Security-as-a-Service (SaaS) is something that is relatively new to the world of IT security. Cloud computing is an emerging market; however, the potential cloud computing offers is huge. About a month ago, McAfee contacted The Tech Herald to demo its SaaS Total Protection solution. Below are the results, both the positives and the negatives.

McAfee Total Protection Advanced - Small Business Edition is a hosted security service that layers anti-Virus, software-based Firewall, and browser protection in one package. Total Protection Advanced, which was used in this review, offers the extra layer of e-mail protection. Hosted security offers some interesting perks for IT when it comes to security enforcement and management and McAfee offering takes advantage of this by streamlining the security process on a network with single-click installation and policy-based management.

This review covers the setup and management of McAfee Total Protection Advanced - Small Business Edition (Total Protection from here on out), as well as detection coverage for various Malware and other threats. The test covered a lab setup of one Administration computer and three employee computers. One computer was left out of the install group as a control device. The computers with Total Protection installed were all updated, including the latest software patches and security updates. The exception is one computer with Internet Explorer 6.0 to test compatibility.

Set-up and Installation:

Total Protection is straightforward when it comes to set-up. Once the control computer (Administration station) has the software installed, all that is left to do is e-mail an installation link to the other computers on the network. Total Protection offers two other levels of installation management for larger networks aside from e-mail. You can perform silent installations and push installations. The fastest way to get the application working is to e-mail the network with the installation link and deploy it.

Once the e-mail is sent and the users install the client, as the administrator you will notice the computers instantly on the administration web console. (See image 1 below) From this point you will want to create groups and policy. Once the groups and policy are set, that it for the most part regarding management. The changes are instant, as the Total Protection network will instantly deploy all changes made by the administrator -- or damn near instantly. In the testing of policy, creating some settings were instant, and others took hold after about three to five minutes.

Group and Policy creation is point-and-click (See images 2 and 3). The documentation provided both in the introduction e-mail to the service and online explains this process pretty well. However, unlike most cases where security will require complex settings, this setup is intuitive. While McAfee offers a decent default setting, it is wise to create your own policy and groups that are unique to your own network (Note: To make things simple as an administrator, create the policy first and then create the group).

Policy creation is simple to move through, the administration screens offer tabs to cover the Virus, Spyware, Firewall, and Site Advisor settings. The option that stands out is the Firewall management screen, which can prevent desktop management of the installed Firewall; instead control is turned over to the administrator.

Usage and detection testing:

With Site Advisor as well as the Firewall and anti-Virus on the user computer, Total Protection offers a decent layer of security. However, no security solution can take into account that some people ignore warnings and other alerts and disable some security features. If you have read past reviews on The Tech Herald, then you know a favorite test in the lab deals with Malware Core.

As you can tell after watching the video linked to below, when visiting the Malware Core site, McAfee tossed up some obvious warnings. However, the object of the video was to point out an important issue when creating policy. Notice that the Firewall prompted the user to take an action when Malware core wanted to access the Web. The user could allow this connection, thus infecting their system, and likely the network. Now McAfee recommends that the administrator lock down the systems and manage everything, but there is the option to let the user self govern with regard to the Firewall. Use that option sparingly, if at all. The wrong click can cause serious issues down the line.

McAfee passed the Malware Core test. First there were the warnings, and even the silliest of users would notice them, and the majority would stop their actions (there is always one however who will know better than anyone and ignore all the warnings). The second was a full blown infection, which McAfee caught and removed.

[Screencast Video Link]

[Note: Video edited for time. Total scan time after Malware Core removal was about twenty minutes. Also, the video was not embedded due to capture size. Notice the date on the AV update. This is a little odd, because the IE7 computer used in the Malware Core test was the one computer that was updated with current Virus and Spyware coverage. This could be due to various reasons and was not explored in the testing. Coverage was confirmed however, using the admin console before the test started.]

Aside from anti-Virus and Firewall, Total Protection offers e-mail filtering as well. The e-mail scanning from an administrator's stand point is granular and very controlling. The filtering works by routing e-mail through McAfee servers, so there are some changes that you will need to make regarding MX settings. Once working however, the e-mail filtering is great, as you can see in the report in the image below.

The overall rating of the Spam protection offered in the e-mail scanning would hover at a high 98 percent, well within what McAfee claims. However, like MXLogic and other gateway filtering, there is a quarantine area for each user, so false positives are not lost. They can later be added to a whitelist, ensuring delivery.

The documentation for the e-mail set-up is detailed enough to get started with ease. The catch is the MX configuration, which will cause some problems if not correctly configured (this would be where the phrase RTFM comes into play). If you chose the e-mail server security application, you will need to perform some other configuration options, however the documentation covers this (e-mail server Security Application is only available on Microsoft Exchange and Lotus Domino).