Where patching ends DCS takes over fortress mode for legacy and modern systems
Use Cases and Deployment Scope
A lot of my clients are running legacy operating systems, and I use DCS Prevention to harden these systems. I also use DCS to provide granular access control for non-legacy systems, thereby reducing their attack surface and exposure to vulnerabilities. Lastly, it significantly reduces the costs associated with the Extended Security Update (ESU) program.
Pros
- Granular Control via application Whitelisting
- Granular control not just via application executables but also the network connections that is launched via the applications for an even more refined control
- Support for very old Legacy Operating systems are supported for both Server and Desktop OS platforms
- Ability to send syslogs to SIEM
- Support for many Operating systems types, Legacy and Non-Legacy
- Many ways to build policies to get to the same end result giving flexibility in creating the design that supports the customer.
- New version of DCS-SA 6.10 has the singular UI back for all management and investigation related tasks giving you the single pane of glass.
- Provides ability to seamlessly detect what runs on the applicable OS and then take that results and import int a prevention rules that lowers allot of manual effort.
Cons
- Alerting needs some work. It's a bit tedious to get the exact alerting correct. Build out a more friendly UI for alerting options
- Need DCS-SA to have an HA option so you can enable multiple DCS-SA Management Servers for automatic fail-over.
- Would be nice if you can setup a replication options in DCS-SA for clients with multiple sites so you can have a DCS local Server at each site then replicate the data between the sites.
- Would be nice to have DCS-SA as a cloud native option as well where agents are installed then points to the DCS-SA Cloud Portal. THen add replication in from a local DCS-SA server to the cloud as well
- Extend support for DCS-SA to be able to do AV scanning not just when using VMWare NSX via agentless scanning but also just to scan via agent?
Return on Investment
- ESU savings: Removed legacy devices from the Extended Security Update program, saving roughly 2 mil per year.
- Legacy life extension: Kept unsupported OS's secure for 4 years past end-of-support, avoiding 3 mil in early replacement costs.
- Audit and risk: DCS accepted as the compensating control in 2 audits, with zero successful compromises on hardened systems since deployment.
Usability
Other Software Used
Symantec Endpoint Security, Symantec Encryption, Symantec Email Security.cloud, Symantec IT Management Suite, Symantec Data Loss Prevention
