Norton Internet Security 2010 product reviews

After the 2009 edition blew me away, I was hard-pressed to figure out just how they were going to make this one any better. What, artificially-intelligent virtual spies summoned up to hunt nasties in the system? And you know what... that's kinda what they did! Except, instead of a ravening horde of little code warriors, they have us... the community of Norton product users... and a collective intelligence system aptly called "Quorum".

Quorum is a system that copes with those annoying files that are neither clearly white-hat or black-hat, by assessing them based on their prevalence and 'reputation' amongst the collective Norton userbase. Let me put it this way... as the security industry is well aware, there are three main security methodologies: Black-, Grey- and White-list based, bahaviour-detection based, and file signatures. They all have the same failing however... they are statistical tools that work best on large volumes of known files... but are utterly useless on unknown files that occur in very small volumes. Enter Quorum... it draws on the knowledge of millions of users... if a file is extremely rare, comes from an unknown, or known-bad, source, and was created very recently, it is unlikely to be a valid file... more likely a one-shot piece of malware generated on the fly to beat the list and signature based systems.

Because traditional malware protection has a series of unavoidable delays - first a file has to be suspected by a user, then submitted for investigation, then processed for damage assessment and threat potential, and finally studied for reliable detection and eradication methods - malware authors have learned that the window of opportunity has shrunk to around 24 hours or less, thus the threats have evolved too - now the most effective malware tools are generated 'on the fly' as you visit and infected website or download a new application from a torrent for example, and have variable behaviour patterns... beating all of the traditional security protocols easily. Mutating code beats signature-based security, while it's unique nature makes it relatively immune to list-based systems and novel behaviour routines confuse bahaviour-based detection tools. So, because it is a new file, relatively unique amongst the community, and has no reputation, the user is warned off allowing or using it. This effectively neuters the malware's greatest tool, and ensures that their greatest feature is the one that will ultimately make their tools MORE detectable.

Now this isn't some Nazi'esque system that states "I do not trust zis file, you are verboten to use it. I vill kill it now!" - it is simply a user-informing system that says "Well mate, this one looks a bit dodgy... use it if YOU trust it, but be aware it could be a nasty." then leaves it to the user to make up their own mind. This somewhat flies in the face of Norton's latest ethic of "Look, why ask the user? Years of experience and research tells us X is bad, Y is good... so let's save them the stress and automate that bit." but it leaves the ultimate control in the hands of the user, and if they are unsure, it also advised to hold off using the file, and check it again in a few hours to see if has become more 'trusted and acceptable' by the community. But fear not... this is only an *added* level of protection... all the tradtional systems are still in place and just as effective... Quorum simply adds another tool in the ongoing war on malware stupidity.

As well as this newest tool, which has actually been passively integrated into the last few versions, collecting test data and file statistics but is only now an active component, this suite has all the usual gadgets: antivirus of the traditional support, firewall, identity protection, content filters, web-browser protection (for most, but not all, browsers), email scanning and intrusion protection. And as with the 2009 suite, this system comes with independant CPU vs Nortons resource usage meters, providing clear evidence that though Norton's CAN use up all of your system resources, it only does so when you aren't active. While you are on the machine, Norton's quietly sits back and let's you hog it for yourself.

For users of last year's offering, the new interface has few surprises. A new skin - less of a window and more of a flat-panel touchscreen effect, which I personally think is a great style that should be adopted by more application designers, and a new "flip screen" gadget that literally rolls the main window over to reveal a secondary screen with more information and tools. You can't miss it, it's the big bent-around arrow in the bottom-left corner that wasn't there last year. Other that, all the features and tools, methods of configuration, and reporting graphs are all pretty much the same, though you may notice a few minor differences, particularly the new easy-to-access System Insight report that displays little marker icons at key events. This can be helpful to track down any sudden new problems... a quick look at this report will show you if problems were always happening, or only started to manifest themselves after you installed a particular piece of software, for example.

For those who just want a quick overview, the main screen will be more than sufficent, but for the die-hards, drilling down through the layers of links will give you pretty much all the details you could want, plus a few that you probably don't need. Such as the Vulnerability Protection tab, which lists all the software Norton's are aware of that are vulnerable to attack... the downside of this list: It's not restricted to the software YOU have... it's the whole swag! A bit pointless, a nightmare to plow through, and could easily be made far more useful by automatically filtering it against your system's actual app list... after all, it knows every file on your beast, so surely it can't be THAT hard to prune it down? Maybe in 2011...

You'll find other updated features are very effective, such as the new anti-spam engine... which surprisingly is no longer a Norton tool, but now uses Brightmail's engine. Reports vary, but they all confirm that this is between 15-20% better than last year's Norton-based engine. Will wonders never cease? And finally there's the kids to consider... and the package comes with a free subscription to OnlineFamily - a content-control system that filters the results of search traffic from some of the major searchengines and reports on their potential threat rating. You could use browser plug-ins to do the same thing, such as the highly effective Web of Trust (WoT) plugin for Firefox, but OnlineFamily is a bit more than simply a rating system, so is going to provide you more trustworthy results.

On a more pragmatic level, the tests we ran were on a moderately well-infected system, with a range of malware that was from across the detection spectrum. Some of it would test the signature-based protection, some the behavioural, and some was fresh unique code downloaded from a site known to be infected with drive-by download malware. NIS '10 managed an impressive 99.8% accurate detection rate on the first pass, and cleaned up the rest less than 2 minutes later after a pulse update brough it up to speed. Sure enough, Quorum detected them first, but was unable to advise clearly... which is quite acceptable really... better to leave it to the user when certainty wasn't at 95% or better. Only one false-positive, and that was from our booby-prize file... a keygen application downloaded at random from the internet. Known to be clean, it was to be expected. No anti-malware system likes keygens, even clean ones.

Overall, once again Symantec have outdone themselves. The new features add value as well as greater security to ensure your online experience is as safe and secure as it's possible to get, while still leaving the user free to get on with things without being bombarded by pointless drivel messages that confuse... often leading to some bad choices and a lot of pointless abuse of an innocent and effective tool. We did encounter one strange issue when it came to this, and though we at first thought to blame NIS, it was actually NIS that helped us discover the REAL cause... at the same time as we were evaluating this, we were also testing some external storage devices, and found the system would crash and we'd get a visit from the BSoD Fairy if we unplugged a drive. This behaviour only began after we installed NIS '10... but with the aid of the System Insight report, we were able to pin the actual start of the trouble down to the installation of a second drive managment utility that conflicted with the first one... the second one was installed 8 hours AFTER we installed NIS... and the reports confirmed the actual cause and link... so well done Norton, you kept your reputation clean, and proved your effectiveness in one fell swoop.