McAfee brings antivirus support to VMware’s vShield

McAfee yesterday announced a version of its antivirus software for VMware’s vShield security technology.

The McAfee Management for Optimized Virtual Environments (MOVE) AV already had supported the Microsoft HyperV, Xen and general VMware virtual-machine platforms. MOVE AV 2.5, available now, marks the first time that the product supports VMware’s vShield API, which relies on an agentless software approach to scan and eradicate malware.

The agentless approach helps eliminate the problem of so-called “A/V storms” that can occur when running antivirus software in virtual-machine environments which can slow everything down, said Rishi Bhargava, senior director of product management at McAfee. But he added that McAfee still has concern about the effectiveness of the agentless technical approach embodied in VMware’s vSphere APIs.

“Malware is best detected when you have a lot of context for it,” said Bhargava. In that respect, a software agent helps, he pointed out.

“Agentless is not the whole context. In the future, VMware needs to evolve the vShield API to help provide that context,” he added.

Bhargava’s remarks echo many industry concerns that have been raised in the past regarding the vShield APIs which depend on an agentless approach that makes use of a small software hook provided by VMware in vSphere to perform security tasks.

But so far, VMware has held fast to this agentless design as the only approved way to make use of the vShield security technology it has architected for vSphere, which runs the security capability in a separate virtual appliance.

According to McAfee, the integration with VMware vShield Endpoint is going to let users optimise performance in Virtual Desktop Infrastructure and virtual servers based on VMware. It’s also possible to license MOVE AV for use in a mixed hypervisor environment supporting the older agent-based VMware approach, the agentless VMware approach for vShield, Xen and Hyper-V.

Kaspersky Lab and Trend Micro are also supporting the VMware vShield APIs, and Symantec is also expected to have a vShield-designed anti-malware product out later this year.