2

Years back I used Altiris SVS which is now Symantec Endpoint Virtualization and I liked it but I ended up switching to Sandboxie. It how since been updated by Symantec and I am considering switching back.

I have tried to read up on the "Symantec Virtualization Suite" but all the information that relates to what I want to know refers to "Altiris Software Virtualization Solution" which I remember being not nearly as put together as the updated Symantec version of it so I don't know if this information holds true still or not.

What I Want:

  1. Compatibility with as wide a variety of applications as possible as I plan on installing anything I can in the solution I end up using.
  2. Security as to keep my applications trapped away from infecting my system. Like a Browser exploit.
  3. Clean environment the less clutter the better so I can easily remove an application.
  4. Windows 7 x64 compatibility

Here are the list of Pros and Cons I have come up with so far. Please correct me if I am wrong and elaborate on why I am.

Sandboxie

Pros:

  1. Very Secure
  2. Lightweight
  3. Highly Configurable
  4. Flexible
  5. Easily View What is Running under each box and terminate it if needed

Cons:

  1. Not Free
  2. Not fully supported on x64
  3. Items are trapped or not, visible to only themselves or actually written to the system
  4. Clunky Interface
  5. File Structure is Messy
  6. Hard to backup for migration to new install.

Symantec Endpoint Virtualization

Pros:

  1. Lightweight
  2. Transparent
  3. Professional Grade
  4. Free for personal use
  5. Straight Forward interface
  6. Applications can interact with other applications files in different ways.
  7. Supported on Windows 7 x64
  8. Easy to backup

Cons:

This is where I need help as I have not fully tested this solution. The information I found on other sites pertains to Altiris which is a really old version of it.

  1. Have To Disable all other Layers(Applications) to create a new one
  2. What files belong to what layer if any are unclear because it is transparent.
  3. Not as configurable as Sandboxie
  4. Security???
  5. Traps files installed on the System Drive only???
  6. ?

From what I can tell as a general overview.

Sanboxie = Visible file redirection

Symantec EVS = Transparent file redirection

You may look over this an say the obvious choice is Symantec which is the one I am leaning towards but I cannot find any real information on how secure it is which is my main concern and why I am posting this. The information I see floating around about Altiris not the updated Symantec version says it is completely insecure and files easily leave the sandbox. I have installed it in a VM and tried to get files to jump out but I have no luck. If anyone has experience with this and could enlighten me as to how secure it is I would really appreciate it.

To be more to the point.

  1. What are some Pros and Cons not listed for each application?
  2. How secure is Symantec Endpoint Virtualization? Detailed information would be appreciated.
Riguez
  • 3,764

1 Answers1

0

It turns out Symantec EVS is not intended to secure the sandbox because it would hinder the applications ability to work with other applications and the OS.

An application inside the Symantec sandbox can use other processes/programs on the system to write outside the sandbox which is a big security problem. For the most part all files are written to the sandbox but a malicious piece of software would easily be able to get out of it.

I decided to use the Symantec system for all applications except the ones that have a security risk which is pretty much just the browser... I was then left to find a way to secure the browser. The fact that Sandboxie and Symantec don't play well together cut Sandboxie out of the picture.

With just a few options left on securing the browser I decided to ThinApp Firefox 3.6 and set the ThinApp to only allow writes to be made to %Profile%\Downloads.

So the solution is to use Symantec EVS or SWV as it is actually called to manage all the regular applications and ThinApp or another solution to secure the web browser.

I would have stuck with Sandboxie but the ability to have the applications sandboxed, interact with each other normally and being able to just turn them off and completely hide them as if they were not installed in the first place is just to good to pass up... my environment is so much cleaner as I only have the applications I am currently using turned on. A good example is only turning on Photoshop with all of its clutter and processes when I need it.

Riguez
  • 3,764