Re: [Full-disclosure] looking for enterprise AV solution

[bk <chort0@xxxxxxxxx>]

(resending from correct account)
On Oct 26, 2010, at 6:55 AM, Mikhail A. Utin wrote:

> Folks,
> We are looking an enterprise level AV-software <snip>. Any advising?

Signature-based AV is a dead technology.  Updates don't get released until 
hours after you're already infected, so all it really ends up doing is being a 
resource-suck on your CPUs and hard-disk access.

My recommendation:  Buy whatever has the highest composite score for ease of 
management, limited resource consumption, and affordability.

Anyone who says "get Vendor X" or "get Brand Y" without telling you what 
selection criteria they used is a tool.  How do you know if what is important 
to you was also important to them in making the selection?

Run zero-hour threat detection on your e-mail gateway, and force your users 
through a proxy that does content scanning for web threats.  Make sure you 
don't get duped by vendors who sell "network virus detection" in their products 
that is actually just a tiny sub-set of some vendor's signatures that are 
rarely updated (a lot of firewalls do this).  You want something that is based 
on anomaly detection and has the ability to detect emerging threats.

Getting an update 9 hours after the virus is released isn't any better than not 
having AV at all, and I'd argue that due to license costs and performance 
impact, it's actually worse.  You're better off just setting aside budget for 
virus clean-up and employee education... Too bad auditors don't see it that way.

--
bk


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/