3
votes

This question is a little opinion based, but I think it can be based in fact and I would prefer answers backed up with a link to a reputable company if possible.

The problem is at my job, we have "okay" hardware for the developers, laptops running Windows XP (I know) with dual core 2.3 Ghz processor, 2GB of memory and 60 GB hard disk @7200 rpm however, the amount of virus scan and security agents and big brother software on these make them unusable when scans are running. My company insists on running full disk virus scans every monday and "smart scans" every other day.

I appreciate the concern for viruses as much as the next guy, however it is hindering our work and we are looking for a new setup that allows the developers to work unimpeded by scans, yet provides virus protection et al that the company is looking for.

Keep in mind my company is not really willing to change antivirus vendors, so we're looking at a developer oriented solution because most of the business users do not experience these issues.

UPDATE:
Company policy requires that all laptops (which I have) are taken home each evening unless you have an office to lock it in. Because I am office-less, I have to take it home each evening.

I am willing to listen to any scenario, switch to a desktop, switch to a different OS, any of the above. Just looking for setups that people currently use, that seem to work for their developers, in particular java developers.

We also run a lot of software on our laptops, an applicatoin server, a database, email client, developer IDE, database IDE and other random things as required.

END UPDATE.

Any suggestions?

3
  • Is disconnecting the computers from the network or running Linux an option? Jul 15, 2009 at 17:29
  • The company is unwilling to switch antivirus vendors, but willing to buy new laptops? Is the antivirus that expensive?
    – Ernie
    Jul 15, 2009 at 17:35
  • @3dinfluence - We are willing to listen to any OS switch, I'm just looking for possible ideas to alleviate the problem. @Ernie We are currently on a 2 or 3 year lease cycle with hardware and the cycle end is fast approaching.
    – Nick
    Jul 15, 2009 at 17:51

10 Answers 10

0
votes

I don't think you're going to find any economical level of hardware platform that won't show some signs of stress during virus scanning, especially in the realm of laptop computers. Workstation-class machines with 10K or 15K-RPM SAS drives and multi-core processors (to give you faster IO, more IO parallelism, and processing parallelism) are your best bets, but that's going to be expensive.

This is one of those classic "tradeoff triangles". In this case, the points of the triangle are probably "Virus Scanning Frequently", "Users Not Impacted", and "Inexpensive Computers". You can optimize however you want in that triangle, but you're not going to get all 3 things.

You don't want to hear it, but I'd argue that a rethinking of your antivirus strategy is in order.

1
vote

Maybe a software solution would be better. Does the virus scanner have the option of shutting down the computer when it's done? Maybe at the end of the day the developer can run the virus scanner in lieu of shutting down. When the scanner is done, the user comes in the next day to a freshly scanned computer that's ready to boot up.

0
votes

Having an on-access should make it unnecessary to run a scan, though I realise many IT departments insist on using a scheduled scan, possibly because they might be fired if there was a virus outbreak!

All I can suggest is to try and convince your support guys that an on-access scanner alone is adequate. I strongly advise you have at least an on-access scanner. Any modern AV on-access scanner shouldn't cause a significant slowdown. i use AVG here and only notice it when doing big directory replications.

JR

3
  • Just a minor nit: "Having an on-access should make it unnecessary to run a scan [...]" -- That's true as long as the AV solution is always more current than the virus creators... Since that's rarely the case, it makes sense to "re-scan" files periodically to ensure a new virus wasn't missed on the first access scan.
    – Chris_K
    Jul 15, 2009 at 17:34
  • @Chris: I would (indeed I do) run a full scan occasionally e.g. over a lunch break. Whether you could trust developers (a race related to Orcs but less evolved :-) to do the same is debatable. Jul 15, 2009 at 17:38
  • @John Did I forget to mention that I'm a developer? Its funny, we have a similar opinion of our IT counterparts on the hardware side.
    – Nick
    Jul 15, 2009 at 17:55
0
votes

There is no good solution to this problem that I can see- if management insists on auditing that often, you're stuck with it. However, a possible fix could be making it so that developer stations that can't access the internet, only the company intranet, and exempting them from the daily scans, letting only the weeklies run. If there's an infection loose on the intranet, quarantine the developer subnet and lock it down, and thoroughly disinfect before reconnecting it.

0
votes

How about changing the scan time to 5:00 PM or whatever time the developers generally go home? Alternatively, how about 12:00 PM, and the Devs all take lunch exactly at noon every Monday? This assumes that the full scan is worse performance-wise than the Smart scan.

2
  • The are doing a lunch time scan, but they insist on doing a full scan on Mondays which take on the order of 4 hours, roughly. I'm a java developer, so we have lots of jar files, that it tries to scan each file inside of.
    – Nick
    Jul 15, 2009 at 17:52
  • @Nick I suggested the same in a comment below - but how about getting cable locks for the laptops, so they can be left in the building at night? That should make them no more or less enticing than the desktops that are already sitting there. Once you leave the laptops, the scans can be run overnight.
    – Carl C
    Jul 16, 2009 at 2:18
0
votes

I've gone with a sort of combination of what the others here have said.

Our weekly Full scans run weekly on Monday's at 3 AM. They should be long done before anyone shows up to start the week.

As for the on-access scan, configure the AV client to ignore the directory structure containing the source code. If the client is also scanning network shares -and- your file servers are also running AV, be sure to exclude share scanning from the clients as well.

2
  • 1
    Thanks for the suggestion, however, the company policy requires us to take the laptops with us at close of business, because we work in cubes. We've thrown around the idea of getting desktops, which I believe someone else mentioned.
    – Nick
    Jul 15, 2009 at 17:53
  • How about cable locks for the laptops?
    – Carl C
    Jul 16, 2009 at 2:15
0
votes

I'd suggest some really fast SSDs to alleviate some of the seek overhead from the scans. Obviously, this would help even more if you could exclude your dev folders from the scan (though I bet IT policy won't allow that).

0
votes

The last time a virus nuked my Windows system at work (completely in spite of our antivirus, I might add!), I switched to Ubuntu. It mostly works well and considering that I'm a Unix sysadmin it's well suited to me. Ubuntu comes with a free SSH client and a terminal program that uses tabs for the multiple remote logins I have going at any given moment in time. That, plus some standard internet apps, basic word processing, and Kdevelop for a nice multi-language (including Java) IDE gets me by 90% of the time.

The first big, fat caveat comes from our database client, which neither has a Unix version, nor does it run under the WINE "emulator". This may happen to you. Try dual-booting Ubuntu on your work computer, or using your own laptop to experiment with. This is the only way of knowing if such a solution is right for you or any of the other developers where you work.

The other big, fat caveat is that Linux is NOT immune to viruses. It's not likely that you'll get infected, but it's entirely possible that you can get one through the network, especially if you're running an application and database server locally that is accessible from the network (one of several included firewall solutions would prevent this however). But it is certainly less prone to viruses, and its small market share means that Linux isn't a high priority target for virus writers, and infections are pretty rare. But then, so is the H1N1 Flu. It doesn't mean you have no reason to worry at all.

0
votes

Why has nobody questioned the fact that the scans are running during developer work hours yet? Why can't they run overnight? Your problem is most certainly a people one, not a technology one.

0
votes

First suggestion would be to switch to a desktop so the scans can be run while the developers aren't trying to work on the machines.

If that doesn't work, next would be to see if it is possible for the developers to remotely connect, over a VPN, to the network late Sunday night from home for a scan to run from say 12:01am Monday morning that should finish by the time they would need to disconnect the laptop from the remote network to bring it in to the office. I'm not sure how well some of the corporate folks would like this idea but it would have the scans run on the schedule and the laptops are out of the office when the scan is done.

Not the answer you're looking for? Browse other questions tagged .