HP T5700, t5710, Sygate Security Agent, Symantec Embedded Security Frequently Asked Questions Manual

HP Sygate Security Agent and Symantec Embedded Security:
Frequently Asked Questions

Question and answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Firewall questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Log files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Intrusion detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

For more information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1

Question and answers

This paper provides answers to commonly asked questions about the HP Sygate Security Agent and the
Symantec Embedded Security subscription service. Currently, the firewall in Symantec Embedded Security
is the same as in the HP Sygate Security Agent.

Overview

Q: Are thin clients susceptible to viruses or worms?

A: Server Based Computing with HP Compaq Thin Clients is, by nature, less susceptible to virus and

worm attack than a PC with Windows XP Professional. When compared to the traditional
unmanaged PC network model, the HP thin client computing model yields a less vulnerable,
segregated approach to computing with substantially better recovery time, while minimizing total cost
of ownership (TCO).

1. With the HP thin client computing model, your exposure to virus attack on the thin client system is

less than a standard Windows PC. See the white paper titled “Thin Client Virus Vulnerability
Analysis” at http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00595181/

c00595181.pdf for more information.

2. The HP thin client computing model utilizes PC blades and/or servers located in the data center.

You can protect and monitor these centralized devices more easily with centrally managed virus
and firewall tools. Compromised resources can be quickly taken offline, or recovered faster and
more cheaply than distributed PC resources.

3. Since no user data resides on the thin client, there is no risk of user data loss due to a virus or

worm on the thin client.

4. If a thin client’s image is compromised or corrupted, the recovery time is typically measured in

minutes instead of hours. You can often perform recovery with a simple reboot of the client.

Additionally, HP follows strict security-centric image design policies and uses the Enhanced Write
Filter to provides a more secure environment for thin-client computing. The Enhanced Write Filter
protects the thin client from undesired flash memory writes (the operating system and functional
software components reside in flash memory). If a thin client does become infected by a virus, a
simple reboot cycle clears the system RAM and returns the client to its original state from the protected
Flash memory.

HP believes the thin client computing model is an effective solution for the security conscious
enterprise. However, the Windows XP Embedded operating system may have vulnerabilities that can
be exploited by the increasingly sophisticated attacks on business networks. To provide further
protection for our customers, HP has partnered with Symantec to deliver industry leading protection
from worms, trojans and viruses.

Q: What does HP deliver in the factory image?

A: The image contains the HP Sygate Security Agent.

2

Q: What is the free functionality?

A: The HP Sygate Security Agent provides a customizable firewall that helps protect your computer from

intrusion and misuse, whether malicious or unintentional. It detects and identifies known Trojans, port
scans, and other common attacks, and in response selectively allows or blocks the use of various
networking services, applications, ports, and components.

HP Sygate Standalone Agent has the ability to allow or block any port or protocol, inbound or
outbound, by either application or traffic signature. The Agent not only blocks according to these
parameters, but can also link them with logical and/or conditional statements, increasing the scope
and flexibility of polices that you can apply. The Agent can also block and apply policy to custom
protocol adapters, enabling enterprises to use custom network-enabled applications and to block
applications that circumvent the TCP/IP stack with custom protocol adapters.

Q: How can I get signature updates for the Sygate firewall to ensure protection from

the latest threats?

A: Symantec Embedded Security (HP Part Number EL390AA) is available as a subscription service.

Symantec acquired Sygate and has integrated the Sygate firewall into Symantec Embedded Security.
Purchasing the Symantec Embedded Security subscription provides a full year of updates to the
firewall, and additionally provides integrated anti-virus technology, a requirement in many business IT
environments. HP offers leading firewall and antivirus technology from an industry leader: Symantec
Embedded Security.

Q: How can I obtain antivirus support for my thin clients?

A: Symantec Embedded Security (HP Part Number EL390AA) is available as a one year, renewable,

subscription service. With both antivirus and firewall protection, the Symantec Embedded Security
agent provides an industry-leading level of protection for thin clients with Microsoft’s XP embedded
operating system. Symantec acquired Sygate and has integrated the Sygate firewall into Symantec
Embedded Security. Purchasing the Symantec Embedded Security subscription provides a full year of
updates to the firewall, and additionally provides integrated anti-virus technology, a requirement in
many business IT environments. HP offers leading firewall and antivirus technology from an industry
leader: Symantec Embedded Security.

Q: How do I buy Symantec Embedded Security?

A: Symantec Embedded Security (HP Part Number EL390AA) is available direct from HP, or your local

and online resellers. Once purchased, HP will mail you a letter with information on how to download
the latest versions of the Symantec Embedded Security and updates for the antivirus and firewall
components.

3