The Symantec Endpoint Protection client must be scheduled to auto update.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-42612	DTASEP004	SV-55340r1_rule		Medium

Description
Antivirus signature files are updated almost daily by antivirus software vendors. These files are made available to antivirus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system. The antivirus software product must be configured to receive those updates automatically in order to afford the expected protection.

STIG	Date
Symantec Endpoint Protection 12.1 Managed Client Antivirus	2014-10-01

Details

Check Text ( C-48893r1_chk )
Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Under Policies, select LiveUpdate -> Double-click the applied policy -> Select Overview -> Under Policy Name -> Ensure "Enable this policy" is selected. Criteria: If "Enable this policy" is not selected, this is a finding. On the client machine use the Windows Registry Editor to navigate to the following key: 32 bit and 64 bit: HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\Schedule Criteria: If Enabled is not set to 1, this is a finding.

Check Text ( C-48893r1_chk )

Server check: From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Under Policies, select LiveUpdate -> Double-click the applied policy -> Select Overview -> Under Policy Name -> Ensure "Enable this policy" is selected.

Criteria: If "Enable this policy" is not selected, this is a finding.

On the client machine use the Windows Registry Editor to navigate to the following key:
32 bit and 64 bit:
HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\LiveUpdate\Schedule

Criteria: If Enabled is not set to 1, this is a finding.

Fix Text (F-48194r1_fix)
From the Symantec Endpoint Protection Management Server, Symantec Endpoint Protection Management Console: Select Policies -> Under Policies, select LiveUpdate -> Double-click the applied policy -> Select Overview -> Under Policy Name -> Select "Enable this policy".