Bitdefender GravityZone Security for Virtualized Environments
Security service for virtual machines, virtualized datacenters and cloud instances delivered by the GravityZone on premise console

Benefits:

Best performance In virtual environments

Based on competitive performance testing run with Login Virtual Session Indexer, (Login VSI), GravityZone – SVE has the least impact on applications running in virtualized environments among virtualization security solutions

Simple and easy to deploy, lowers implementation duration and cost

Delivered as a Linux Ubuntu self-configuring hardened virtual appliance, integrates with VMware vCenter, Citrix XenServer, and Active Directory

Cost Reductions Through Higher Server Consolidation

GravityZone Security for Virtualized Environments server consolidation by up to 20% when compared to traditional antimalware, reducing hardware needs and energy consumption

Scalable and resilient security

Eliminates single point of failure and AV storms, grows organically by cloning virtual appliances and automating deployment with golden images

Minimized Administrative Overhead

Combines simplified deployment and administration with powerful antimalware engines and security policies to help streamline IT operations while improving compliance

Multi-Platform Coverage

Optimized protection on all known hypervisors - VMware vShield VMware ESXi, Citrix Xen, Microsoft Hyper-V, Red Hat KVM, Oracle VM and more

Features:

One solution

• One console offering easy centralized management, deployment and enforcement of security policies to any number of endpoints, on any hypervisor, in any cloud;
• One architecture enabling full visibility and control in datacenter and cloud through integration with Active Directory, VMware and Citrix hypervisors;
• One agent covering any combination of virtualization platforms, private and public cloud providers;

Multiple security layers

• Antimalware
  Antimalware and antivirus, including real-time protection for file systems, memory, processes and registry database;
  Targeted attack defense and zero-Day Threat Protection through advanced threat control and advanced exploit detection;
• Multi-layered anti-ransomware defense
  including similarity-based detection, advanced threat control against unknown ransomware, and anti-ransomware vaccine to halt the encryption process
• Firewall
  Fully featured two-way personal firewall and host-based intrusion detection and prevention HIDS / HIPS;
• Content Control
  Multiple thread filtering of web content to identify potential online threats;
• Device Control
  Port and device control to enforce data protection policies;
• Application Control Whitelisting
  Creates inventory of authorized applications and prevents the execution of malware or unauthorized software. Application Control Whitelisting is available for Windows platform only (starting with Windows 7 for desktop and Windows Server 2008 R2). Application Control Whitelisting should not be activated on File Servers.

Performance boosters

• Centralized scanning offloads antimalware processes from each protected virtual machine to virtual security appliances;
• Multi-level caching - de-duplicating scanning processes with two-layered caching mechanism;
• Optimized Scanning – focused on the 10% capable of execution that may harbor malicious code;

Universal coverage

• Any combination of virtualization platforms: VMware, Citrix, Microsoft Hyper-V, KVM, Oracle;
• Any environment: datacenters, private cloud, public cloud and hybrid cloud;
• Tightly integrates with VMware NSX;

Scalable and resilient

• Application delivered as a self-configuring hardened virtual appliance based on Linux Ubuntu;
• Employs fast and secure open source database MongoDB;
• Load balancing on multiple security virtual appliances eliminates single point of failure;
• Scales just by cloning virtual appliances;

Technology Overview:

GravityZone SVE provides the option of delivering antimalware protection using security virtual appliances (Security Servers) functioning as centralized points of antimalware intelligence, without a traditional security agent installed in each VM. A traditional agent would require constant updates and monitoring and consume significant local resources to operate. Each VM connects to a Security Server to offload most antimalware functionality, covering file system, memory, process and registry scanning on both Windows and Linux.

GravityZone SVE uses a multi-layered caching mechanism that contributes to leading performance. First, a local cache is maintained within each VM so objects are scanned only once. Second, a shared cache is maintained at each security server so that objects scanned on one VM are not scanned on another. Finally, a series of file block-level caches bring deduplication of scanning down to the level of file chunks, meaning that files with few differing blocks of interest to the antimalware engines on Security Server are not completely rescanned. The net result of these Bitdefender-exclusive technologies is the secret behind the performance achievements of GravityZone SVE.

The entire arsenal of award-winning Bitdefender threat protection technologies is built into the security engines and embedded into the virtual appliance architecture. With SVE, antimalware protection is more robust than ever, providing leading protection and highly available, instant-on protection for every VM in the datacenter.

Bitdefender GravityZone comes with a powerful mix of security technologies equipped to handle everything from your everyday malware to the most advanced targeted attacks. Thanks to technologies such as Advanced Threat Control, powerful anti-exploit, awardwinning antispam or bleeding-edge content filtering, as well as its multi-layered anti-ransomware defense, Bitdefender ranks highest in independent test results, with an over 99% detection rate of new or unknown threat.*

The entire arsenal of award-winning Bitdefender threat protection technologies is built into the security engines and embedded into the virtual appliance architecture. With SVE, antimalware protection is more robust than ever, providing leading protection and highly available, instant-on protection for every VM in the datacenter.

BitDefender Endpoint Security Tools - Central Scan at a Glance

For Security Server to access the file system of each VM, along with memory, registry and running processes and other required features, a supporting set of services delivered as Central Scan must be deployed to each VM. The characteristics of Central Scan are:

Low system impact:

• Less than 110 MB storage during runtime (including runtime cache)
• 10-20 MB local memory during runtime (on-access scanning)
• Peak CPU load of 1-2%, on a single virtual CPU for on-access scanning

Primary functions:

• Establishes connection to an available authorized Security Server (virtual appliance), allowing local access to file system, registry, memory and processes.
• Switches connection to alternate Security Servers in case of slow response time or sudden unavailability.
• Manages local disinfection, quarantine and process blocking.
• Maintains local cache of scanned items for performance gains.
• Runs as a local service with all administrative privileges removed, guarding against attacks that attempt to shut-down protection locally.
• Optionally provides a User Interface inside the VM with desktop pop-up notifications.
• Deployment of Central Scan (available in both a Windows and Linux version) is simple and requires no reboot of the virtual machines, while deployment of Security Server likewise does not require a reboot of machines hosting VMs.
• Central Scan can also be baked into templates and VDI images to minimize management overhead.

GravityZone unique architectural design creates several advantages:

• Virtual Machines have no local antimalware scanning engines and definitions, and will always be protected by an available Security Server.
• Eliminates the possibility of AV Storms.
• Multi-level caching across individual VM and Security Server ensures unique files are scanned only once.
• Eliminates boot time performance and security gaps encountered as VMs start.
• No single point of failure in the protection, as Central Scan automatically connects or reconnects to an available Security Server, as defined by policy.
• Centralized protection without bottlenecks, since Central Scan can automatically switch to another Security Server with a faster response time.
• Non-persistent virtual machines are automatically protected and governed by the correct security policy (when Central Scan is installed on the image and the security policy is applied to a resource pool or folder, the VM instance will inherit the policy accordingly).
• Increases VM density, as a consequence of reduced memory, disk space, CPU and I/O activity.
• VMs are invariably protected by the latest, up-to-date, technologies, even if restored to an older snapshot/backup or if booted after an extended period offline.
• No need to monitor AV installations on individual virtual machines after Central Scan has been installed.

Generates custom and powerful queries on the GravityZone database to obtain advanced analytics and insights into your network’s security, via an easy to use graphical interface, that doesn’t require advanced SQL knowledge to configure your queries (available for Enterprise Security on-premise products only)

Unsurpassed Performance

SVE was designed to solve the issues related to running AV in a virtualized environment and has been continuously improved, with a focus on protection, simplicity, performance and compatibility.

Our extensive performance testing proves that SVE has the lowest performance impact of all major AV solutions on the market, while also providing Bitdefender award-winning protection. As such, you should be able to reclaim up to 17% of your host’s computing power and reduce latency compared to your current AV solution, while cutting operational cost due to a radical reduction in maintenance and monitoring.

Optional NSX Integration

When VMware NSX platform is leveraged, Bitdefender delivers leading guest introspection that is specifically built for the SoftwareDefined data center, by providing agentless protection, automated deployment and orchestration of security services in the virtualized environment.

Flexible Licensing for Datacenters and Individual VMS

GravityZone SVE introduces a simple licensing model as either per CPU socket in datacenter or VM-based purchasing options. VM licensing is split between virtual servers and VDI to comply with dynamic and highly virtualized infrastructures.

Unified Management

GravityZone SVE is one of the security services delivered by GravityZone Enterprise Security unified platform and is managed through the Control Center web interface. In addition to VM security, GravityZone Enterprise Security covers physical workstations and servers (Windows, Linux, Mac), mobile devices (Android, iOS), and Exchange mail servers.

GravityZone consists of a unique architecture based on a turnkey virtual appliance that can be cloned as load requires, with each instance playing one or more roles. This simple yet powerful model give GravityZone the edge to horizontally scale to meet the demands of the largest environments as a single deployment.

For example, three appliances running the open-source, cloud-centric database included in GravityZone may run in San Francisco, with two in New York, while a similar number of communication servers are geographically dispersed where needed. GravityZone virtual appliances can also be configured as load balancers. As one geographic point grows, it’s as simple as spinning-up more GravityZone virtual appliances, selecting the appropriate roles, and allowing the load of the existing deployment to flow onto the new appliances. This ground-breaking, cloud-based architecture provides customers fast and easy access to scale, maintenance, monitoring and reporting.

In a geographically dispersed environment, GravityZone brings datacenters together, delivering control of virtualized environments across heterogeneous hypervisors, physical endpoints (laptops, desktops, servers) and mobile device, simultaneously.

* AV-Comparatives Heuristic / Behaviour Tests, March 2015

System Requirements:

OS Coverage - Widest Virtualization and Operation Systems Coverage Through Technology Partnerships

VMware:

• VMware vSphere 4.1, 5.0, 5.1, 5.5, 6.0 with with VMware vCenter Server 4.1, 5.0, 5.1, 5.5, 6.0
• VMware View 5.0, 5.1, 5.2, 5.3
• VMware Workstation 8.0.6, 9.x, 10.x, 11.x
• VMware Player 5.x, 6.x, 7.x
• ESXi 4.1 (build 433742 or higher), 5.0 (build 474610 or higher), 5.1, 5.5, 6.0
• vCenter Server 4.1, 5.0, 5.1, 5.5, 6.0
• vCloud Networking and Security 5.5.1, 5.5.2, 5.5.3, 5.5.4
• vShield Manager 5.0, 5.1, 5.5
• vShield Endpoint
• VMware Tools 8.6.0 build 446312 or higher

Integration with VMware NSX Requirements:

• ESXi 6.0 or later for each server
• vCenter Server 6.0 or later
• NSX Manager 6.2.4 or later
• VMware Tools 10.0.9 or later

Integration with Citrix:

• Citrix XenServer 5.5, 5.6, 6.0, 6.2, 6.5, 7.0 (including Xen Hypervisor)
• Citrix XenDesktop 5.0, 5.5, 5.6, 7, 7.1, 7.5, 7.6, 7.7, 7.8, 7.9,
• Citrix XenApp 6.5, 7.5, 7.6, 7.8, 7.9,
• Citrix VDI-in-a-Box 5.x

Microsoft:

• Hyper-V Server 2008 R2, 2012, 2012 R2
• Windows Server 2008 R2, 2012, 2012 R2 (including Hyper-V Hypervisor)

Linux:

• Red Hat Enterprise Virtualization 3.0 (including KVM Hypervisor)

Oracle:

• VM 3.0

Operating Systems Coverage

Windows

• Workstation Operating Systems: Windows Vista (SP1, SP2), 7, 8, 8.1, 10, 10 TH2
• Server operating systems: Windows Home Server, Small Business Server (SBS) 2008, 2011, Windows Server 2008, 2008 R2, 2012, 2012 R2

Linux:

• Red Hat Enterprise Linux / CentOS 5.6 or higher
• Ubuntu 12.04 LTS or higher
• SUSE Linux Enterprise Server 11 or higher
• OpenSUSE 11 or higher
• Fedora 16 or higher
• Debian 7.0 or higher
• Oracle Solaris 11, 10 (only in VMware vShield environments)
• Oracle Linux 6.3 or higher

Oracle:

• Solaris 11, 10 (only in VMware vShield environments)

Compare Solutions:

Security Services delivered by GravityZone Enterprise Security On-premise installation

	Security for Virtualized Environments	Security for Endpoints	Security for Exchange	Security for Mobile
Overview	Protection for virtualized datacenters enabling real-time scanning for file systems, processes and memory on Windows and Linux virtual machines, on any virtualization platform, and in any public cloud.	Protection for any number of physical workstations (Windows, Linux and Mac), embedded devices and servers.	Protection for Microsoft Exchange Servers ensuring secure messaging and collaboration environment.	Unified security with management and compliance control of iPhone, iPad and Android devices to support bring-your-own-device (BYOD) initiatives.
Protected Systems and Platforms	Guest OS: Windows Oracle Solaris Linux Virtualization Platforms: VMware Citrix Hyper-V Linux Red Hat Oracle VM	Server OS: Windows Linux Workstation OS: Windows Mac Linux Tablet and embedded OS: Windows Embedded Windows XP Tablet PC	Mail Servers: Exchange 2007, 2010, 2013 Physical and virtual servers Roles: Edge, Hub and Mailbox Protocols: SMTP, MAPI, Exchange ActiveSync	Mobile platforms: Apple iPhones and iPad tablets Google Android smartphones and tablets
Features	Smart Scanning - centralized scanning offloads security tasks to Security Virtual Appliances Integration with VMware vCenter, Citrix XenServer and Microsoft Active Directory Agentless security with VMware vShield endpoint Two-layered caching Load Balancing on multiple Security Virtual Appliances Environment aware security agent Intelligent deployment Breakthrough resource optimization for virtual machines	Smart Scanning - centralized scanning offloads security tasks to Security Virtual Appliances Environment aware security agent Integration with Microsoft Active Directory Intelligent deployment Breakthrough resource optimization for physical machines Location-aware policies User-aware policies Policy Inheritance Endpoint staging	Email traffic filtering Malware scanning Exchange databases Support for Database Availability Groups DAG Remote deployment Reports and monitoring dashboard Real-Time Messaging Protection	Integration with Microsoft Active Directory Unified management Device inventory management Screen locking with password BYOD policies support Device compliance management VPN and Wi-Fi provisioning
Security Layers	Antimalware Firewall Content Control Device Control Behavior Monitoring Application Control	Antimalware Firewall Content Control Device Control Behavior Monitoring Application Control	Antimalware Antispam Antiphishing Attachment filtering Content filtering	Antimalware Antiphishing Anti-theft Web filtering Storage Encryption Rooted and jailbroken detection Security policies enforcement
Licensing	For consolidated datacenters Per # of physical CPUs; For individual virtual machines: Per # of Virtual Desktops (VDI); Per # of Virtual Servers (VS);	Per # of Physical Workstations (PW); Per # of Physical Servers (PS);	Per # of mailboxes	Per # of devices

Documentation:

Download the Bitdefender GravityZone Security for Virtualized Environments Datasheet (.PDF)