Norton Security 2007 review: Norton Security 2007

The Norton Internet Security 2007 interface is new, the code is leaner, and the retail price much lower, and the program provided many surprises under the hood. Small-business owners and advanced users who scour the edges of the Internet will appreciate the addition of advanced malicious-behavior monitoring and new rootkit-detection features found nowhere else. But average users who never stray far from mainstream Web sites will find most of the new features within Norton Internet Security 2007 unnecessary--it's like purchasing a Hummer to drive it only to church on Sundays. And despite several code tweaks (something like 80 percent of the code was rewritten), Norton Internet Security 2007 still feels heavy and clumsy. There's a definite advantage to the end user when Symantec filters down some of its enterprise technology to the desktop, yes, but Norton Internet Security 2007 fails to strike the right balance between providing these tools and maintaining ease of use. Unfortunately, Norton Internet Security 2007 doesn't play well with other security applications you might already have installed, including third-party antispyware apps. Therefore, we recommend ZoneAlarm Internet Security 7, a much lighter, more user-friendly, best-of-breed Internet security package over Norton Internet Security 2007.

Setup and interface
Norton Internet Security 2007 is available in a boxed set and online. Either way, Symantec has lowered the price: Norton Internet Security 20007 is now priced at $69.99 for a three-user license. Note, however, that Symantec no longer offers a single-user license for Norton Internet Security 2007. Competitors McAfee and ZoneAlarm also charge $69.95 for their three-user licenses, but they still offer $49.95 single-user licenses, as well. Our installation from disc proved uneventful. Upon its completion, we needed to set up our online Norton account. Ostensibly, the account is useful when downloading optional features available from Symantec, but it's also a clever way of getting you to register your copy of the software.

Once installed, Norton Internet Security 2007 occupies 350MB of hard drive space--more than twice the file space required by either ZoneAlarm or McAfee, but given all of the included features, it's not as bad as it could have been. Like McAfee, Norton runs some nonessential services in the background, such as Norton LiveUpdate, which can reduce system performance on older machines. Unlike McAfee, the fully installed Norton runs only two active scanning processes.

The Norton Internet Security 2007 interface is simpler and much cleaner than last year's. For example, instead of having different desktop windows open for the Norton Protection Center and Norton Internet Security, these are now combined into one window with tabs. Unlike last year's version, the Norton Protection Center is more of an information gateway, linking to helpful how-to articles first before mentioning additional products or services available from Symantec. We approve of this change.

When you first launch Norton Internet Security 2007, a new sidebar window displays your system's current security status using the now-common green-yellow-red security rainbow. Norton provides a Fix Now button, but unlike McAfee's own Fix button, Symantec takes you to another screen where you must then choose what to fix and so on. For people who want to tweak, that's fine; but most home users will simply want whatever's wrong fixed and may find the extra step annoying.

Should you decide to uninstall Norton Internet Security 2007, you'll note that there is no uninstall icon listed in All Programs; instead, you'll have to use Microsoft's "Add and remove programs" from the Windows control panel. After we rebooted, we found a handful of registry entries remaining but no files or folders. While this wasn't nearly the mess left behind by Trend Micro, it was not as clean a removal process as ZoneAlarm's.

Features
Norton Internet Security 2007 adds some new protection, but the bulk of the changes provide deeper protection with its existing technology and most of those enhancements come from just one product: Norton AntiVirus 2007. A quick check of the UI reveals that several features--Norton AntiSpam, Norton Parental Control, Confidential Information Blocking, and Ad Blocking--are missing from the installed product. Following a growing trend by security vendors who realize the "one size fits all" model no longer works for Internet security, these are now offered a la carte, available for download from Symantec as needed.

New in the Norton Internet Security suite is Symantec's own antiphishing protection tool. Using an add-on toolbar to Internet Explorer, Norton Internet Security alerted us to suspected phishing sites, or those known to Symantec to be otherwise suspicious or fraudulent. You may continue on to the suspected site if you wish, and you can also report additional sites. Support for Firefox was promised but was still missing in the final release product we saw. Unlike McAfee, which makes its SiteAdvisor antiphishing tool available as a stand-alone toolbar for both Firefox and IE, Symantec's antiphishing tool is available only within the suite.

In testing, Symantec's antiphishing tool detected four out of five active fraudulent sites, results on a par with those of the free toolbar download from Netcraft and significantly better than those of the built-in detection within Microsoft's new Internet Explorer 7 for XP SP2 and Firefox 2.

Also new is a behavior-monitoring and blocking feature acquired from a company called Whole Security. Called SONAR (formerly Behavioral Malware Detection (BMD)), the Symantec version of this feature will become active in mid-January on thousands of Norton Internet Security-and Norton AntiVirus-protected systems worldwide. The company claims that through monitoring alone it has detected thousands of new malicious code scripts and incurred very few false positives.

In terms of enhanced features, Norton Internet Security 2006 already offered some rootkit protection, but Norton Internet Security 2007 takes detection to a new level. Symantec has extended its Veritas VxMS enterprise technology to the consumer level, allowing Norton Internet Security 2007 to compare files within the directory to files on the volume level. This quickly ferrets out suspicious or known malware and rootkits operating on your system. Norton Internet Security 2007 can also throttle its antivirus scanning engines so that either the full system scan or a quick scan runs in the background, giving priority to applications such as Microsoft Word. Other antivirus engines already have this technology.

One enhancement we do not agree with is Symantec's decision to disable firewall alerts by default. Symantec already does this with its antivirus alerts and insists that most people do not want to be bothered with granting or denying programs' access to the Internet. We disagree. Years ago, firewall alert messages were a problem, but today, a properly configured "smart" firewall should have access to a vast database of allowed applications, thereby minimizing the need to alert users except when a new or rogue application is detected. We found the silence frustrating. Advanced users, who sometimes need to monitor their Internet access, must now drill down within the configuration settings to enable the alert messages.

The Norton Internet Security 2007 suite does not include wireless router protection. In fact, none of the Internet security suites we've seen includes the ability to configure WEP or WPA protection on common household wireless routers--vital for any secure Wi-Fi connection, and it's a mystery to us why more vendors aren't including it within their security suites. Norton Internet Security 2007 changes your firewall protections based on whether you are connected to your home network, an office network, or a public wireless network, such as that of an Internet cafe or a commercial airport, but Windows Vista has that capability built in.

Missing from Norton Internet Security 2007 is thorough protection from identity theft. An ID vault for storing passwords and credit card information is de rigor in Internet security suites from McAfee, Trend Micro, and ZoneAlarm, yet it is missing from Symantec's suite. For that feature, the company directs you to buy its new Norton Confidential application.

Also missing are system diagnostics and backup features (available in McAfee Internet Security Suite 2007) and enhanced Internet transaction security (available in ZoneAlarm Internet Security 6.5). For built-in backup, Norton users will need to purchase Norton Save & Restore or Norton SystemWorks 2007.

Performance
Norton AntiVirus 2007 improves on last year's CNET Labs' performance test scores, although Norton turns in a mixed bag of results overall. On our iTunes test, Norton AntiVirus 2007 lost ground compared with last year, taking 208 seconds as opposed to 184 seconds last year. On our Sorensen Squeeze test, Norton AntiVirus 2007 improved, taking 317 seconds compared to 326 seconds last year. Overall, Norton showed the most improvement with individual file scans: it took only 117 seconds and 320 seconds last year. But in terms of boot speed, Norton lost ground, taking 4 seconds longer--66 seconds as opposed to last year's 62 seconds. To find out how we test, see CNET Labs' How we test: Software: antivirus page.

To determine how well a product will protect your PC we refer to test results from two leading independent antivirus testing organizations. In the latest test results from AV-Comparatives.org, Norton AntiVirus 2006 earned an Advanced + (highest) rating, catching 98 percent of all malware tested, and from Checkvir.com, Norton AntiVirus 2006 was one of eight products to earn its Standard (highest) rating.

For firewall tests, we used NMAP on a closed system with a router connection, however, we were unable to scan the Norton Internet Security 2007 PC; all other vendors tested produced at least some results in the various tests performed. Norton hides or "stealths" a PC from criminal hackers, which is good, though we're suspicious of what we can't see.

Support
The Norton Internet Security 2007 download site has a 32-page PDF manual, which is surprisingly light and almost useless when it comes to critical information; the index, for example, is only 2 pages, and it doesn't list information on configuring the firewall settings. The updated, automated, online technical-support service works with only Internet Explorer 5.5 or higher, not Firefox. Fortunately, the redesigned FAQ knowledge base still works in both IE and Firefox. If you're still having trouble finding an answer, Symantec offers live technical-support options. In our tests, free online chat required a 15-minute wait, free e-mail averaged about 72 hours for a response, and a live conversation over the phone cost $9.95 and required a 30-minute wait. But to use any of these options, we first had to first fill in our name, address, e-mail, and telephone number--this despite already having set up a Norton Account.

By going deeper, and by breaking apart its Internet security protection into individual modules, such as Norton Save & Restore and Norton Confidential, Symantec risks weakening Norton Internet Security 2007 against its competition by making it only one part of a larger puzzle. Essentially, Norton Internet Security 2007 is a very thorough antivirus-and-firewall combo with a few other security features thrown in, but it lacks data theft prevention, which is what most people want in an Internet security suite. There's also a weird duality, with features for home users that'll annoy advanced users and advanced-user features that most home users will never need. We prefer ZoneAlarm Internet Security 7; it strikes the right balance and gives end users the most complete Internet security package on the market today.