Enterprise Anti Virus

[sparkeh]

Firstly I'd cast an eye over the Microsoft Security Essentials EULA:

From MICROSOFT SOFTWARE LICENSE TERMS - MICROSOFT SECURITY ESSENTIALS

Restrictions. The software may not be used on devices owned by government or academic institutions.

Secondly I would remove it. Schools have, and do, get into trouble for this.

 

I use Sophos, apart from the, admittedly stupid, occurrence of it quarantining its own files, I think it does a very good job.

Edited January 3, 2014 by sparkeh

[Davit2005]

Along with backups I personally consider Anti-Virus most important.

 

I sure don't want to end up in another workplace that has had neglected/no-existent Anti-Virus and have to sort out the mess

[matt40k]

@bencole your a special school, I assume you have to apply for funding from the LA for pretty much everything. I doubt it would take more then 2 mins to get the funding for AV, still surprised it was included with the internet connection as it a critical part of the duty of care.

[beancole]

@bencole your a special school, I assume you have to apply for funding from the LA for pretty much everything. I doubt it would take more then 2 mins to get the funding for AV, still surprised it was included with the internet connection as it a critical part of the duty of care.

 

We have antivirus. And will be keeping antivirus. Its not a question of funding. Its a hypothetical question is it possible to create a system witbout. For example you can build a machine with software to wipe the hdd everytime it is rebooted. This would wipe any changes or viruses installed. But this would not protect against everything.

 

The second thing ive been thinking about is nowadays there are many free products for everything apart from, it appears, enterprise anti virus.

[matt40k]

Reason free doesn't work for antivirus is it's mission critical, you can't wait for a developer to return home from his day job to investigate some new virus. You have to make it the developers day job.

 

You MIGHT get away with it it everything was cloud based, the issue would be if someone installed a keylogger for example on a device, ok you've wiped it, but you wouldn't know that someone has previously installed it so you wouldn't know the damage has been done. So you wouldn't lock up that security hole. Antivirus is really the last line of defence, normally when that pops up, you know you've basically failed.

[Chris_Cook]

Its probably also because of the various business models of free software. There are some free antivirus products out there - clamav as already mentioned, and avg etc. Broadly speaking you have three types of free software:

 

Open Source - developed when someone is interested in a project, or has a new way of doing something. This relies on someone skilled who thinks its worth giving their time for free.

Ad supported - This probably isn't great for antivirus, and many people probably wouldn't trust it. Spiceworks seems to be doing well out of this model, so its not impossible.

Limited feature set - Businesses can normally afford a small amount for more advanced features. Most of the enterprise features for AV are reporting etc for large networks. Home users don't need it, and even if you can get only 50p a device you can probably make money.

 

So the enterprise features are an advanced option, so would be paid for in the last option. You probably don't want your antivirus popping up with adverts while you're working. That leaves open source, and most developers seem to prefer working on higher profile projects like kernels and web browsers and GUIs. Reporting engines probably arn't the most exciting projects to work on. Its not impossible that this will change, its just no one has done it yet.

 

Wiping the device each boot is great except that: 1. It takes time, and 2. Now OSs are becoming more stable, reboots are less frequent. So you are pretty much unprotected until the next reboot.

[ConradJones]

wiping the OS on reboot would protect against the OS and installed programs being damaged.

 

but you must store your data somewhere, this location is vulnerable to both infection if.e. storing an infected file containing the virus and also to data loss.

 

yes it is possible, I personally don't run anti-virus on all of my home machines, mainly because the majority run linux. but i would not dream of even suggesting a commercial environment is run without antivirus especially if windows is involved, the risk far outweighs the benefit.

[beancole]

wiping the OS on reboot would protect against the OS and installed programs being damaged.

 

but you must store your data somewhere, this location is vulnerable to both infection if.e. storing an infected file containing the virus and also to data loss.

 

yes it is possible, I personally don't run anti-virus on all of my home machines, mainly because the majority run linux. but i would not dream of even suggesting a commercial environment is run without antivirus especially if windows is involved, the risk far outweighs the benefit.

 

The only way I can see to run without is to completely lock everything down(via GPO, no USBs etc). Only allow a certain list of sites, have antivirus on the server where docs etc are stored. And have all emails, MIS etc hosted on a 3rd party. And to have all machines wipe any changes when rebooted.

 

The problem with this is its unmanageable and would take away the experience of actually using a computer. I know it has been done with certain systems like low level military networks. but this means you can only access content that is set by admins.

[synaesthesia]

Still entirely moot. Those sites can still do nasty things. Look at Yahoo last week. Blocking yahoo? Half the teachers that picked up any resources from our County Council a few years ago also brought in Conficker with them. There's only so much you can do. There is no feasible way of running without AV without seriously compromising your data security.