4 ms·

Sysadmin here. We install AV to tick the box. It doesn't add much to the security equation, and hasn't for years. For prevention, limited roles/access and patc

Sysadmin here. We install AV to tick the box. It doesn't add much to the security equation, and hasn't for years. For prevention, limited roles/access and patching does all the heavy lifting. Detection happens on the server and network side. Otherwise we are expecting a compromised device to know/report itself. Remediation is a wipe and reload from known sources. When properly automated it is faster than running a full AV scan, and much more reliable.

notyourday 7y ago
> Sysadmin here. We install AV to tick the box. Ding! Ding! Ding! Does your company need to accept credit cards? Guess what? You must have AV as there are only two choices in a self assessment form: [ ] Anti-virus and anti-malware software is deployed on all systems used by the company staff. [ ] Anti-virus and anti-malware software is not deployed on all systems used by the company staff. Selecting the 2nd makes one fail self-assessment which in turn denies company's ability to accept credit cards. Security is a charade.
- gruez 7y ago
  would windows defender count as antivirus software?
  - notyourday 7y ago
    We were provided with a very large list of AV software (~2 printed pages long). Windows Defender was not on it. It was decided the risk of using software not on the list was not worth it.[0] [0] It was the 2nd annual assessment/audit I was involved in -- during the first one the sticking point was that our user-facing website was exposed to users via a CDN that was detected by the vulnerability scanner as some PHP application, which caused us to fail that test. Needless to say we did not want to deal with such mess again.
- donmcronald 7y ago
  That industry seems like a dumpster fire. I once saw an assessment that includes a regular firewall scan. Apparently everyone locks down their firewall, triggers the scan, re-opens their firewall. I guess as long as everyone's getting paid...

notyourday 7y ago

> Sysadmin here. We install AV to tick the box. Ding! Ding! Ding! Does your company need to accept credit cards? Guess what? You must have AV as there are only two choices in a self assessment form: [ ] Anti-virus and anti-malware software is deployed on all systems used by the company staff. [ ] Anti-virus and anti-malware software is not deployed on all systems used by the company staff. Selecting the 2nd makes one fail self-assessment which in turn denies company's ability to accept credit cards. Security is a charade.

gruez 7y ago
would windows defender count as antivirus software?
- notyourday 7y ago
  We were provided with a very large list of AV software (~2 printed pages long). Windows Defender was not on it. It was decided the risk of using software not on the list was not worth it.[0] [0] It was the 2nd annual assessment/audit I was involved in -- during the first one the sticking point was that our user-facing website was exposed to users via a CDN that was detected by the vulnerability scanner as some PHP application, which caused us to fail that test. Needless to say we did not want to deal with such mess again.
donmcronald 7y ago
That industry seems like a dumpster fire. I once saw an assessment that includes a regular firewall scan. Apparently everyone locks down their firewall, triggers the scan, re-opens their firewall. I guess as long as everyone's getting paid...