Full Disclosure: Re: looking for enterprise AV solution

[Brian Keefer <chort () smtps net>]

On Oct 26, 2010, at 6:55 AM, Mikhail A. Utin wrote:

> Folks,
> We are looking an enterprise level AV-software <snip>. Any advising?
Signature-based AV is a dead technology.  Updates don't get released until hours after you're already infected, so all 
it really ends up doing is being a resource-suck on your CPUs and hard-disk access.

My recommendation:  Buy whatever has the highest composite score for ease of management, limited resource consumption, 
and affordability.

Anyone who says "get Vendor X" or "get Brand Y" without telling you what selection criteria they used is a tool.  How 
do you know if what is important to you was also important to them in making the selection?

Run zero-hour threat detection on your e-mail gateway, and force your users through a proxy that does content scanning 
for web threats.  Make sure you don't get duped by vendors who sell "network virus detection" in their products that is 
actually just a tiny sub-set of some vendor's signatures that are rarely updated (a lot of firewalls do this).  You 
want something that is based on anomaly detection and has the ability to detect emerging threats.

Getting an update 9 hours after the virus is released isn't any better than not having AV at all, and I'd argue that 
due to license costs and performance impact, it's actually worse.  You're better off just setting aside budget for 
virus clean-up and employee education... Too bad auditors don't see it that way.

--
bk

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/