Re: Centralized Antivirus Recommendation

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Mon, 03 May 2010 16:00:35 EDT, "Sabourin, Justin" said:

> We're currently researching options to move away from our current
> antivirus solution in favor of something with better detection abilities
> and a solid management console/reporting server.

Out of curiosity, do you have a sane metric for measuring "better detection
abilities"? Do you have any guidelines for false positives/negatives (remember
that it's almost impossible to get both numbers to be low at the same time,
and as one vendor demonstrated recently, *both* types of errors have major
security implications...)  How about trade-offs between "detect every variant
known to man" against "finish the scan before the user gets annoyed"?

(No, I don't have answers - just trying to promote asking better questions :)

Attachment: _bin
Description: