Priveon Labs Security Blog

The much anticipated Cisco Security Agent 6.0.2 was released today with many new product features and fixes. Of the most notable enhancements includes added support for 64-bit Operating Systems as well as 32 and 64-bit support for Windows 7, 2008, and VMWare WS 6.x, specifically:

• Windows 7 (Professional and Enterprise) 32-bit platform
• Windows 7 (Professional and Enterprise) 64-bit platform
• Windows Server 2008 (Standard, Enterprise, and Web Edition) 32-bit
• Windows Server 2008 (Standard, Enterprise, and Web Edition) 64-bit
• VMware WS 6.x (workstation)

(All CSA 6.0.2 supported agent Operating Systems can be found here.)

Other notable improvements include:

• Improved SystemAPI rule integration with Microsoft Data Execution Prevention (DEP)
• Integration and reporting on rootkit kernel modification via Microsoft's Kernel Patch Protection (KPP). Note: KPP is only used in MS 64-bit OSes. 32-bit Operating Systems still rely on CSA's Rootkit Detection rules.
• Support for FQDN's in Network Address Sets and wildcard support in those FQDNs (resolvable to IP4 only). Ex: *.Priveon.com

For a full list of CSA 6.0.2 enhancements, please see the official CSA 6.0.2 release notes. Additionally, CSA 6.0.2 may be downloaded from Cisco's website (valid contract required).