beancole Posted January 2, 2014 Posted January 2, 2014 General thoughts please people. Prelims - Small school 130 students, 120 staff, 130 Machines 3 servers (and a fog server that wipes computers every holiday period.) Anti Virus, Currently on sofos endpoint security all machines also have Microsoft security essentials on. Internet firewall is managed by SmoothWall. USBs and Disk media are allowed. Problem/Idea/Thoughts - I am kinda of the opinion that antivirus is an unnecessary expense. The system is locked down with group policy so only certain programs can run. I am fully aware that viruses could come through with Java, ActiveX etc and not require admin permissions to do what they do. I know there is a risk can the risk be mitigated without paying large fees? What does everyone else use, do. Anyone already do this? Anyone thought of this before. I need some advice for the risk assessment. Any help or advice would be greatly appreciated. Cheers, Ben
free780 Posted January 2, 2014 Posted January 2, 2014 Do you have sophos and security essential s running? 1
synaesthesia Posted January 2, 2014 Posted January 2, 2014 (edited) I am kinda of the opinion that antivirus is an unnecessary expense. Ben WHAT?? Sorry, you should perhaps revisit your priorities! Being naive or massively optimistic like that will only be a detriment to the security and safety of your school. There's no real need or point in running multiple solutions. Do you have a licensing agreement with Microsoft like EES? Could you therefore already be entitled to use System Center Endpoint Protection? Edited January 2, 2014 by synaesthesia
beancole Posted January 2, 2014 Author Posted January 2, 2014 WHAT?? Sorry, you should perhaps revisit your priorities! Being naive or massively optimistic like that will only be a detriment to the security and safety of your school. There's no real need or point in running multiple solutions. Do you have a licensing agreement with Microsoft like EES? Could you therefore already be entitled to use System Center Endpoint Protection? Currently we have nothing I am pushing for Microsoft OVS-ES, Secondly being a patronising helps no one. Please don't bother to post again. Most antivirus software will not protect from most attacks. If I were to create a virus I would make it to defeat sofos, mcafee etc.
dwhyte85 Posted January 2, 2014 Posted January 2, 2014 (edited) It's a bad idea - sorry in advance if you don't like that response. If these machines are on the same network as anything important, that could leave you with red faces and a lengthy explanation to give on why you have no protection when MIS/accounting data is nabbed. If it's one you have no choice but to follow through with, for reasons of financials - could consider a re-image the machines nightly and pay for licensing to scan your fileserver(s)/storage or anywhere people put data, of course this is assuming this network can't access the MIS/accountancy area... also considering disabling USB access, no admin rights, mandatory profiles, no access to e-mail, use of Java ... and any site where people can potentially download work e.g, dropbox, 4shared, skydrive... but then people may complain they're too restricted. . If you can get something on an existing agreement, cheaper through an LEA or thrown in with any other deals would definitely take that over a bare network. PS - you're right they MAY attempt to do the disabling of AV, but the point is the AV will find known patterns in the files downloaded... you are always at risk to 'FUD'/crypted binaries but AV does scanning and will pick it up when it's known to be bad or if it's something it's not encountered, often they sandbox before things run to see what it tries to do. Not sure what you mean not protect from most attacks... most good AV will catch a high percentage of the likely things that are downloaded... some employ network monitoring to see what files are doing to assess the current unknowns on-top of the initial sandboxing. Best of luck, I understand what you're getting at but it'd be a bad idea Edited January 2, 2014 by dwhyte85 1
synaesthesia Posted January 2, 2014 Posted January 2, 2014 (edited) That wasn't meant to be patronising, but over and above the feelings of schools technicians or NM's I like most here feel obliged to protect the school *and you*. Your argument would fall flat on your face when you're at an employment tribunal explaining to a jury why you felt it wasn't necessary when data was compromised. If you can get OVS pushed through you'll be laughing. The cost of Sophos etc on a per-seat basis, especially for primaries isn't too bad (£1.95 was it?). Are you part of an Academy chain at all? Plenty of discounts to be had when buying bulk for chains, they may even have a deal in place already. ** edit ** I should also point out you should probably be removing MSE from the machines as small businesses (with no educational exemption) are only able to run it on up to 10 machines to the licensing Edited January 2, 2014 by synaesthesia
Chris_Cook Posted January 2, 2014 Posted January 2, 2014 I think it would be a bad idea to run without AV. I don't let anything connect to my school network unless it has some form of AV on it. Is your objection financial or technical? There must be loads of low cost AV solutions out there that would be better than nothing. We get sophos included with our LEA services, I think this is fairly common in across the UK. How would you know if malware was getting through your other lines of defense? Tools like the sophos enterprise console can give a really helpful overview of what's going on on your network. Looking at what goes on on mine, I would never remove the antivirus from any of our computers.
dhicks Posted January 2, 2014 Posted January 2, 2014 I am kinda of the opinion that antivirus is an unnecessary expense. I would tend to agree, although in the end I figured something client-side was needed. We went for ESET NOD32 - £500 per year to cover the whole school (about the same size as yours) isn't bad. Client-side antivirus should hopefully stop infections via USB stick and so forth - most of the newer malware seems to distribute via email and web downloads these days. Your SmoothWall filter should hopefully be stopping malware before it gets to the client machines, and if you've not alrready got a spam-spotting email filter then ClamAV is free.
free780 Posted January 2, 2014 Posted January 2, 2014 You really need AV and applocker. Usb sticks locked down. No av is a bad idea.
witch Posted January 2, 2014 Posted January 2, 2014 Our eset costs us £1.50 per machine through the LA - maybe you could get this sort of deal as when we were told we would have to pay (previously it had been free) I spoke directly to eset and they seemed keen to offer a similar deal. As for whether you need it or not. I think so. My only experience to back this up is the viruses trojans etc which have appeared on machines that have disabled or corrupt AV.
elsiegee40 Posted January 2, 2014 Posted January 2, 2014 (edited) General thoughts please people. Prelims - Small school 130 students, 120 staff, 130 Machines 3 servers (and a fog server that wipes computers every holiday period.) Anti Virus, Currently on sofos endpoint security all machines also have Microsoft security essentials on. Internet firewall is managed by SmoothWall. USBs and Disk media are allowed. Problem/Idea/Thoughts - I am kinda of the opinion that antivirus is an unnecessary expense. The system is locked down with group policy so only certain programs can run. I am fully aware that viruses could come through with Java, ActiveX etc and not require admin permissions to do what they do. I know there is a risk can the risk be mitigated without paying large fees? What does everyone else use, do. Anyone already do this? Anyone thought of this before. I need some advice for the risk assessment. Any help or advice would be greatly appreciated. Cheers, Ben AV is far from being an uneccesary expense. There are many techs on here who have had sleepless nights wresting their networks back from the grips of a virus that has taken hold despite the AV. I had one 3 days before Ofsted visited in my last school. AV minimises that risk. Relying on your network being "locked down" is senseless and also very risky. Losing your network directly affects the running of the school and Teaching and Learning. It also puts your school at risk of breaches of the data protection act should passwords to sensitive systems be extracted for example. The fines are massive, both personally and to the school. Because your school is classed as a business, free AV options are unlikely to be available. MSE, for example, is for home use only...though even M$ is not recommending that it is used any more even at home. I am sorry, but at worst AV should be regarded as an essential evil and should not be removed. Edited January 2, 2014 by elsiegee40 1
burgemaster Posted January 2, 2014 Posted January 2, 2014 (edited) I would say that AV is becoming more of a necessity now than previously. With cyber crime on the up rise etc. The amount of quarantined threats we have even with a secured firewalled network I couldn't ever consider it. If anything was to happen you would be hung high and dry, I don't think you could create a risk assessment that would support it anyhow.? I would be constantly terrified of Cryptolocker or similar Trojans!!! Edited January 2, 2014 by burgemaster
elsiegee40 Posted January 2, 2014 Posted January 2, 2014 Also, do not underestimate the capacity of your colleagues to click on links in emails that should have been consigned to spam. Only today, I got asked about this one Dear Amazon Customer, We have recently determined that various computers connect to your Amazon account, password, and the present of chess more taient before the connection. Now we need to confirm the new information from your Amazon account. If not completed within 48 hours, we will be forced to suspend your account indefinitely, because it can be used in a fraudulent intent. Thank you for your comprehension in this way. To confirm your online account: >> Click here How anyone could think it might be genuine, I don't know... the email address used to send it wasn't even an amazon one.
Dos_Box Posted January 2, 2014 Posted January 2, 2014 NIMDA took down many schools in CLEO about 10 years back due to a poor AV config and from a small primary school it spread like wildfire. Just because your network may be locked down does not preclude the chance that you can get infected from another vector. Also think about the legal aspect of it. Imagine if you did get infected by a hypothetical virus that steals or opens doors in SQL databases and suddenly you find your MIS has been compromised. Firstly you would have to inform the Information Commissionaires Office, and then you would really have to explain why you had no protection in place to prevent this. When it comes to network security, never say never.
beancole Posted January 2, 2014 Author Posted January 2, 2014 Point to note. No mis or accounts hosted internally or any emails etc. However as an excerise i dont think it is possible unless anyone knows a decent reputable and free enterprise anti virus.
elsiegee40 Posted January 2, 2014 Posted January 2, 2014 Point to note. No mis or accounts hosted internally or any emails etc. However as an excerise i dont think it is possible unless anyone knows a decent reputable and free enterprise anti virus. These services don't have to be hosted internally for passwords to be obtained. Externally hosted email still has malware that doesn't get filtered automatically (my example was in Gmail for education - if the link had been clicked on, it could still have exposed our network) I cannot be sure from your above post whether you intend to keep an AV or not. I still recommend that you pay for AV and use it.
Arthur Posted January 2, 2014 Posted January 2, 2014 You could install Microsoft's EMET to protect against both known and unknown exploits, but this would be installed in addition to anti-virus. a decent reputable and free enterprise anti-virus. Anything that's decent, will not be free.
burgemaster Posted January 2, 2014 Posted January 2, 2014 (edited) Just to add.. I would make sure that you remove all references to your school in here/profile/online if you plan to run without protection.. Whether it be your schools students or potential hackers looking for an easy target to exploit etc Also just checked.. Since we cleared the logs (I believe beginning of school year) in our enterprise console we have had 32 infected website's blocked by Sophos. This is going through a county Smoothwall firewall and a 2nd local Smoothwall install. Edited January 2, 2014 by burgemaster 1
elsiegee40 Posted January 2, 2014 Posted January 2, 2014 Just to add.. I would make sure that you remove all references to your school in here/profile/online if you plan to run without protection.. Whether it be your schools students or potential hackers looking for an easy target to exploit etc Good advice
synaesthesia Posted January 2, 2014 Posted January 2, 2014 In his shoes I'd be more worried about people from here contacting the head/governors at his school voicing their concern, but let's not forget he just stated an opinion rather than "I intend to run a school network with no protection". I sincerely hope for his own sake as well as the school that won't be the case.
MordyT Posted January 3, 2014 Posted January 3, 2014 Anything that's decent, will not be free. Well, there is one, but you have to be in the us for it. Avast
Arthur Posted January 3, 2014 Posted January 3, 2014 Well, there is one, but you have to be in the us for it. I knew about AVAST, but didn't mention it since I reckon Ben's school is in Selby (North Yorkshire), rather than Selby (South Dakota). 1
speckytecky Posted January 3, 2014 Posted January 3, 2014 Another + for Sophos EM from me. I know it had a 'major' problem about a year ago now but the support team did a magnificent job recovering that plus I have never found Sophos support wanting. We have a lot of our lock downs working through a work group on the Enterprise Console and it's a great tool for monitoring in so many other ways as well. The price is pretty unbeatable and great value as well.
Oaktech Posted January 3, 2014 Posted January 3, 2014 I'm plenty happy with my Eset AV, we have a 1800 device license including servers and mobile security and it costs us £3500. For a really small network I would also +1 the sophos offering, You might be able to get an offering from MS included in you, or your LEA's licensing deal. Whatever you do, don't run with nothing.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now