The Symantec Endpoint Protection client must be scheduled to auto update.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42668	DTASEP004	SV-55396r1_rule		Medium

Description
Antivirus signature files are updated almost daily by antivirus software vendors. These files are made available to antivirus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system. The antivirus software product must be configured to receive those updates automatically in order to afford the expected protection.

STIG	Date
Symantec Endpoint Protection 12.1 Local Client Antivirus STIG	2015-06-30

Details

Check Text ( C-48939r1_chk )
GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Client Management -> Select Configure Settings -> Under the LiveUpdate tab -> Ensure "Enable automatic updates" is selected. Criteria: If "Enable automatic updates" is not selected, this is a finding. On the machine use the Windows Registry Editor to navigate to the following key: 32 bit and 64 bit: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\Schedule Criteria: If Enabled is not set to 1, this is a finding.

Check Text ( C-48939r1_chk )

GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Client Management -> Select Configure Settings -> Under the LiveUpdate tab -> Ensure "Enable automatic updates" is selected.

Criteria: If "Enable automatic updates" is not selected, this is a finding.

On the machine use the Windows Registry Editor to navigate to the following key:
32 bit and 64 bit:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\Schedule

Criteria: If Enabled is not set to 1, this is a finding.

Fix Text (F-48253r1_fix)
Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Client Management -> Select Configure Settings -> Under the LiveUpdate tab -> Select "Enable automatic updates ".