Cisco CSA replacement?

thefindjack · ‎10-20-2008

Currently we are trying to use Cisco CSA in our production environment to eliminate the need for antivirus software that may slow down production servers. Though CSA is a great product, we have found it increasingly difficult to manage and maintain as the servers we operate are so vastly different. Is there something else out there that is comparable but easier to manage than CSA, or what do others do in production environments for protection? Thanks for your replies.

tsteger1 · ‎10-20-2008

Hi David, you don't mention which version you are using.

CSA (pre version 6) wasn't designed to obviate the need for AV.

CSA had a pretty steep learning curve in earlier version especially if you increased the number of applicable policies.

I think they addressed a lot of that with version 6 and the inclusion of ClamAV was an added bonus.

I don't know if you've tried it, but you might want to before dumping it for something else.

I haven't seen any posts regarding some of the issues you've experienced and NetPro is a great resource for solving issues since you probably aren't the first to encounter them.

Tom

thefindjack · ‎10-20-2008

Currently Im on version 5.2, so maybe alot of the problems I have encountered could be resolved with a newer version. So you would say that version 6 is more use friendly? Seems like version 5.2 is very cumbersome and hard to manage, I feel like it could be a full time job to setup and manage it on a day to day basis.

tsteger1 · ‎10-20-2008

Version 6 was designed to be easier to manage and I found that to be the case, though I haven't had as much testing time as I'd like.

Take a look at the release notes here:

http://www.cisco.com/en/US/docs/security/csa/csa60/release_notes/CSA60RN.html

I've been using CSA since version 4.0.3 and it seems to get easier to manage with each new version.

And remember, any issues you run in to have probably been seen before, so post here if you need advice.

Tom

matt_nels · ‎10-20-2008

The jump to 6.0 from 5.2 does make a good deal of changes that make it a bit easier. At first it may be a little strange at first, but you will quickly notice that the changes make the work easier.

jimmahoney99 · ‎10-22-2008

I also am looking for a replacemnet becuase i feel csa is very high maitenance. In it's defense. it was in when i started this job and the person that brought it in has gone and there is now documentation. the version i'm on is 4.x. other products i have been looking at 1)stormshield by Skyrecon. 2)Cynapspro 3)Sanctuary Suite by Lumensions 4)Parity by bit9 and a few others. So far they all have the same issue in the sense that you have to have rule or a whitelist everytime you rollout a new app or make changes to an app that modify's the hash of the file. I'm actually going to start looking at CSA 6.0 and see if it helps my issues

hope this helps

Jim