full-disclosure - Re: looking for enterprise AV solution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTin_8oP=k70NZPnGBoKNdn4gR9SmcK+2dnc8OmMS@mail.gmail.com>
Date: Wed, 27 Oct 2010 11:32:31 +0100
From: Jamie Riden <jamie.riden@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: looking for enterprise AV solution

On 26 October 2010 19:26, bk <chort0@...il.com> wrote:
> (resending from correct account)
> On Oct 26, 2010, at 6:55 AM, Mikhail A. Utin wrote:
>
>> Folks,
>> We are looking an enterprise level AV-software <snip>. Any advising?
>
> Signature-based AV is a dead technology.  Updates don't get released until hours after you're already infected, so all it really ends up doing is being a resource-suck on your CPUs and hard-disk access.
>
> My recommendation:  Buy whatever has the highest composite score for ease of management, limited resource consumption, and affordability.
>
> Anyone who says "get Vendor X" or "get Brand Y" without telling you what selection criteria they used is a tool.  How do you know if what is important to you was also important to them in making the selection?

If you've got a decent perimeter, it should keep the threats out for
some time, but I tend to agree. AV these days is starting to be more
about detection than prevention - it will at least highlight that you
have a problem so you can deal with it. Think of it as part of your
intrusion detection if it helps.

Oh, and somewhere I used to work ran two separate AV products on the
mail gateway, and then a third on desktops on servers. I suspect this
was more about licensing models (couldn't do per-seat for email as we
had >100k email addresses) than paranoia, but it did help out
considerably to have independent engines.

cheers,
 Jamie
-- 
Jamie Riden / jamie@...eynet.org / jamie.riden@...il.com
http://uk.linkedin.com/in/jamieriden

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/