6 ms·

So, what do people run on their servers / macbooks for AV? Anything? I was in a meeting just last week with our new "head of Security" who exclaimed when i sta

• ams6110 10y ago
  On Windows PCs, I use Microsoft Security Essentials/Defender/Whatever-it's-called-this-release. It's already there, and basically can't be turned off, so why not? I do not use AV on any other platforms.
  • lqdc13 10y ago
    Windows MSE can be way more resource hungry than many AVs while providing a worse protection. Symantec might actually be worse than MSE depending on your data etc. Avira is the best free one right now IMO. No spam you can't opt out of and no pop ups.
    • magicalist 10y ago
      > No spam you can't opt out of nope
      • lqdc13 10y ago
        What specifically is the pop-up? I don't see any you can't disable.
    • th0br0 10y ago
      Any proof for this claim?
      • lqdc13 10y ago
        I work on a product that required testing of all these AVs in real life scenarios and also requires to improve upon them. Regarding scanning speed for MSE: On my current Windows installs (2 VMs - one Win7, one Win10) and one installed on bare metal, it takes up to 5 seconds to scan a 5MB file after it is downloading and before it is run. These systems have a lot of software installed on them so such results may not generalize to everyone. Also, "antimalware service" sometimes goes nuts and would take up 100% disk usage on non-SSD disks after an update for hours on end. I am not sure what the reason for this is. Regarding which AVs are faster at scanning: you can try them all here just for static analysis: https://github.com/joxeankoret/multiav https://github.com/joxeankoret/multiav However, the overhead in many cases doesn't have that much to do with scanning speed but deals with what the AVs choose to scan and what types of files are being scanned. For example, how do they handle changing files on a live system? Do they take shortcuts with files at a known location with known initial bytes/hash? Then there is the annoyance factor - Kaspeprsky for example keeps trying to get you to sign up/use their non-antivirus features within the software package. Finally - efficacy. The only reason we are using the AVs at all. In the efficacy dept, the best one by far out of traditional AVs is ESET-NOD32. It detects about 70-75% of new threats when they're in PE32 format. Symantec detects roughly 40% in my testing, which is on par with 42% that Microsoft MSE detects. The samples came from a number of sources, but perhaps the best one is virusshare - https://virusshare.com/ https://virusshare.com/ Anyone can do their own test if they're so inclined, but nobody should trust the tests where there are claims that the top AVs detect 99.5% of malware. I am not sure where they're getting such numbers but I've never seen more than high 70s on currently circulating recently (within last week) released malware. I might do a blog post about it later since this is a topic many people disagree on. Disclaimer: The views expressed here are my own and do not necessarily represent the views of my employer.
        • th0br0 10y ago
          Thanks for that lenghty reply! Interesting to hear that NOD32 is still the best.
• walrus01 10y ago
  ClamAV on public facing smtpd/MX that talk to the world: https://en.wikipedia.org/wiki/Clam_AntiVirus https://en.wikipedia.org/wiki/Clam_AntiVirus
• benjarrell 10y ago
  The thing that kills me is, AV software for Linux is just looking for Windiws viruses. Tripwire seems more appropriate for Linux. I've had that debate and it was decided that we had to have something. FWIW we use TrendMicro deep security.
  • wmt 10y ago
    Typical AV for Linux is for server products serving mainly Windows clients, and the Windows clients are more probable to run random binaries. Linux malware, outside of someone trying to crack the computer, largely doesn't exist because have you ever tried to ship binaries for all Linux distros?
• beedogs 10y ago
  I've never run AV software on any of my Mac computers or any of my Linux PCs. There's no need. I will never get a Mac or Linux virus. I'm vehemently against running AV software on Linux at the enterprise level, too. The best I've been able to do there, though, is to ensure that on-access scanning (aka "slow the system down to 10 percent of its usual speed for no reason at all") is completely disabled. Edit: any explanation for the downvotes?
  • tluyben2 10y ago
    >any explanation for the downvotes? I noticed that before on this subject: I agree with you and said that before on the subject of AV on Linux and got downvoted. Not claiming there are not viruses on Linux, just saying that, in roughly 20 years of using it, I have never seen one on my servers or workstations. So why would I sacrifice speed? For workstations I think Linux people are more careful than others (I have no citation just personal experience). I do not need warez and if I have to browse something fishy I do that from a VM or another account; not 100% safe but a lot safer than the entire mess people seem to have on Windows boxes (incidentally it has been around 20 years since I last worked with Windows seriously too).
    • benmcnelly 10y ago
      Just wanted to add on that the down-votes probably come from people that take your comment as perpetuation of the argument that macs don't need AV, vs taking it at face value that its been your experience (and mine) with the OS. On the flip side, I have 4 infected mac's being flagged by webroot right now because the users downloaded and ran things like fake flash installers. So "every day" users do dumb things on macs and windows. For those user, the AV performance hit is worth it (to me) :)
• zanny 10y ago
  On Ubuntu you have Apparmor, and mandatory access control (in practice, any sandboxing mechanism) is vastly superior to antivirus, at least in default-deny mode (which, sadly, Ubuntu does not use by default). If arbitrary software needs administrator level policy set to access the filesystem or devices, rogue software cannot harm your system. If trusted packages also need policy, then exploits in that software cannot do any more damage than the minimum amount of capabilities allocated to the application, which is quite frequently just the apps config file.
  • ryuuchin 10y ago
    I realize that it's better than nothing but be careful with the default AppArmor profiles, they're very coarse grained and allow a lot of stuff that they don't really have to for compatibility reasons (so they just work). I'm not saying they're useless but they could certainly be better and/or tweaked to your needs.
• thirdsun 10y ago
  To be honest, I wouldn't put AV on anything but Windows. There I'd opt for Microsft's Security Essentials since it's the least offensive/annoying solution. On mac and linux I just don't see the need unless you're doing questionable things or trust shady sources. Be aware that macOS also comes with a very basic and rudimentary protection built-in called XProtect.
• pfg 10y ago
  The first tool I run on new Macs is osxlockdown[1] (use [2] if you want a UI). It disables a bunch of features and enables things like the firewall. Make sure you don't disable things you're actually using, though. I don't run any AV, but I use OpenDNS Umbrella, a DNS-level malware blocking service with the capability to switch to "active" traffic filtering (basically a MitM proxy, though that part is completely optional). It's a neat tool with a nice dashboard, and the pricing is okay with $20/year. OSSEC is a great tool for servers, but not the kind of "Let's just throw some AV at it so we can tick that compliance box" tool many are looking for. [1]: https://github.com/SummitRoute/osxlockdown https://github.com/SummitRoute/osxlockdown [2]: https://objective-see.com/products/lockdown.html https://objective-see.com/products/lockdown.html
  • deleted 10y ago
    [deleted]
  • voltagex_ 10y ago
    >[PASSED] Disable IPv6 I'd like to see the rationale behind disabling IPv6 outright. Edit: https://github.com/SummitRoute/osxlockdown/issues/4 https://github.com/SummitRoute/osxlockdown/issues/4
• vinhboy 10y ago
  Little Snitch -- at minimum it makes you more aware of who's trying to phone home.
  • jedisct1 10y ago
    If you know what you are doing, and how the apps you are using work. It's very easy to shoot yourself in the foot, and prevent apps from working correctly. In addition to driving apps developers mad with bug reports, you can end up being less secure by breaking update mechanisms.
    • Tepix 10y ago
      Little Snitch is pretty good at visualizing the traffic, including the blocked traffic. It's not a tool for beginners, however.
• ryuuchin 10y ago
  grsecurity[1] for linux. You don't even have to use RBAC if you don't want to (you can still use AppArmor/SELinux/etc) but RBAC comes with a built-in learning mode which is good and will likely do a better job than you could and generating a profile. Sure you'll probably have to hand tune it a bit but for production servers I see no reason why RBAC couldn't be used with it's training/learning mode. [1] https://grsecurity.net/ https://grsecurity.net/
  • mixedCase 10y ago
    Plugging Alpine Linux, a distro that while known for its small size, which led to widespread adoption as a Docker base image, includes grsecurity by default in its kernel and is very security focused.
    • iyn 10y ago
      It's hard to believe that Alpine is "very security focused", when both the .iso and checksums are served over http/have no https forced.
      • aidenn0 10y ago
        The ISOs are GPG signed.
        • iyn 10y ago
          True, but public key is also send with http by default and signature doesn't even have proper https. It is possible to securely verify the integrity etc (e.g by using keyservers), but Alpine doesn't help with this at all.
• jcoffland 10y ago
  On my macbook I run Linux for AV. https://wiki.archlinux.org/index.php/MacBook https://wiki.archlinux.org/index.php/MacBook
• jedisct1 10y ago
  Nothing. The best AV is: - keep everything up to date - uninstall flash, java, silverlight - don't open random junk - use homebrew/homebrew cask to install stuff
  • Decade 10y ago
    > The best AV is: - keep everything up to date - uninstall flash, java, silverlight - don't open random junk - use homebrew/homebrew cask to install stuff Indefensible. Just browsing a web page is “open random junk.” Ad networks bring malware to mainstream web sites; Adblock is now a major line of defense. You could wallow in despair, or you could use QubesOS. Which, infuriatingly, does not include IPv6 yet.
    • reacweb 10y ago
      IMHO, the best AV for windows is: start a fresh VM at each boot and discard it at shutdown. If your shared folders contains only harmless data, you have almost nothing to fear.
      • kmch 10y ago
        You don't have to discard it each time. You can just have it revert to a snapshot whenever the VM is rebooted.
    • lmm 10y ago
      Web browsers are at least somewhat sandboxed - they have to be. (I'm not sure about adblock - it blocks some threats in an ad-hoc way, but it might add an exploitation vector of its own). QubesOS is only a little bit more sandboxed than a web page; it's relying on Xen (which has a poor security track record) and mostly still using commodity OSes written in C for the insides (though there is some hope e.g. http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/ http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewal... ), so at the moment even running Qubes you're still almost certainly vulnerable in all sorts of places. I agree that something like qubes (that is to say, an OS formed of a number of strictly isolated modules with a small well-defined API between them) is the path to genuine security, but we'll have to at a minimum replace the Xen layer with something proven correct before we can claim to have a genuinely secure system.
• Thaalei 10y ago
  You can explain that traditional viruses are less common on Linux. Rootkits and privilege escalation exploits are more likely. One strategy might be to say that Linux systems are not sheltered from any threat (saying otherwise might lead the other person to consider you as a biased Linux fan), but instead to explain that the threats and consequently the defensive tools to adopt are different. So, instead of an AV, I would recommend 1) an host-based intrusion detection system (HIDS), like OSSEC or Tripwire, and 2) a kernel patched with Grsecurity. The HIDS will send you an alert every time an important file (like /etc/shadow) or a new binary / package is installed or modified. Grsecurity will offer multiple very efficient protection mechanisms against privilege escalation exploits (among other things). For the MacBooks, I don't know.
  • matt_wulfeck 10y ago
    That kind of security/noise Avalanche seems only effective for paranoid administrators that can process the data from a small number of servers. Maybe a little controversial, but I think the most effective solution is simply to replace boxes frequently with full OS updates.
• devonkim 10y ago
  In production you still need to protect from zero days with some form of protection that is not necessarily detection or antivirus such as AppArmor or more commonly SELinux.
• Spooky23 10y ago
  It depends on your strategy for dealing with endpoint security and why the security folks are demanding it. Usually these requirements are driven by external compliance or some zealous security guy reading NIST docs without context. For UNIX, try to get ClamAV through or buy whatever solution is cheapest. IIRC, McAfee worked in the most platforms, including AIX. For Windows, Microsoft stuff (Windows Defender and the "Enterprise" equivalent baked into SCCM) have the lowest impact on the system... But are pretty "meh" solutions. But even the best AV is pretty meh. Personally, and coming from alot of experience managing lots of computers (or people doing the management), I would recommend running the cheap/free Microsoft AV to check the box and do the following: force users to run without privilege, disallow internet access from privileged accounts, use an application whitelisting solution, use a good proxy/anti malware solution like Palo Alto or zScaler. The whole point of this stuff isn't to stop threats -- that's a game you always lose. You want layered protection that stops what it can, helps prevent lateral movement and increases the probability of detecting a compromise.