Tag Info

Hot answers tagged

36

I think you acknowledge an interesting sys-admin truth there, which is that unless you can reduce the probability of being hacked to zero then eventually, at some point, you are going to get hacked. This is just a basic truth of maths and probability, that for any non-zero probability of an event. The event eventually happens... So the 2 golden ...


33

You don't "clean malware". You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble. As far as dealing with the "threat", you don't allow users to run with Administrator-level accounts (on Windows), and you don't install untrusted software (inasmuch as is possible). It seems fairly simple to me. My ...


28

You NEED antivirus software It's been said a few times in these answers that developers should know better, or should only install software they need from known good sites, etc, so if you need antivirus you have a social issue, not a technical issues. A few points on that: Prevention is only one of the functions of antivirus. Even if your vendor is slow ...


28

Obviously some machines need AV but if you need help explaining why some machines might not, here's my favorite XKCD comic...


28

Yes, it's certainly a reasonable request. The day you deny that your infrastructure is vulnerable to virus threats is the day you've lost a great deal of credibility. You need to weigh the ramifications (annoyance factor, possible performance issues, maintenance overhead) of running AV with the value of this contract. If one company is listing AV as a ...


26

The likelihood of a Linux server being infected by a virus is very very low, not zero. If that is a concern for your auditor/client/whoever, then you should understand that and determine if their business is important to you. If their business is worth more than the CPU cycles and disk I/O that it will take to scan, then you should install the AV. If it is ...


21

Yes, although for the most part they are configured to scan for viruses overnight with real-time file protection disabled, the exceptions are: File servers - Set to scan on write only. Full nightly scan. Sharepoint - No current anti-virus, waiting on Sophos for SharePoint to come out of beta. Exchange - Exchange specific anti-virus soloution. Overnight ...


20

This sums up my opinion.


20

The main reason to have anti-virus running on linux servers is usually not to protect the server itself - but to protect the end users who use the services / files on the server. Think of the server as a potential virus carrier. In order to protect the server itself you should be looking at proper firewalling and server hardening procedures, and packages ...


15

Defender is just an anti-spyware kit. It's not going to stop all viruses so you'll still depend on a decent virusscanner. But it can replace some of the McAfee features.


15

We use NOD32. The main reason for choosing it was because it was less of a resource-hog than the others.


15

A well run webserver should IMHO not have a commercial anti-virus (AV) package installed. The kind of Office macro viruses and mass-market trojans that AV packages are optimized for are a poor match to the problems of a web server. What you should do is: Absolutely obsess over input validation. Examples: that users can't upload malicious content to your ...


15

I think we need to put the term "virus" in context. If you're talking about the self-replicating binaries that float around Windows networks then sure, the probability of Linux getting one of these is very very low. If we're talking about the broader subject of malicious software, then Linux is anything but immune. Unpatched and poorly configured Linux ...


15

Whitelist, don't blacklist You're describing a blacklist approach. A whitelist approach would be much safer. An exclusive club will never try to list everyone who can't come in; they will list everyone who can come in and exclude those not on the list. Similarly, trying to list everything that shouldn't access a machine is doomed. Restricting access to a ...


14

Please see Guidelines for choosing antivirus software to run on the computers that are running SQL Server for help.


14

Definitely yes on file servers; you can then scan the files people store on the server without having to rely on desktop AV (which can fail) Exchange, I'd advise installing a proper exchange product (Sybari AntiGen was the original; that's now MS ForeFront for Exchange but there's lots of competition now) that will scan the content of the emails; there's ...


13

My organization uses Symantec Endpoint Protection (version 11). As many of you know, Symantec products were not the best during the last few years. I am happy to report that the newest version performs much better. It has a small memory footprint and thanks to pull updates, it will not clog your network with useless traffic. It has powerful management ...


12

I would not install any antivirus software on those machines assuming the following points: The computer runs behind a router with built in firewall, MAC address filtering and NAT. Only needed ports are open Windows firewall is enabled Developers only install software that they need to get things done from trusted sites No pirated software is used ...


12

If it's Windows it should have antivirus protection, regardless of whether it's a VM or a physical machine. Your comments regarding performance tells me 2 things. You don't have enough resources to properly run all those VMs on the same host. You need to optimize your scanning settings and/or use something that isn't such a massive resource hog. I also ...


12

Get the EICAR test vector and use that.


11

No way a virus can get on a server (unless you do web surfing there or install strange software) Without addressing any other points of your argument, the one above is patently, provably, historically untrue.


11

Intrusion Detection Systems (IDS) and Intrusion Protection Systems (IPS) are a rather broad topic. As such, my answer here is far from comprehensive. The types of IDS include network and host based. Network based IDS, such as SNORT, analyze and log network traffic based on a set of rules. These rules would match potential vulnerabilities, thus ...


11

Detection is Easier (and More Reliable) Than Prevention By definition you cannot prevent a zero day attack. As others have pointed out, you can do a lot to reduce the impact of a zero day attack, and you should, but that is not the end of the story. Let me point out that in addition, you should devote resources to detecting when an attack has occurred, ...


10

Anti-virus software should definitely be running on all machines in a properly-managed network, even if other threat prevention measures are in place. It should run on servers too, for two reasons: 1) they're the most critical computers in your environment, much more than client systems, and 2) they're no less at risk only because nobody actively uses (or at ...


9

AFAIK, there isn't a package than answers to all your requirements. Best Open Source AV package i know is ClamAV, and it doesn't have much, if any reporting and remote control/installation, and no centralized management. You can circumvent these problems by developing a scripted management and RIS environment. Shouldn't be too hard assuming you already ...


9

For us it came down to Symantec Endpoint Protection and ESET Nod32/Smart Security. Both have excellent central management features, and both score well on detection rates and not sucking up system resources. We went with ESET based on a bad experience with the trialware of Symantec while evaluating both. ESET was cheaper, as a bonus. Goes to show you ...


9

You should be scanning incoming messages before they reach your end users, and you should be scanning outgoing messages before they pass from your control... but you don't necessarily need to do it at the e-mail server. A lot of companies have a gateway appliance, separate from the e-mail server, that sits at the edge of the network and supports scanning ...


8

You should certainly have anti-virus protection for your mail server. In fact, you should not be asking if you should get anti-virus software but asking what you need and how you need to configure it. I am assuming you are using exchange server, given this there are specific solutions out for exchange, which typically are not CPU intensive. It will give ...


8

File-level AV is needed on Servers, it's just the attack vector that's different. If that server allows users to upload any kind of data at all to it (such as all web servers doing anything except serving static pages) it needs AV software. That malware may not be infecting the server but it can infect other clients. An AV alarm on a server can be a very ...


8

Background There are obviously multiple variables involved here, so there is not a one-size fits-all response. These variables include: Existing company/corporate policies Any policies involving security mandates (such as the requirement to run the company configured AV) may make this decision a non-issue. Variability of the "production" environment. If ...



Only top voted, non community-wiki answers of a minimum length are eligible