The good, the bad, and the truth about cloud-hosted Antivirus

A while back, in the interests of reducing RAM usage on several SBS 2003 sites, I made the switch to a cloud-hosted Antivirus product.  This was the end point, but it certainly wasn't what I started out looking for.

Both clients had on-premises installations of Symantec Endpoint Protection, having simply renewed licensing for full-blown Symantec Enterprise suites over the years.  Of key importance to me was that my customers were paying for features that we just couldn't use, given the loading of the servers and the scarcity of hardware.

I saw the requirements as two key components;

• Endpoint protection (i.e. desktops, laptops, servers) and
• Email protection (antivirus and antispam)- being MS SBS sites, this means Exchange Server.

The full SEP suite gave me SMTP as well as VSAPI email protection, and Web protection in-line via a proxy daemon, as well as Mac and Linux protection.  I didn't need any of those.

With expiring subscriptions for SEP 11, I approached my preferred supplier and started making enquiries about cross-grade pricing to just get the products I needed, plus some pricing for ESET's SBS suite, just for comparison.

My account rep Monique put me in touch with the local in-country distributor for Symantec products, who duly made contact and asked some pointed questions.  A few days later, a quote turned up for the two relevant Symantec products (Endpoint, and Mail Security for Exchange) with a price tag around twice the cost of a simple renewal of the full SEP suite, which included these products already.

I expressed my dismay, and started plotting my revenge in the form of a carte-blanche migration to ESET Nod32.  I had heard some really bad things about SEP 12, so a straight renewal of SEP wasn't high on my list of Fun Things To Do:

But a day or so later, I got a call from a Business Development Manager for Symantec Australasia, based in Sydney.  We had a great chat, and he pointed me to the new (at the time) Symantec Endpoint Protection Small Business Edition 2013 (which later went through a name change).

Mind = blown.

Irrespective of anything else, I could get rid of the hugely resource-hungry SEP Management and Sybase SQL Anywhere database system, and manage the desktop AV clients from the cloud.  OK, so what about the email system?

Well, email took a bit of a change of heart.  For years, I have been a proponent of VSAPI scanning, letting the server take all AV load for message and attachment scanning and leaving the clients to do nothing more than filter some junk-mail. My main reason was the really good spam protection I had been receiving through the Brightmail technology built into Symantec's Mail Security for Exchange (SMSMSE).  I was also relying on the ISP by using wildcard POP3 accounts, and the SBS POP3 Mail Connector. Yes, I could continue to do that (I had a quote, albeit an expensive one), but I was excited by the possibility of offloading that processing to the cloud as well.  Did Symantec have something that fit?  Absolutely - a mail filtering platform that provided both Antivirus and Antispam filtering during the SMTP delivery path.  Symantec email.Cloud.

I received pricing.  I was smitten.  Things couldn't get better.  Pricing was average (about the same as ESET's on-premises suite), and I could free up valuable resources on my single-server sites.

So I ordered, and life was good.

Is it perfect? No.

Is it great value for money? Well, no.

So do I regret it?  No.  The decision to shift to the cloud was made for the right reasons, but I probably could have (should have) chosen individual vendors for each product/layer, selecting the offering that represented the best cost/benefit proposition for each area.  I didn't, but I'm now happy with what I have.

Watch out for my follow-up article on deploying and configuring the Symantec cloud-managed Small Business Edition Endpoint client.  I'm also planning on a second follow-up article, specifically around the Symantec email.Cloud platform. I promise to try to bring those to you more quickly than the six months it took me to get onto this one.

Cheers,
JS

Are Virtual Servers relevant for single-host sites?

Hypervisors are great. I work with VMware's vSphere and vCenter all day every day in my life as an IT Infrastructure Engineer. Virtualisation (no, I don't spell it with a 'z', I don't live in the U.S. of A.) is a staple part of most organisations today.

But is it relevant for a small organisation with a single server?

Client B (the second-smallest client I have) is 'little'. A 10-user manufacturing business, they are by far the most formal of my small clients and actually care about their IT systems. But have no doubt, the IT budgets are limited.

A recent discussion with the Managing Director about their IT future highlighted some challenges when designing a solution; in a genuine small business, none of the IT components are optional.

Me: What bits do you need in a hurry to keep the business running? You know, fulfil existing orders and take new ones.
Client: Just email and Exo (a SQL-based accounting system) and the formula documents on the 'S'-drive. And the office phones, but just the main number will do if we can get to voice-mail. And the payroll system if it's a Tuesday. Oh, and the Internet, for banking and stuff. But that's all. We'd have the email on our phones, right?
Me: So.. everything then?

In my experience, a small business is often built around Microsoft's Windows Small Business Server. And for one reason really: Cost. SBS is cheap when compared with the cost of purchasing the same functionality one license at a time (I don't count Open Source platforms, one day I might even explain why). So if your Small Business got on the SBS ladder prior to ~2008, then Exchange, Active Directory, SQL, and a whole bunch of other stuff is likely to be on the one server.

So, back to the original question: is a single hypervisor host relevant in this business? All those eggs, all in the one basket?

My answer is, 100% yes. And here's why; it helps with the costs to the client, while making administration and expansion easier. Win-win.

Microsoft's SBS 2008 and 2011 editions allow you to split your SBS installation onto a second server for the core products, if you have the Premium edition. And you've always been able to introduce a second Domain Controller to an SBS environment, or add member servers to split File & Print or other application-specific services off. Chances are pretty good that there wasn't budget for a second server, but maybe you managed to squeak one in. But at the heart of the system, you still had one main server. Or worse, you had two or three important servers, any of which would be a major problem if it wasn't up and running. So essentially, all your eggs were in the one basket anyway.

Virtualisation adds some bonuses, and given the 'everything in one' thing isn't any more of a negative than we already had, those bonuses are pure wins. Let's list some;

• Snapshots - we can take a quick snapshot of a VM before doing some risky upgrade. Roll-back is now simple if the brown stuff hits the fan. (PS; Don't make snapshots of your AD controller, and roll back to them, if you have multiple AD controllers! More on this another day, just take my word on it for now.)
• Easy remote admin - all hypervisors use some sort of admin console, which exposes power-on/off, virtual media mounting, adding additional disk etc.
• Flexible DR and BCP - your systems are already image files, so you can probably find a machine and a way to boot your existing machines if your main host does go belly-up.
• New things to play with - there are dozens (hundreds? Probably thousands!) of useful Virtual Appliances around, so things that used to be out of the budget may be reasonably straight forward in a virtual environment. Need a firewall but the client won't spring for anything more than a ADSL router with NAT? Try a free firewall appliance. How about a network monitoring system?

In an upcoming post, I'll have a look at the two hypervisors I thought about (VMware's vSphere Hypervisor, and Microsoft's Hyper-V), which one I went with and why.

Cheers,
JS

In The Beginning..

I created a blog!  Well OK, let's get started then.

I've been wanting to document my decisions, questions, answers and the bits in between, of the impending upgrade to SBS 2011 of my various SME clients. So here we are.

If you stumble upon this post, be aware that this is intended as a placeholder post until I get the time to write a proper one.  In the meantime, my wife is dragging me off to see the newborn child of some friends of ours :)

There's a bit of stuff already that I want to capture, so I'm making a note of it here in order to remind myself.

• The good, the bad, and the truth about cloud-hosted Antivirus
• Are Virtual Servers relevant for single-host sites?
• ESX or Hyper-V
• Backup options
• The many ways to buy SBS
• Storage for a SME Host - NFS storage and RAID levels for Local Disk
• Hypervisor Host specs - How much do you need?
• Booting from USB/SDCard and the extra things that must be done
• Hardware management and health alerts
• Can't access your ESX host? Here's one reason why.

Hopefully, for your sake and mine, this turns out to be useful.

Cheers,

JS