Do firewalls and anti-virus software affect a server's performance?

Question

Learning about a company I have ties to, I just found out that their server has no encryption or antivirus software installed on it. When they asked their IT company why (they deal with a lot of sensitive data), they were told that both of these would have affected performance, so they decided to forgo it. I'm concerned about this though because it sounds like a major security issue, but I was hoping someone here could clarify.

I'm not a System Administrator, but this doesn't sit well with me.

Answer 1

Forgoing software firewalls and anti virus tools on a server for reasons of performance is like choosing to forgo a harness while racing in the Le Mans because it's scratchy. Your parents need to find a new IT outsourcing company. Quickly.

Yes there are performance hits, but a properly sized server will be able to manage that performance degradation. The risks of not having proper security software are far, far worse than a sluggish server.

Answer 2

Both affect performance. How much they do, versus how much load the server is under, is a balancing act.

ENCRYPTION - Something has to do encryption/decryption on the fly as you access files, save files, etc. That's generally done in software, though there are hard drives that do encryption as well. Since it generally IS software, there is some load on the server as it encrypts/decrypts files. Is that load significant? It can be. As with all things, it depends on how beefy the server is, what it's doing, etc. Would you see a noticeable performance hit in, say, an office of 15 people accessing Word documents off a fileshare? Presuming the server is fairly new, probably not. If you had 1500 people accessing the same server, you would likely see slowdown. So it's a tradeoff.

ANTIVIRUS - Generally with antivirus you see on-demand scans. That is, when a file is accessed, the AV program scans it to make sure it isn't infected. It will also generally run periodic scans of the OS, and will look at tasks being performed to make sure they don't match virus definitions. This, too, is a software process that takes system resources. Generally if you're running a Windows server, you want AV on it, case closed. Linux you can probably get away without running one - the way Linux is architected gives it pretty good resistance to viruses.

Without knowing the exact environment your parents are running on their server, it's hard to say what they should/shouldn't be doing. In general, though, if they're running Windows, and it can see the internet (or other machines on the network can), it should at least be running AV. Encryption may well be overkill. Most of my clients don't encrypt data, sensitive or no, preferring to rely on NTFS access controls, good firewalls, and AV. Your mileage may vary, though.

Answer 3

Overhead of a firewall is generally pretty minimal, particularly on linux-based systems. If you start doing really funky things, it may start to grow a bit, but it shouldn't get out of hand under normal circumstances.

AV scanning can add significant overhead, depending on the amount of traffic you get and the scanner being used. However, this is generally a good tradeoff on, for example, a mail server. Ditching virus-laden attachments before they make it to your users is worth a bit of extra processor usage. Likewise for a web server that allows user uploads.

Answer 4

Running minimal security at the risk of affected performance, is not even a measurable cost vs benefit situation. You will pay much more for a lack of security than a slight stock performance decrease. If you really consider how much you'll be risking, especially for a large organization.It is even worth spending the money to purchase higher performance server hardware with RAID for better performance and to eliminate a single-point of failure, and a more powerful processor, to accommodate a powerful and reliable software's resource consumption.

Answer 5

The answer is that it depends on the situation and what kind of risk mitigation is involved.

Antivirus and encryption DO both impose some performance penalty. Any time you have another bit of software running it'll use some processor cycles.

Now, for the situation at hand, it depends on what they're dealing with as to whether it was a smart choice or not. You don't mention what kind of server they're using, or what you mean by sensitive data. Medical data? Monetary information? Personal records? Company information?

Antivirus is a touchy subject in sysadmin circles. You'll find some who advocate it on everything. Others only use it on Windows. Others say it's a waste. And all of these opinions can be found coming from people with years of experience under his or her belt. Probably because it does, in part, depend on the situation and server use.

Me, I use antivirus when necessary because every @#^$# AV I've run has had issues at some point. Some didn't catch something in time. Others screwed up software on the system they were installed on. Another just decides to stop updating itself, no matter what, unless you completely uninstall and reinstall the AV engine. In the end I think I've dealt with more anti-malware software issues than malware on servers.

As for encryption the overhead on a file server is really negligible in the majority of cases. The drawback is that it's possible if there's a problem, you won't be able to get the data back. Lose the encryption key or screw up an account and you no longer get access to the data.

Unless...of course...you have good backups. And those are encrypted too, yeah? Because if not, your disk encryption is pointless.

Or maybe you got a zero-day worm/infection on the server that your antivirus doesn't yet detect (and you can't layer antiviruses or you'll end up with other problems.) It starts uploading files to a remote network; encryption doesn't mitigate that. Or one of the client systems with legitimate access to the sensitive data starts uploading information in proxy.

The truth is that your provider, again depending on risk mitigation value, would need to evaluate the value of the data and the consequences of the data being misappropriated and use an appropriate security measures to mitigate the risks. Security is a process and it's done in layers. There's no single security measure that eliminates the attack vectors. You can have all the security measures taken and have one disgruntled employee with legitimate access walk out with the information you label as sensitive.

Depending on your data and the amount of risk you are willing to take, you might want to change providers. If you're just talking about a relatively simple file server, the information you relayed is a red herring.