3

How many of you run anti-virus on your sole-purpose Windows IIS Webserver (no Web surfing from the machine, does handle some file uploads)? Why or why not?

For purpose of discussion, let's say a small .NET forms/database application with a SQL Express backend running on the same box; moderate load, say a couple hundred concurrent users at any time. The Web application does process image uploads for user galleries.

Few things that come to mind... if you do run AV:

  • do you exclude all directories with the exception of the directory into which the uploads are placed?
  • Do you have real-time scanning enabled or just a scheduled scan?
  • How do you have the AV set to respond to threats, automatic or require user-input?
  • what about the performance penalty?

3 Answers 3

3

We run real-time AV on all Windows boxes, no matter their function. Just another layer of defense-in-depth, and I've always regarded it as part of the cost of running on Windows. I wouldn't only limit to the upload directory, either -- if something malicious did get through or your box was otherwise compromised, often the first thing that happens immediately is that more malware is downloaded, and probably to somewhere that isn't the upload directory. There's definitely a performance penalty, and while it's worth it to us, we don't have a huge number of users/visitors to scale for, so take that for what it's worth.

1

Answers

1. Do you exclude all directories with the exception of the directory into which the uploads are placed?

It is advantageous to do performance testing without exclusions before deciding that they are necessary. If performance is satisfactory without creating new security holes of our own design, why bother?

2. Do you have real-time scanning enabled or just a scheduled scan?

In nearly all enterprise environments, the answer is "both."

3. How do you have the AV set to respond to threats, automatic or require user-input?

Normally, you want it to respond automatically and immediately but to do something that's potentially reversible (i.e. quarantine, not delete).

4. What about the performance penalty?

It turns out that your choice of antivirus product can make a bigger difference in terms of performance than configuring exclusions.

Anecdotally: in my personal experience, in an enterprise environment, ESET with no exclusions has far less of a performance impact than Symantec with practically everything under the sun excluded -- even on servers with extraordinarily busy drives, e.g. SQL database & call center recording. Be sure to evaluate multiple anti-malware products in your own test environment before you make a decision.

Bottom Line

Unless rules like "no Web surfing from the machine" are enforced by actual firewall rules, you can assume that they will be broken. People make mistakes. Also, it is not wise to believe that you can predict all of the ways that malware is likely to spread.

As the others said, the conventional wisdom is that all Windows computers need anti-malware software, no matter what their role. As administrators, we get to decide which AV product to install and how we need to to configure it.

0

I agree with nedm.

We run McAffe VirusScan Enterprise on all of our clients and servers no matter what their purpose.

They have realtime scanning as well as a full scan every Sunday (maintainance window time)

Threats are dealt with automatically and an email is sent to the system admins informing them.

While it is less likely to get a virus on a machine that has no end-user interaction there is always the possiblity of a malicious user exploiting your webserver and trying to upload a virus to the machine.

Of course no virus software is 100% and if it is some custom code it might not be caught but if it is something off the shelf the virus protection will catch it and your server will be safe.

It is just another extra layer of protection.

Having AV software on there should be kept upto date but it isn't an excuse for not checking access logs and looking for other strange activity on web server periodically...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .