0

I need your help with a question on Gateway Anti-Virus and Desktop/Server Anti-virus.

The example I have is the following:

You have a network of 50 machines (Desktops/Servers) which includes a router that is also a gateway anti-virus.

The servers are linux and the desktops are windows.

There is a policy in place where USB flash drives are not allowed to be inserted into any machine at any time so nothing malicious could be run from that drive.

The Gateway Anti-virus is suppose to protect anything viral or malicious that is requested to enter the network from the outside.

In this example, what are the benefits of having anti-virus software on both Servers or Desktop's Computers even if you have a gateway anti-virus in place?

Thanks, MJ

Improve this question
3
  • 1
    What happens when one of your users figures out how to VPN out or gain access to an external resource via an SSH tunnel or the like, and gets some sort of badware that way? Your AV gateway isn't going to help you in that circumstance.
    – EEAA
    Mar 23, 2016 at 22:23
  • Hi EEAA, are you saying if you get out somehow with some kind of encrypted connection, (like VPN or SSH) the gateway AV won't be able to protect you from malicious activity? Can you give me a example?
    – user345245
    Mar 23, 2016 at 22:31
  • 2
    That's right. HTTPS, ssh, IPSec, etc are all encrypted protocols that your gateway will not be able to inspect.
    – EEAA
    Mar 23, 2016 at 22:33

2 Answers 2

Reset to default
4

There are many more ways for virii to enter your workstations than ONLY from the network. There are also many protocols that can encrypt or obfuscate data in such a way to render gateway antivirus software useless. I personally would never rely solely on gateway antivirus for any reason. It is sad to say... that desktop/server antivirus software is still necessary.

Improve this answer
2
  • Thank you for your attempt, but I was looking for an answer, not an opinion.
    – user345447
    Mar 24, 2016 at 20:15
  • 1
    @B.Clarke It's not an opinion: it's a fact. Malware can enter a computer in many ways other than the network, and there are various types of traffic which a gateway antivirus can't inspect (basically, anything encrypted).
    – Massimo
    Mar 24, 2016 at 20:50
0

Desktop anti-virus can see the data prior to encryption and report it to a central location. Even if it's a laptop outside the network depending on the package you go with. In the end like others have said, you never want to rely solely on gateway based antivirus. My boss enacted a very neat rule to not allow any executable to run unless its in program files/program files x86.

That rule alone has saved us much headache.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .