or better form to commercial customers. Accordingly, this document is provided "as is", and Tolly Enterprises, LLC (Tolly) gives no warranty, representation or undertaking, whether express or implied, and accepts no legal responsibility, whether direct or indirect, for the accuracy, completeness, usefulness or suitability of any information contained herein. By reviewing this document, you agree that your use of any information contained herein is at your own risk, and you accept all risks and responsibility for losses, damages, costs and other consequences resulting directly or indirectly from any information or material available on it. Tolly is not responsible for, and you agree to hold Tolly and its related affiliates harmless from any loss, harm, injury or damage resulting from or arising out of your use of or reliance on any of the information provided herein. Tolly makes no claim as to whether any product or company described herein is suitable for investment. You should obtain your own independent professional advice, whether legal, accounting or otherwise, before proceeding with any investment or project related to any information, products or companies described herein. When foreign translations exist, the English document is considered authoritative. To assure accuracy, only use documents downloaded directly from Tolly.com.  No part of any document may be reproduced, in whole or in part, without the specific written permission of Tolly. All trademarks used in the document are owned by their respective owners. You agree not to use any trademark in or as the whole or part of your own trademarks in connection with any activities, products or services which are not ours, or in a manner which may be confusing, misleading or deceptive or in a manner that disparages us or our information, projects or developments. 211101-uv-3-kt - 04Feb2011VerP © 2011 Tolly Enterprises, LLC Tolly.com Page 9 of 9