5

We have basic server-side virus scanning in our datacenter, but it's expensive, uses a considerable amount of CPU cycles, and is annoying to maintain. I'm not looking for a sales-pitch on "better" AV software, I'm more looking for a pulse on the community to see what other people are doing in their data centers.

Here's a quick overview of our datacenters - Primarily a Windows shop, with a small number of web servers, and a ton of SQL Servers. Of the web servers, only a few are public-facing, and port restrictions are very tight - Port 80 and 443. None of the SQL Servers are public facing.

In terms of "internal" threats (users doing stupid things), we are very restrictive with permissions, so only a very small portion of the company can install anything server side. Everyone else uses websites or client-side tools to access the servers.

So in this sort of "protected" private datacenter scenario where 95% of the users access the servers from client tools, and there is little to no public exposure, is there a strong case for running A/V clients on all of our back-end servers or not?

1 Answer 1

7

So in this sort of "protected" private datacenter scenario where 95% of the users access the servers from client tools, and there is little to no public exposure, is there a strong case for running A/V clients on all of our back-end servers?

Not really, no. Though, it usually boils down to an issue of "compliance" or because someone high enough up thinks running AV on all your private servers is how "security" is created.

Having said that, it's not a bad idea to have at least occasional anti-virus scans on all your machines, regardless of how well-protected or isolated you think they are, and there is a strong case to be made for this practice.

Coincidentally, the easiest way to achieve regular AV scans on all your machines is to have a lightweight AV client installed on all your machines. (Again, "all" means "all" and includes the "protected," "private" servers you mention.) Once you accept that all your machines should have an AV client, it's down to an issue of configuration to prevent the AV clients from interfering with your servers.

Personally, I prefer to handle this by having an AV client on all my servers, and disabling the realtime protection/on-access scanning portion on all the servers for which it is safe to do so, while leaving the scheduled virus scans intact (or adjusting the schedule as needed). This strikes a balance between server performance and virus protection. Servers that are heavily interacted with by the users or connected to the internet get the full AV policy, of course.

3
  • Yes, definitely an issue of compliance due to the type of data we work with. Even I can say that it "feels" strange not having AV on every machine, even though I know the risk of an infection is extremely low on our SQL Servers. Our current solution has some options that allow the real-time scanner to ignore certain directories. Since we're already invested in the AV software I think I'm going to start by having it focus on the key areas where users have access to write files. I have a hunch that will lower the CPU usage considerably.
    – user207411
    Jan 30, 2014 at 2:23
  • Exclude "safe paths" could be a strong vulnerability considering that it's quite easy exploit the Windows file system permissions.
    – Fez Vrasta
    Jan 30, 2014 at 7:56
  • @FezVrasta Perhaps, but there are also a reasonably large number of directories you need to exclude from real-time AV scanning if you want your Windows services to work. Jan 30, 2014 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .