mailing list archives
Re: looking for enterprise AV solution
From: Brian Keefer <chort () smtps net>
Date: Tue, 26 Oct 2010 10:39:43 -0700
On Oct 26, 2010, at 6:55 AM, Mikhail A. Utin wrote:
We are looking an enterprise level AV-software <snip>. Any advising?
Signature-based AV is a dead technology. Updates don't get released until hours after you're already infected, so all
it really ends up doing is being a resource-suck on your CPUs and hard-disk access.
My recommendation: Buy whatever has the highest composite score for ease of management, limited resource consumption,
Anyone who says "get Vendor X" or "get Brand Y" without telling you what selection criteria they used is a tool. How
do you know if what is important to you was also important to them in making the selection?
Run zero-hour threat detection on your e-mail gateway, and force your users through a proxy that does content scanning
for web threats. Make sure you don't get duped by vendors who sell "network virus detection" in their products that is
actually just a tiny sub-set of some vendor's signatures that are rarely updated (a lot of firewalls do this). You
want something that is based on anomaly detection and has the ability to detect emerging threats.
Getting an update 9 hours after the virus is released isn't any better than not having AV at all, and I'd argue that
due to license costs and performance impact, it's actually worse. You're better off just setting aside budget for
virus clean-up and employee education... Too bad auditors don't see it that way.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/