Just what ingredients go into a security suite? It used to be a pretty clear recipe: antivirus, firewall, antispam, parental control, and various condiments. These days, though, some vendors reward their users by pushing suite-level features down into the antivirus. F-Secure, on the other hand, has taken the opposite approach, with common features like malicious URL blocking and phishing protection reserved for the suite. F-Secure Internet Security (2017) enhances its antivirus protection with those browser-safety features, and it includes an easy-to-use spam filter and simple parental control, too. But this collection of components doesn’t quite make a top-notch suite, as I’ll explain.
For $69.99 per year, you can install this suite on three PCs. Bitdefender Internet Security 2017 and Kaspersky cost $10 more for three licenses, but both are significantly richer in features than F-Secure. Norton costs the same, but gives you five licenses. You pay a little less for F-Secure, but you also get a little less.
This program’s main window features the same blue, green, and white color scheme as F-Secure Anti-Virus. As with the antivirus, one button launches a malware scan, the other opens the settings dialog. The only significant difference, other than the program name at top, is that the band along the window’s bottom includes a segment labeled Browsing Protection.
Shared Antivirus, Mostly
Antivirus protection in this software is precisely the same as in the standalone F-Secure antivirus, with a couple of specific enhancements. Please read my review of the antivirus, linked above, for full details. Here I’ll summarize what’s the same, and highlight what’s better.
Three of the five independent antivirus labs that I follow include F-Secure in their testing. In general, it earns ratings that are good, but not great. For example, out of five tests by AV-Comparatives it earned the top rating, Advanced+, in just one, but did manage the second-best score, Advanced, in the other four. Its aggregate score is 8.3 points out of a possible 10. For comparison, the aggregate scores for Norton and Kaspersky are 9.7 and 10, respectively.
F-Secure did very well in my hands-on malware-blocking test, in no small part due to the efforts of the behavior-based DeepGuard scanner. It detected 100 percent of the samples in my collection and earned a malware-blocking score of 9.8 points, which is excellent. With a perfect 10 points, Webroot SecureAnywhere Internet Security Plus owns this test.
For my malicious URL blocking test, I start with a feed of very new malware-hosting URLs supplied by MRG-Effitas, typically no more than a day old. Each one links directly to a malicious executable file. I attempt to launch each in Internet Explorer and note whether the antivirus diverts the browser from the dangerous site, eliminates the malicious download, or fails to even notice a problem.
With no browsing protection component, the standalone antivirus has to rely on analyzing the downloaded files. It eliminated 78 percent of them, a score that’s just slightly better than the current average. The full suite’s Browsing Protection system raised that score to an impressive 96 percent. Out of 100 malware-hosting URLs, F-Secure blocked 95 in the browser and wiped out one more during download. With 98 percent protection, Symantec Norton Security Premium did even better, but not by much.
Like the antivirus, the suite offers F-Secure Search, a search portal that starts with results from Google but marks them up to identify safe, risky, and dangerous sites. It also includes a link to install the free edition of the F-Secure Key password manager, something you could get without installing another F-Secure product.
Excellence at blocking malicious URLs doesn’t always translate into effective detection of phishing websites. These are fraudulent sites that pose as bank sites, email portals, even online gaming sites. If you enter your password on one of these fake sites, you’ve given fraudsters control of your account. It’s easy money for them, and when they’ve scammed a few victims, they take down the site and put up another.
Because phishing sites are so ephemeral, I try to get the freshest ones I can for testing, preferably ones that have been reported as possibly fraudulent, but not yet blacklisted. I launch each URL in a browser protected by the product under test, and in another browser protected by long-time phish destroyer Norton. I also launch the same URL in Chrome, Firefox, and Internet Explorer, relying on each browser’s built-in phishing protection.
Quite a few products I’ve tested can’t even beat the built-in browser protection, and just a handful do better than Norton. Of recent products, Bitdefender, Kaspersky, and Webroot eked out a protection score higher than Norton’s, and Check Point ZoneAlarm Extreme Security 2017 tied Norton. Another half-dozen come close, lagging no more than 6 percentage points behind Norton.
F-Secure’s antiphishing score, 22 percentage points below Norton, is the best of the remaining products, but from 6 percent down to 22 percent down is quite a leap. Internet Explorer and Chrome had an unusually good day; both did better than F-Secure. If you use one of those two browsers, just leave its antiphishing turned on, so it works in parallel with F-Secure.
Modern Windows versions include an effective firewall component that handles basic tasks like defending against outside attack and putting the system’s ports in stealth mode. Like Trend Micro Internet Security, F-Secure opts to just let Windows Firewall handle those tasks. If you choose to turn the firewall on or off, or to adjust its settings, F-Secure launches the configuration dialog for Windows firewall.
F-Secure does enhance firewall protection with two advanced network protection features, both enabled by default. It blocks exploit attacks by preventing the download of files that aim to exploit vulnerabilities. And it warns you if the network you’re using attempts DNS hijacking.
I don’t have a way to test the DNS hijacking protection, but I had no trouble hitting the test system with 30 exploits generated by the CORE Impact penetration tool. Tested the same way, the standalone antivirus eliminated the malware payload for 60 percent of the attacks, but it provided no information other than that it blocked a “harmful file.” With its advanced protection, the suite blocked the same attacks, but also identified them as exploits. It even reported the official name for half of those it blocked. Norton has scored best in this test, blocking two-thirds of the attacks at the network level, before they could affect the local system at all.
While F-Secure doesn’t include program control in its firewall settings, you can configure DeepGuard to warn you when an unknown program attempts Internet access. When enabled, this feature bombards you with popups. It’s reminiscent of the very earliest personal firewalls, meaning that you’ll be awash in popup queries for a while.
As part of my firewall testing, I try to disable protection using techniques that would be available to a malware coder. F-Secure doesn’t expose any significant settings in the Registry, so a hacker couldn’t just turn off protection that way.
I found eight F-Secure processes running in memory. I had no trouble terminating individual processes, but they just kept coming back. It was a bit like playing whack-a-mole. I’m more impressed with apps that protect their processes against external termination. Who knows what a malicious program could accomplish during that brief time between process termination and reanimation?
Looking at Windows services, I found four belonging to F-Secure, all completely undefended. I had no trouble stopping those that were running and disabling them all so they wouldn’t start again. Doing so killed off F-Secure completely. I’ve mentioned this problem year after year in my reviews, but it never gets fixed.
See How We Test Security Software
Minimalist Spam Filter
If you’re one of that rare group whose email doesn’t get spam filtered out by the provider, F-Secure can help. That is, if your email comes from a POP3 account. F-Secure doesn’t filter IMAP, Exchange, or webmail accounts.
There’s a huge variation in the complexity of spam-filtering suite components. At one end, you have ZoneAlarm, with its blacklist, whitelist, and sliders to adjust the filter’s sensitivity to different spam categories. There’s even an option to automatically send a challenge message to any sender not already approved.
At the other end, you have F-Secure. You couldn’t get simpler as far as settings go. The spam filter is either on or off. F-Secure marks spam messages in the subject line. If you want to divert those messages to a spam folder, you must configure your email client to do the job. The help system does explain how to do that in Windows Mail, Outlook, Thunderbird, Eudora, and Opera.
And that’s the entire extent of the spam filtering function. There’s no email client toolbar to let you mark spam that reached the inbox or valid mail that wound up in the spam filter, no whitelist, no blacklist, no sensitivity adjustment. If you love tweaking configuration settings, this filter will prove unsatisfying. But some users will appreciate its simplicity.
I’ve already discussed the protection against malicious and fraudulent websites that Browsing Protection provides, but those are just the beginning. Click the link at the bottom left of the main F-Secure window to open the Browsing Protection window.
You configure this feature separately for each Windows user account. By default, all users get protection against harmful websites and banking protection. The third main item is parental control. Sensibly, this feature is off unless you actively enable it. I’ll discuss banking protection and parental control below.
Like Norton, McAfee Internet Security, and others, F-Secure marks up search results with icons to flag safe, iffy, and dangerous websites. Unlike Norton and McAfee, F-Secure doesn’t let you click through to a page with details to explain the link’s rating.
Clicking Settings lets you fine-tune the app’s configuration. The settings are user-specific, including a page of statistics and an option to reinstall the browser extensions.
There’s no doubt that securing your Internet connection is more important when you’re making a bank transaction than when you’re binge-watching cat videos. Some vendors, among them Kaspersky and ESET, offer to launch sensitive websites in a secured browser. Others, like Bitdefender and Quick Heal Internet Security 17, launch an entirely separate desktop, isolated from the regular desktop.
F-Secure’s approach is simpler. It hinges on the fact that any man-in-the-middle or data-interception attack needs its own connection to the Internet. Banking protection in F-Secure simply cuts every Internet connection other than the one performing a sensitive transaction.
When you reach a financial site, F-Secure displays a top-edge banner on the desktop reporting that banking protection is active. After a moment, the banner slides offscreen, but leaves a thin green line at the top. This mode ends automatically when you close the browser. You can also pull down the banner and click End if you just want to move on to a nonsensitive site.
It’s easy enough to see that this feature works. When I launched a protected transaction, the Internet connection for other browser windows terminated. However, it’s not terribly selective at what it protects. During my antiphishing test, Banking Protection kicked in for several fraudulent bank sites.
Simple Parental Control
It’s easy enough to enable parental control for each Windows account that’s used by a child. F-Secure can block content matching 16 categories, 11 of which are blocked by default. There’s no age-based configuration like you get in ESET Internet Security 10, Norton, and others, but all the categories are visible at once, and it’s easy enough to tweak them. You can also set it to force Safe Search in Google, Yahoo, and Bing.
Choosing Time limits lets parents either limit online time or limit total computer time. In either case, a simple grid makes it easy to set the weekly schedule. Parents can set a daily time limit instead of or in addition to the weekly schedule.
I configured an imaginary child account to use all the parental control components and took the system for a spin. I set it to block all Internet use on the current day of the week and observed that it diverted the browser to a warning about time limits. I changed the system date to a different day and tried again. F-Secure still blocked access, which is as it should be. Parental control that’s fooled by tweaking the system date/time isn’t effective.
I lifted the time limitation and tried some naughty searches. F-Secure successfully imposed Safe Search in Google, Bing and Yahoo, even though all three portals used HTTPS. Trend Micro stopped trying to force Safe Search because of the difficulty with HTTPS. Bitdefender also can only force Safe Search for regular HTTP connections.
I tried to reach a secure anonymizing proxy website, to no avail. F-Secure filtered it out, but just left the browser displaying an error message. ESET and Quick Heal do the same, but they at least put the warning in a popup. A simple three-word network command that disabled parental control in Total Defense Unlimited Internet Security and MicroWorld eScan Internet Security Suite had no effect on F-Secure.
Finally, I tried my best to find a naughty site that F-Secure failed to block. I couldn’t. That’s as it should be! However, there’s one big hole in the system. Parents often give older children Administrator access, rather than come enter a password every time the child wants to install a new game. A child with Administrator access can simply turn off parental control. Also, there’s no list of blocked websites, just a number on the statistics page.
F-Secure handles the basics of parental control, letting parents block access to inappropriate sites and control how much time the kids spend online. However, it doesn’t come close to the full-featured parental control system you get with Norton, Bitdefender, or Kaspersky Internet Security.
Tiny Performance Hit
Based on my hands-on testing, I must conclude that the performance impact of modern security suites ranges from nothing measurable to not very much. That’s important, because a user who finds that security software puts a drag on performance will simply turn security off. Even so, there’s some variation within that range.
My hands-on testing of this utility didn’t show any measurable impact on boot time, or on the time required to zip and unzip a huge collection of files. In both cases, the average time for multiple runs before and after installing the suite came out the same.
To test each product’s impact on typical file operations, I time a script that moves and copies a large collection of various-sized files between drives. This test script took 30 percent longer with F-Secure keeping an eye on things. Even so, I didn’t notice a slowdown while testing.
F-Secure’s average for the three tests is 10 percent, which is not bad. However, Norton’s average of just five percent is better, and Webroot had no measurable effect on any of the three tests.
You Can Do Better
Antivirus is the best part of F-Secure Internet Security. With the addition of Browsing Protection, it scored even better than the standalone antivirus in my hands-on tests. It didn’t score quite as well with the independent labs, though. And some of its other components don’t do all they could. F-Secure leaves firewall protection to Windows, and its POP3-only spam filter doesn’t include many common features. Simple parental control fails if the child has an Administrator account. And a malicious program that managed to slip past the antivirus could completely disable F-Secure by shutting down its essential Windows services.
To its credit, F-Secure Internet Security is inexpensive, but for just $10 more than F-Secure’s three-license price, you could install Bitdefender Internet Security or Kaspersky Internet Security. These two are our Editors’ Choice products for entry-level security suites. Throw in another $10 and you can install Symantec Norton Security Premium on ten devices, or put McAfee LiveSafe on every device in your household. Norton and McAfee are both Editors’ Choice for cross-platform multi-device security suites. F-Secure is a decent product, but you can do better.
Note: These sub-ratings contribute to a product’s overall star rating, as do other factors, including ease of use in real-world testing, bonus features, and overall integration of features.