Norton Internet Security 2012

  • Category: Software
  • Review Date: 09.07.11
  • Bottom line:

    Some suites are good at just one thing, but Norton is a jack of all trades. Powerful antivirus protection, smart firewall, accurate antispam… it all works well.

  • Pros:

    Powerful antivirus protection and malware cleanup. Smart firewall protects without hassle. Blocks phishing sites and exploits. Very accurate antispam. New startup manager. Identity Safe now syncs form-filling and password management with the cloud. Integrates with other Norton products.

  • Cons:

    SONAR detection may erroneously block very obscure and little-used utilities.

Editor Rating:


By Neil J. Rubenking

The main window of Symantec's Norton security suite was getting pretty darn crowded as of last year. Symantec designers observed that users mostly ignored the dozens of links and controls, beelining for the ones that launch a scan and check for updates. The interface for Norton Internet Security 2012 ($69.99 direct for three licenses) emphasizes those two favorite activities on its main screen and pushes almost all the rest onto a slide-up panel of advanced settings. It's not just a pretty face— Norton Internet Security 2012 did well in all of my tests, without dragging down test-system performance.

Symantec also added more power to the product's antivirus engine. In particular, the SONAR behavior-based detection component now tracks more behaviors and correlates them to identify malicious or risky processes.

The Norton Insight database now offers information about each program's reliability. Based on observing how often a program crashes on the millions of computers tracked by Norton Community, it assigns one of four reliability ratings. And the suite can now refrain from online activity when the computer is using a bandwidth-limited connection.

Powerful Antivirus
At the core of Norton Internet Security 2012 is the same powerful antivirus engine found in the standalone antivirus. For full details, please read my review of Norton AntiVirus 2012 ($39.99 direct, 4.5 stars). I'll summarize here.

All of the independent testing labs that I follow include Norton in their tests, and they give it good ratings overall in both static and dynamic tests. The chart below summarizes recent results. For an explanation of the chart's contents, see How We Interpret Antivirus Lab Tests.

When I challenged Norton to clean up twelve infested test systems, it called on a variety of tools. On one system it automatically ran a preinstall scan to neutralize interfering malware. The scan results on several systems included a link that recommended using Norton Power Eraser (Free, 4 stars) to finish the cleanup. One required use of the Norton Bootable Recovery Tool.

Cleanup took a while, especially on systems that needed multiple scans, but the results were impressive. While Norton didn't have the highest detection rate, it scored higher for malware removal than any other product tested with the current set of samples. It also took the top scores for rootkit and scareware removal. For an explanation of how I calculate these scores, see How We Test Malware Removal.

Norton also did a very good job blocking malware from infesting a clean system. Its SONAR behavior-monitoring module tracks all activity by each process, so when it detected a threat partway through installation it was able to roll back all changes. Among products tested using my current set of samples, Norton's 8.9 points for malware blocking is beaten only by G Data InternetSecurity 2012 ($44.95 direct for three licenses, 3 stars) with 9.0 points. Norton scored a perfect 10 for rootkit and scareware removal. To understand my scoring system, please see How We Test Malware Blocking.

The Norton Insight database records data about all programs found on the millions of computers connected to the Norton Community. A program that's not found in the database is very likely to be a zero-day virus or a polymorphic threat, so the SONAR system takes a hard look at such programs. This also means that SONAR may block very old or obscure utilities, especially those that perform system-level actions and aren't digitally signed. Most users won't encounter this problem, and whitelisting guarantees that SONAR won't mistakenly block a significant program.

Exploit Prevention
Protecting the system against Web-based exploits is typically seen as a firewall task, but Symantec builds this feature into both the standalone antivirus and the full suite. When I attacked a test system with exploits generated by the Core Impact penetration tool, Norton blocked every single one. It didn't make a big fuss; it just slid a small notification window onto the desktop. Clicking a link in the notification brings up an extremely detailed report on the blocked attack.

It's true that few of these exploits could have harmed the test system. Each is tailored to a specific version of Windows, Internet Explorer, Firefox, Word, or some other application and can't do any harm to other versions. Even so, if a Web site is trying to attack my system I want to know about it.

Trend Micro Titanium Maximum Security 2012 ($79.95 direct for three licenses, 3.5 stars) identified a bit over half of the exploits by name, and Kaspersky Internet Security 2012 ($79.95 direct for three licenses, 3.5 stars) nailed two thirds of them. But Norton is the only one that consistently nabs all or nearly all of the exploits.

Smart Firewall
As expected, Norton Internet Security 2012’s smart firewall stealthed all of the test system's ports, making them invisible to outside attack. By default the suite assigns Internet and network permissions automatically. Unless you dig deep enough to turn off this feature you'll never get a popup firewall query from Norton.

This approach does mean that Norton won't block leak test utilities from demonstrating techniques that malware uses to evade old-school program control. It doesn't need to block them; its internal analysis can tell that they're just demos with no malicious payload.

Kaspersky also assigns permissions automatically, but it takes a different approach. Kaspersky assigns each program a trust level and adds restrictions as the trust level goes down. These restrictions affect network access but also access to sensitive file and Registry areas.

Naturally my attempts to kill off Norton's protection using techniques that a malware coder could employ flopped miserably. I got "access denied" when I tried to kill its processes with Task Manager, and the same result when I tried to stop or disable its services. And I couldn't make any changes to its Registry entries.

In my view this is exactly what a suite firewall should be. It takes care of all essential firewall tasks without pestering the user. Those with firewall expertise can dig deep and view or change its settings, but the average user doesn't need to do a thing. And it consistently offers the best protection against Web-based exploits.

Startup Manager and Performance
As in previous editions, you can "flip" the main window over to view a performance graph. Even if you're not interested in the pretty moving graph lines, the performance monitoring feature can help when your system bogs down. It will pop up a warning to let you know just what program is hogging system resources.

New in the 2012 edition is the Startup Manager, a feature previously found only in Norton 360 Version 5.0 ($79.99 direct for three licenses, 4.5 stars). Startup Manager lists all programs that launch at startup and identifies their level of resource usage. You can reversibly disable any one of them from launching, or set it to launch after a delay.

Accurate Antispam
The suite's antispam component doesn't require any configuration. It integrates with Microsoft Outlook or Outlook Express/Windows Mail, and it automatically whitelists contacts from Outlook and from the Windows Address book. Those using another email client can define a message rule to divert spam into its own folder.

In testing, downloading a thousand messages with Norton checking for spam averaged about 50 percent longer than downloading a thousand messages with no spam filter. That's not a slowdown you'd notice, especially given that downloading email typically happens in the background.

I manually sorted the Inbox and the spam folder into valid personal mail, valid bulk mail (newsletters and such), and undeniable spam, discarding any that didn't clearly fit one of these. Norton's accuracy was very impressive. It didn't put a single valid personal message or valid bulk message in the spam folder, which is very important. And it only let 6.1 percent of undeniable spam into the Inbox.

No other recent suite has approached this level of accuracy. The only products that do better are community-based spam filters, most notably Cloudmark DesktopOne Basic 1.2 (Free, 5 stars). Cloudmark didn't block any valid mail and let just 2.6 percent of spam into the Inbox. For information on how I analyze antispam accuracy, read How We Test Antispam.

Phishing Protection
The Norton toolbar installed along with this suite offers serious protection against phishing sites, quite a bit more than you'd get by installing Norton Safe Web Lite with the standalone antivirus. If you try to visit a site that's been identified as fraudulent it will divert the browser to a big page warning of the fraud.

That's good, but phishing sites come and go so quickly that the newest ones are guaranteed not to be in the database. Norton uses real-time analysis to identify fraudulent sites based on their characteristics. It blocks these as well, but identifies them as "suspicious." In testing, I've never seen it mark a valid site suspicious.

Norton is consistently a very accurate detector of even the newest phishing sites, with a detection rate averaging over 90 percent. It's the standard I use to measure the antiphishing prowess of other security products. Bitdefender Total Security 2012 ($79.95 direct for three licenses, 4 stars) actually scored 9 percentage points above Norton, but it's the only recent product to beat Norton.

I also compare each product's accuracy against Internet Explorer's Smart Screen Filter. Two thirds of current products aren't even as effective as IE alone. Norton averages 33 percentage points better than IE's detection. For an explanation of how I calculate these values, see the article How We Test Antiphishing.

Identity Safe
Antiphishing protects your privacy by steering you away from fraudulent websites that try to steal your passwords. Norton's Identity Safe feature stores all of your passwords and recalls them automatically as needed. You memorize one very strong password and use it as a master password for Identity Safe. Having done that you can change all your other passwords to unguessable rubbish like ZBG8ffeDtrCd.

In the 2012 edition Identity Safe comes closer to the power and flexibility of LastPass 1.72 (Free, 5 stars) and RoboForm Everywhere 7 ($19.95 direct, 4.5 stars). By connecting your Identity Safe login with your online Norton Account you can sync your passwords between all of your computers.

Identity Safe can also automate the process of filling Web forms. You create one or more Identity Cards containing personal information, email and snail mail addresses, phone numbers, and one credit card. LastPass can separately store a list of additional credit cards. RoboForm allows one identity to store multiple instances of credit card data or any other data element.

Identity Safe is significantly less obtrusive in the 2012 edition. Instead of a popup notification offering to save a Web site's credentials, it slides an info bar in at the top of the browser window. When you revisit a site, it simply fills in the stored credentials. If you've stored multiple credentials for the site, once again it uses the info bar to ask which you want to use.

LastPass and RoboForm definitely have a wider feature set than Identity Safe, but Identity Safe will do everything many users need. The new ability sync between computers is a big plus.

Parental Control
Parental control isn't built in to this suite. Rather, a button at the bottom of the window can be configured to log in to your existing installation of Symantec's Norton Online Family. If you don't already have an account you can quickly sign up for the free service. For full details read the separate review of Norton Online Family Premier ($49.99 direct, 4 stars). I'll summarize here.

Norton Online Family is a fully Web-based parental control system that relies on a tiny local client to enforce the "house rules" you define. It emphasizes communicating with the kids, not just control. In fact, you can have it print a copy of the house rules in simple language, so everyone understands what's expected.

The parental control system can block access to sites matching specific inappropriate categories, or just warn rather than blocking. It can set limits on each child's computer use, across multiple PCs. If desired it can put controls on which buddies the child can chat with, and can capture social networking logins.

Parents manage configuration through an online control panel, and also view usage reports online. It doesn't have all the high end features of Bsecure Online v6.16 ($49.95 direct for three licenses, 4.5 stars), but it's better than the parental control in most suites.

Norton Integration
I've mentioned that an icon at the bottom of the main window connects with Norton Online Family. Other buttons link to your existing installation of Norton Online Backup 2.0 ($49.99/year direct, 3.5 stars) and Norton Mobile Security 2.0.

Where the standalone antivirus has a button that connects with Norton Safe Web Lite, the Norton toolbar installed with the suite offers full Norton Safe Web protection. In the suite, that button brings up a form that lets you check a Web site's report or perform a safe search.

Finally, the Manage button brings up Norton Management, a new feature introduced with the 2012 products. Norton Management lets you view the status of all your Norton installations, manage subscriptions and licenses, and even install or uninstall protection. This feature will be enabled the day the product is released. As I'm evaluating the product ahead of that release date I wasn't able to experiment with Norton Management.

Low Performance Impact
Some people still remember ages ago when Norton's suite's resource usage put the brakes on other processes. That hasn't been the case for years, fortunately, and the 2012 edition is no exception.

Despite all the protection of Norton Safe Web and the Norton toolbar, my browsing speed test didn't show any measurable slowdown. The boot time test took 6 percent longer with Norton installed than with no suite. The average boot time slowdown among current suites is 12 percent.

A lengthy script that zips and unzips many large files also took 6 percent longer with Norton's real-time protection watching those files. That's quite a bit less than the average of 22 percent. Another script that measures the time needed to move and copy those same file took 14 percent longer, this time slightly above the average of 12 percent.

It seems very unlikely that you'd even notice these minor performance impacts. Of course, the only way to have no impact at all is to run all security processes on a completely separate computer, as Astaro Security Gateway Version 8 Home Edition (Free, 4 stars) does. For an explanation of how I measure security suite performance see How We Test Security Suites for Performance.

Consistently Powerful Protection
Some suites are strong in one area but weak in another. Norton's components all are impressive. Its antivirus protection is the best I've tested recently; the labs seem to agree. Its smart firewall offers silent protection against a host of threats. Even its antispam outshines the other suites. Norton Internet Security 2012 remains our Editors' Choice for security suite.

Virus removal:
Virus blocking:
Parental Control:

More Security suite reviews:

AVG Internet Security 2012
Kaspersky Internet Security 2012
Bitdefender Total Security 2012
TrustPort Total Protection 2012
Outpost Security Suite Pro 7.5

This review is in partnership with Ziff Davis Media.