The Symantec Endpoint Protection client Tamper Protection must be configured to block attempts to tamper with or shut down the client.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42669	DTASEP005	SV-55397r1_rule		Medium

Description
For antivirus software to be effective, it must be running at all times, beginning from the point of the system's initial startup. Otherwise, the risk is greater for viruses, Trojans, and other malware infecting the system during that startup phase.

STIG	Date
Symantec Endpoint Protection 12.1 Local Client Antivirus STIG	2015-06-30

Details

Check Text ( C-48940r1_chk )
GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Client Management -> Select Configure Settings -> Under the Tamper Protection tab -> Ensure "Protect Symantec security software from being tampered with or shut down" is selected. Criteria: If "Protect Symantec security software from being tampered with or shut down" is not selected, this is a finding.

Check Text ( C-48940r1_chk )

GUI check: Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Client Management -> Select Configure Settings -> Under the Tamper Protection tab -> Ensure "Protect Symantec security software from being tampered with or shut down" is selected.

Criteria: If "Protect Symantec security software from being tampered with or shut down" is not selected, this is a finding.

Fix Text (F-48254r1_fix)
Locate the Symantec Endpoint Protection icon in the system tray. Double-click the icon to open the Symantec Endpoint Protection configuration screen. On the left hand side, select Change settings -> Under Client Management -> Select Configure Settings -> Under the Tamper Protection tab -> Select "Protect Symantec security software from being tampered with or shut down".