full-disclosure - Re: looking for enterprise AV solution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <D7C14EBF-4343-4081-B5C0-AB292EDCE4B2@gmail.com>
Date: Tue, 26 Oct 2010 11:26:11 -0700
From: bk <chort0@...il.com>
To: "Mikhail A. Utin" <mutin@...monwealthcare.org>,
	full-disclosure@...ts.grok.org.uk
Subject: Re: looking for enterprise AV solution

(resending from correct account)
On Oct 26, 2010, at 6:55 AM, Mikhail A. Utin wrote:

> Folks,
> We are looking an enterprise level AV-software <snip>. Any advising?

Signature-based AV is a dead technology.  Updates don't get released until hours after you're already infected, so all it really ends up doing is being a resource-suck on your CPUs and hard-disk access.

My recommendation:  Buy whatever has the highest composite score for ease of management, limited resource consumption, and affordability.

Anyone who says "get Vendor X" or "get Brand Y" without telling you what selection criteria they used is a tool.  How do you know if what is important to you was also important to them in making the selection?

Run zero-hour threat detection on your e-mail gateway, and force your users through a proxy that does content scanning for web threats.  Make sure you don't get duped by vendors who sell "network virus detection" in their products that is actually just a tiny sub-set of some vendor's signatures that are rarely updated (a lot of firewalls do this).  You want something that is based on anomaly detection and has the ability to detect emerging threats.

Getting an update 9 hours after the virus is released isn't any better than not having AV at all, and I'd argue that due to license costs and performance impact, it's actually worse.  You're better off just setting aside budget for virus clean-up and employee education... Too bad auditors don't see it that way.

--
bk

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/