VMware VSHIELD ENDPOINT User manual

P R O D U C T D A T A S H E E T / 1
D A T A S H E E T
AT A G L ANCE
VMware vShield Endpoint strengthens security for
virtual machines and their hosts while improving
performance by orders of magnitude for endpoint
protection. vShield Endpoint enables ooading of
antivirus and anti-malware processing to
dedicated security-hardened virtual machines
delivered by VMware partners. The solution is
designed to leverage existing investments and
allows customers to manage antivirus and anti-
malware policies for virtualized environments with
the same management interfaces they use to
secure physical environments.
K E Y B E N E F I T S
•Streamlineandaccelerateantivirusandanti-
malware deployment.
•Improvevirtualmachineperformanceand
eliminate antivirus and anti-malware bottlenecks.
•Reduceriskbyeliminatingagentssusceptibleto
attacks, and enforce remediation more easily.
•Satisfyauditrequirementswithdetailedlogging
of antivirus and anti-malware activities.
VMware vShield Endpoint
Endpoint Security for Virtual Datacenters
What is VMware vShield
Endpoint?
VMware vShield Endpoint is a unique solution that optimizes
antivirus and other host and endpoint security for use in VMware
vSphere™ 4.1 and VMware View™ 4.5 environments.
vShield Endpoint improves performance by ooading key
antivirus and anti-malware functions to a security virtual
machine, eliminating the antivirus agent footprint in virtual
machines. This advanced architecture frees up system resources,
improves performance of antivirus and anti-malware functions
and eliminates the risk of antivirus “storms” (overloaded
resources during scheduled scans and signature updates).
vShield Endpoint enhances security with a hardened, tamper-
proof security virtual machine (delivered by VMware partners)
that uses robust and secure hypervisor introspection capabilities
in vSphere, preventing compromise of the antivirus and anti-
malware service itself. Demonstrating compliance and satisfying
auditor requirements are enabled through detailed logging of
activity from the antivirus or anti-malware service.
Administrators can centrally manage VMware vShield Endpoint
through the included vShield Manager console, which integrates
seamlessly with VMware vCenter™ Server to facilitate unified
security management for virtual datacenters.
How Does VMware vShield
Endpoint Work?
vShield Endpoint protects virtual machines and their hosts
against viruses, malware and other threats. vShield Endpoint
plugs directly into vSphere and consists of three components:
 Hardenedsecurityvirtualmachine
(deliveredbyVMwarepartners)
 Driverforvirtualmachinestoooadfileevents
 VMwareEndpointSecurity(EPSEC)loadablekernelmodule
(LKM)tolinkthefirsttwocomponentsatthehypervisorlayer
vShield Endpoint monitors virtual machine file events and notifies
the antivirus engine, via VMware EPSEC, which scans and returns a
disposition. It also supports scheduled full and partial file scans
initiated by the antivirus engine in the security virtual machine.
VMware vShield Endpoint streamlines and optimizes antivirus and anti-malware
deployments for virtualized environments.

VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel [phone] Fax [phone] www.vmware.com
Copyright © 2010 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed
at http://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be
trademarks of their respective companies. Item No: VMW_10Q3_DS_PROD_VSHIELD_ENDPOINT_USLET_EN_R4
VMware vShield Endpoint
Antivirus and Anti-Malware Service Across
Virtual Machines
•Antivirusengineandsignaturelesareonlyupdatedwithinthe
security virtual machine, but policies can be applied across all
virtual machines on a vSphere host.
Enforce Remediation
•Pre-denedpoliciesdictatewhetheramaliciousleshouldbe
deleted, quarantined or otherwise handled.
•vShieldEndpointdrivermanagesleremediationactivitywithin
the virtual machine.
Partner Integrations
•IntegrationofVMwarevShieldEndpointwithsecurityvirtual
machine solutions from VMware partners is facilitated through
VMware EPSEC, which provides a library and API for
introspection into file activity at the hypervisor layer.
Policy and Configuration Management
•vShieldManagerprovidesfull-featuredcongurationofvShield
Endpoint policies.
•vCenteractivatesvShieldcapabilitiesonvSphere.
•RESTAPIsallowcustomizedintegrationofvShieldEndpoint
capabilities into solutions.
Logging and Auditing
•Loggingisbasedonsyslogstandard.
•RESTAPIsandvShieldManagerprovideaccessto
third-party logging and auditing tools.
•Administratordenesloggingon/oforantivirusand
anti-malware file activity such as scanning.
Find Out More
For information or to purchase VMware products,
call877-4-VMWARE(outsideofNorthAmericadial
650-427-5000), visit www.vmware.com/products,
or search online for an authorized reseller. For detailed
product specifications and systems requirements, refer
to the VMware vShield Endpoint Administration Guide.
When remediation is necessary, administrators can specify what
actions to take using their existing antivirus and anti-malware
management tools, and vShield Endpoint manages any action
withintheaectedvirtualmachines.
How Is VMware vShield
Endpoint Used?
Streamline antivirus and anti-malware deployment – With
vShield Endpoint, administrators only need to deploy the
enterprise antivirus engine and signature file to a single security
virtual machine instead of each and every individual virtual
machine on a vSphere host.
Improve virtual machine performance – vShield Endpoint
helps organizations securely achieve higher consolidation ratios
by ooading activities such as antivirus and anti-malware scans
from individual virtual machines to a single security virtual
machine on each vSphere host.
Prevent antivirus storms and bottlenecks – Administrators
can use vShield Endpoint to prevent antivirus storms and prevent
bottlenecks associated with multiple simultaneous antivirus and
anti-malware scans and updates.
Protect Antivirus security software from attack – vShield
Endpoint lets administrators deploy and run the antivirus and
anti-malware client software in a hardened security virtual
machine to prevent attacks that target antivirus and anti-
malware solutions.
Key Features
Antivirus and Anti-Malware Ooading
•Filescanningandothertasksareooadedfromvirtual
machines to a security virtual machine.
•VMwareEPSECLKMmanagescommunicationbetweenvirtual
machines and the security virtual machine, using introspection
at the hypervisor layer.