Large Media/Entertainment Company secures Intellectual Property

Background: This Webroot customer is a large global media/entertainment company with more than 30 decentralized locations worldwide.

Challenges: The company has over 54,000 desktops globally. Their largest campus alone is almost 20,000 desktops covering a geographical area larger than Manhattan. About the same time it began looking for a spyware solution, the company was also migrating from a distributed, decentralized IT organization to a centralized one managed by a single CIO. Not a simple task, this migration will take a considerable amount of time and investment to accomplish fully. Spy Sweeper Enterprise is one of the few systems the entire company has centralized on so far. The company has about 2,000 IT people supporting its 54,000 desktops, and it has two people fully dedicated to addressing malware concerns. The company is mostly made up of Wintel machines, either of the desktop or server variety. So, while the malware folks are focused on solving the company's malware challenges regardless of platform, the reality of the situation is that most of their environment is Wintel.

Issues: Given this company's concern with security and privacy, the need to protect the company's intellectual property and their employees' and customers' personally identifiable information was obvious. However, what really rang true with management about the spyware problem was the amount of time and effort spent on troubleshooting, diagnosing, and cleaning specific spyware events from tens of thousands of PCs. As the IT team documented and tracked events related to spyware, the amount of time lost on reformatting hard drives, identifying elusive spyware, cleaning systems and responding to ambiguous help desk calls was unacceptably cost prohibitive. Additionally, the problem was complicated by the sheer physical size of some campuses. It is extremely inefficient to send IT people all over a campus that might be several miles across every time a user has unidentified and random computer misbehavior. Because of spyware's ambiguous symptoms identifying and cleaning the machines without sending a technician is difficult. Adding to the problem is the specific knowledge required for effectively eradicating spyware; it is difficult to ensure all technicians have the right knowledge to eliminate the problem effectively and completely. Simply put, the time spent on spyware was simply not cost effective for the company. Once the senior management realized how much time, effort, and money was wasted on the presence of spyware, they approved the effort of testing and selecting a potential anti-spyware vendor. The company tested a wide variety of anti-spyware software in their search for a solution. Tests included integrated anti-virus suites, best of breed software and even freeware applications. However, it was Webroot that won out.

Solution provided by Webroot: Webroot provided this company its Spy Sweeper Enterprise flagship product, an enterprise-class, centrally managed, scalable solution for companywide protection against all types of spyware, adware and other malware. Spy Sweeper Enterprise is a dedicated desktop and server anti-spyware solution providing a critical addition for maintaining optimal system performance and protecting intellectual property. Webroot's anti-spyware solution provides the following key features that enabled this company to dramatically improve its defense against spyware attacks:
- Real-time blocking with Smart Shields. Spy Sweeper Enterprise offers Smart Shields for proactive defense against spyware behaviors that change a system, including changes to system memory, registry entries, host files, start-up processes, browser hijackings, and many other security settings.
- Accurate threat detection. Utilizing a combination of thorough research and detection processes, Spy Sweeper Enterprise provides very accurate threat detection reducing the potential risk from false positives.
- Patent-pending Comprehensive Removal Technology (CRT). Webroot Comprehensive Removal Technology is the backbone of its advanced spyware removal engine. CRT uses adaptive recognition practices to remove processes,applications, or files that may have changed during the remediation process or may not have been previously detected.
- Threat database — backed by the power of Phileas™. The Webroot Threat Research Center delivers a standard of protection that is unmatched in the industry. Phileas is an automated spyware surveillance system designed to proactively detect spyware on the Internet. Phileas identifies potential spyware and provides protection from new threats before users can unwittingly infect their PCs. This technology dramatically enhances Webroot's anti-spyware definition database and detection capabilities.
- Centralized management. Using the Web-enabled administration console, IT admins centrally configure and automate the deployment of definitions, policies, sweep schedules and program updates to the desktops from anywhere. The admin console allows multiple administrators to be simultaneously be logged in with full audit logging of all user actions. Admins are able to configure the client to be invisible to end users, allow user control over specific settings, or run in administrative mode with full control for advanced users.
- Seamless, scalable deployment. Spy Sweeper Enterprise is seamlessly deployed throughout the organization via login script, an internal software management solution, or using Group Policy in Active Directory.
- Powerful sweep settings. IT admins may specify sweep schedules, set policies for automated quarantine and removal of spyware, configure settings for coverage of files, memory, and registry in sweeps, and determine any software that should not be removed for selected groups (i.e., authorized system monitoring tools used by IT). The lockdown feature allows admins to dictate network and workstation settings for full compliance with the corporate security policy.
- Laptop and remote user management. Spy Sweeper Enterprise maintains the enforcement of administrator-set policies for laptop and remote users while they are away from the network. Laptop and remote users directly check the Webroot update server for definition updates while not connected to the corporate network to ensure continuous protection from spyware threats.
- Reporting and alerting. Extensive reporting features provide geographical executive summaries, spy reports, and status updates. Admins may customize reports to provide detailed analysis of the spyware threat by workstation, group, type deleted and time. In addition, alert settings allow admins to configure multiple email addresses and notification options to ensure the correct people in the organization are alerted when a threat is detected.

Spy Sweeper Enterprise provides a distributed anti-spyware solution using a client/server architecture with centralized management and reporting. The optional deployment of update distribution services allows large organizations to load balance client updates, while also enabling multi-site companies to conserve bandwidth by distributing updates from servers located on the same LAN. With Spy Sweeper
Enterprise, IT administrators may configure security policies and sweep settings by individual workstation, specific groups of users, or companywide. Once Webroot was chosen, the company found that the software not only performed as expected; it exceeded those expectations. The installation and deployment went very smoothly.

Summary: Using internal analysis and estimates, the company now believes that about 35% of their call volume was attributed to spyware prior to the installation of Webroot. Now, very few calls are spyware related, and the call volume has been dramatically reduced. Before the installation of Webroot, the company was about 90% infected with at least one instance of spyware on each computer at their main campus, which houses about 20,000 desktops. In addition, at least 64% of those infected machines were considered critically infected with at least five instances of spyware. After the introduction of Spy Sweeper Enterprise, only 48 machines, or about one-quarter of 1%, are identified as critically infected. This is a vast improvement from the previous situation. However despite these rather stellar results of effectiveness, the company didn't choose Webroot solely on that merit. What really sold them on Spy Sweeper Enterprise was the enterprise central management features.

While several vendors claim central management capabilities, the company felt that only Spy Sweeper Enterprise provided real centralized management. Considering the size and scope of this company, it makes complete economical sense to easily centrally manage software. Certainly features such as price were important, since management would never sign off something abhorrently expensive. But centralized management was important enough to the company that they would've been willing to sacrifice a certain amount of effectiveness to gain the easy management of tens of thousands of desktops from any location. Since the deployment of Webroot the company has noticed a dramatic reduction in help desk calls, non help desk calls within IT and has fewer undefined problems overall. In the interest of full disclosure the company's IT organization was undergoing significant restructuring during this time to a more efficient structure so it is possible that some of the recognized benefits were influenced by all of the activities performed around that time.

Webroot Software
2560 55th Street
Boulder, CO 80301 USA
Tel: 1-800-772-9383

Recommend this to others: