Full Disclosure mailing list archives
Re: looking for enterprise AV solution
From: bk <chort0 () gmail com>
Date: Tue, 26 Oct 2010 11:26:11 -0700
(resending from correct account) On Oct 26, 2010, at 6:55 AM, Mikhail A. Utin wrote:
Folks, We are looking an enterprise level AV-software <snip>. Any advising?
Signature-based AV is a dead technology. Updates don't get released until hours after you're already infected, so all it really ends up doing is being a resource-suck on your CPUs and hard-disk access. My recommendation: Buy whatever has the highest composite score for ease of management, limited resource consumption, and affordability. Anyone who says "get Vendor X" or "get Brand Y" without telling you what selection criteria they used is a tool. How do you know if what is important to you was also important to them in making the selection? Run zero-hour threat detection on your e-mail gateway, and force your users through a proxy that does content scanning for web threats. Make sure you don't get duped by vendors who sell "network virus detection" in their products that is actually just a tiny sub-set of some vendor's signatures that are rarely updated (a lot of firewalls do this). You want something that is based on anomaly detection and has the ability to detect emerging threats. Getting an update 9 hours after the virus is released isn't any better than not having AV at all, and I'd argue that due to license costs and performance impact, it's actually worse. You're better off just setting aside budget for virus clean-up and employee education... Too bad auditors don't see it that way. -- bk _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- looking for enterprise AV solution Mikhail A. Utin (Oct 26)
- Re: looking for enterprise AV solution Jason Nada (Oct 26)
- Re: looking for enterprise AV solution opticfiber (Oct 26)
- Re: looking for enterprise AV solution R0me0 *** (Oct 26)
- Re: looking for enterprise AV solution opticfiber (Oct 26)
- Re: looking for enterprise AV solution Brian Keefer (Oct 27)
- Re: looking for enterprise AV solution Josh Browning (Oct 27)
- Re: looking for enterprise AV solution phillip () bailey st (Oct 27)
- Re: looking for enterprise AV solution Michal (Oct 27)
- <Possible follow-ups>
- Re: looking for enterprise AV solution bk (Oct 26)
- Re: looking for enterprise AV solution Jamie Riden (Oct 27)
- Re: looking for enterprise AV solution James Rankin (Oct 27)
- Re: looking for enterprise AV solution Jamie Riden (Oct 27)
- Re: looking for enterprise AV solution Elazar Broad (Oct 27)
- Re: looking for enterprise AV solution Jason Nada (Oct 26)