Symantec First To Provide Anti-Virus And Enterprise Security Management Protection Against Recently Issued Fraudulent Verisign Digital Certificates - with Enterprise Security Manager and Norton AntiVirus - Product Information

EDP Weekly's IT Monitor, April 2, 2001

Symantec Corp. (Nasdaq:SYMC) recently announced that its award-winning vulnerability assessment and anti-virus solutions, Enterprise Security Manager and Norton AntiVirus respectively, detect and protect against two recently issued fraudulent VeriSign, Inc. digital certificates.

VeriSign discovered through its routine fraud screening procedures that it issued two digital certificates to an individual who fraudulently claimed to be a representative of Microsoft Corporation.

These certificates can be used to digitally sign a program containing malicious code of any type under the name of Microsoft Corporation.

Digital certificates are used to prove that the data originated from the authorized owner and that it has not been modified.

"This is a tremendous example of how two powerful Symantec products - Norton AntiVirus and Enterprise Security Manager - can work together to provide a comprehensive solution to a real-time threat," said Rob Clyde, vice president and chief technologist for Symantec's Enterprise Solutions Division. "Our customers can be assured that Symantec provides comprehensive Internet security solutions."

"We were pleased to see Symantec work quickly to assemble an antidote to avert this potential vulnerability," said Mahi de Silva, vice president and general manager of Applied Trust Services at VeriSign, Inc. "Working together we were able to diminish the opportunity for an attacker to distribute malicious code."

Symantec provides complete security solutions (reactive and real-time) to defend against this latest threat. Enterprise Security Manager provides vulnerability assessment capabilities on machines that have executed one or both of the fraudulent certificates.

The Symantec AntiVirus Research Center (SARC) has developed definitions for Symantec's anti-virus solutions to detect and prevent the download of these certificates as well as to scan the existing file system providing real-time protection. This prevents customers from executing code signed with the fraudulent certificates, even if the code is sent via e-mail.