Educause Security Discussion mailing list archives
Re: MS Exchange - Anti-virus
From: Charlie Prothero <Charlie.Prothero () KEYSTONE EDU>
Date: Tue, 11 Dec 2007 17:44:51 -0500
That's a good point, John, and one we didn't consider on our last AV renewal. We're running NOD (from ESET) on both clients and the servers. It seems much more efficient in terms of system resources than our previous, more popular, product. All of the AV products that we looked at before selecting NOD were offered as package deals, as was NOD. It is compelling to get everything you need in one transaction, from a single vendor. As I recently posted in another discussion, we also have our incoming mail scanned by Tangent (www.tcnoc.com) before it even gets to our system. So our server AV products have far less stuff to scan. Of course, Tangent would not stop anything that someone might bring into our network via their laptop or other malware transport device... Like Corbett said, defense in depth! - Charlie -----Original Message----- From: John Ladwig [mailto:John.Ladwig () CSU MNSCU EDU] Sent: Tuesday, December 11, 2007 5:33 PM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: Re: MS Exchange - Anti-virus Extra credit for *different* AV packages on clients and MTAs. We have that, and it's more or less an accidental side-effect, but it's interestng and may be useful in fast-break or low-volume cases, where AV vendors will roll signatures well out of sync with one another. -jml
"Consolvo, Corbett D" <corbett.consolvo () TXSTATE EDU> 2007-12-11
16:06 >>> I highly recommend both host and SMTP antivirus on Exchange servers for defense in depth, you never know how a piece of malware may spread :) We are using McAfee, I don't recommend McAfee for either host protection or SMTP protection on Exchange (we use it and have had performance problems...). I have used Symantec with somewhat better luck in both cases - we are testing Forefront for 2007 right now. I have been very interested in checking Sophos but have not had the time. Corbett Consolvo Information Security Analyst Texas State University Cc72 () txstate edu -----Original Message----- From: Cheek, Leigh [mailto:lcheek () UTK EDU] Sent: Tuesday, December 11, 2007 3:56 PM To: SECURITY () LISTSERV EDUCAUSE EDU Subject: [SECURITY] MS Exchange - Anti-virus I am auditing a cluster of MS Exchange 2003 servers. No anti-virus (AV) protection software is running on these servers and MS Office is not installed. Systems admins do not access e-mail or surf the Web from these servers. I know that there is a performance hit when you install AV software and that AV, especially McAfee, can be difficult to tune and testing is a must. From what I have read on blogs and at Microsoft's site, I believe that installing AV is best practice for protecting these servers. 1. I have heard of problems with McAfee. If you have installed AV on your MS Exchange servers, what are your using? 2. Do you believe AV should or should not on MS Exchange 2003 servers? Why? I appreciate your help. Thanks, Leigh Cheek, CIA, CISA Auditor Audit and Consulting Services University of Tennessee 149 Conference Center Building Knoxville, TN 37996-4114 (865) 974-4420 fax (865) 974-6171 lcheek () utk edu
Current thread:
- MS Exchange - Anti-virus Cheek, Leigh (Dec 11)
- <Possible follow-ups>
- Re: MS Exchange - Anti-virus Consolvo, Corbett D (Dec 11)
- Re: MS Exchange - Anti-virus Kieper, David (Dec 11)
- Re: MS Exchange - Anti-virus John Ladwig (Dec 11)
- Re: MS Exchange - Anti-virus Charlie Prothero (Dec 11)
- Re: MS Exchange - Anti-virus Gary Flynn (Dec 11)
- Re: MS Exchange - Anti-virus Chris Steele (Dec 12)