5 ms·

Can those customers not install ClamAV? Does that not count as anti-virus?

tw04 6y ago
Can I buy an enterprise support contract for it? I honestly don’t see an option on the site. That’s usually a hard requirement in the enterprise.
- greedo 6y ago
  Cisco AMP is just re-badged ClamAV.
tgtweak 6y ago
Fun fact that doesn't actually pass on pci-dss1 audit. You need a commercial antivirus with active subscription and centralized monitoring of that. Also I'm guessing it's easier for admins of mixed infra to have a single threat definition (ie. So your storage server catches the same threats as your endpoints)
- greedo 6y ago
  Actually, most assessors won't require A/V on Linux. 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). It's typically an ignorant CISO/CSO who wants to mark a checkbox...
  - dingaling 6y ago
    It's not necessarily ignorance, but also risk management. Who is the CIO to say that Linux is exempted from that condition? He'd need a stack of evidence that it's not commonly affected, which would need to be kept up to date . Easier just to say "AV on everything".
    - greedo 6y ago
      A CSO/CISO should be aware of what the threats to their environment are. Otherwise how can they effectively mitigate the risk? They should rely upon SMEs who can keep them abreast of changes in threat models.
  - tgtweak 6y ago
    Pretending Linux can't host or be affected by malware is a pretty ignorant thing for any ciso/cto to do.
jorangreef 6y ago
If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits. At the same time, ClamAV has a terrifying CVE track record. There's no upside, and all downside.
- 8organicbits 6y ago
  CVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products. ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?vendor_id=8871 https://www.cvedetails.com/product/15657/Clamav-Clamav.html?... Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antivirus.html?vendor_id=76 https://www.cvedetails.com/product/398/Symantec-Norton-Antiv... Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-Defender.html?vendor_id=26 https://www.cvedetails.com/product/9767/Microsoft-Windows-De... It may be safer to say that the CVE record for most AV software isn't great.
- jka 6y ago
  As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed. That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.
  - acdha 6y ago
    > Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.
snuxoll 6y ago
God I wish - central management and logging is mandatory under all of these compliance regimes. We’re in the middle of adopting HiTrust and I’ve been forced to install Cisco AMP on all of my servers. The product is absolute garbage and frequently eats up all available RAM, causing itself to crash and leave a core dump filling up my root partition. The worst part? AMP on Linux is literally ClamAV plus a kernel module to monitor file access, network connections and process creation.
- greedo 6y ago
  We've deployed AMP across our RHEL environment, and experienced the exact issues you've described. Cisco's general remediation is to increase the exclusion policy til the core dumps stop occurring. On some systems, AMP is barely monitoring any filesystems...

tw04 6y ago

Can I buy an enterprise support contract for it? I honestly don’t see an option on the site. That’s usually a hard requirement in the enterprise.

greedo 6y ago
Cisco AMP is just re-badged ClamAV.

tgtweak 6y ago

Fun fact that doesn't actually pass on pci-dss1 audit. You need a commercial antivirus with active subscription and centralized monitoring of that. Also I'm guessing it's easier for admins of mixed infra to have a single threat definition (ie. So your storage server catches the same threats as your endpoints)

greedo 6y ago
Actually, most assessors won't require A/V on Linux. 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). It's typically an ignorant CISO/CSO who wants to mark a checkbox...
- dingaling 6y ago
  It's not necessarily ignorance, but also risk management. Who is the CIO to say that Linux is exempted from that condition? He'd need a stack of evidence that it's not commonly affected, which would need to be kept up to date . Easier just to say "AV on everything".
  - greedo 6y ago
    A CSO/CISO should be aware of what the threats to their environment are. Otherwise how can they effectively mitigate the risk? They should rely upon SMEs who can keep them abreast of changes in threat models.
- tgtweak 6y ago
  Pretending Linux can't host or be affected by malware is a pretty ignorant thing for any ciso/cto to do.

jorangreef 6y ago

If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits. At the same time, ClamAV has a terrifying CVE track record. There's no upside, and all downside.

8organicbits 6y ago
CVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products. ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?vendor_id=8871 https://www.cvedetails.com/product/15657/Clamav-Clamav.html?... Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antivirus.html?vendor_id=76 https://www.cvedetails.com/product/398/Symantec-Norton-Antiv... Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-Defender.html?vendor_id=26 https://www.cvedetails.com/product/9767/Microsoft-Windows-De... It may be safer to say that the CVE record for most AV software isn't great.
jka 6y ago
As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed. That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.
- acdha 6y ago
  > Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.

snuxoll 6y ago

God I wish - central management and logging is mandatory under all of these compliance regimes. We’re in the middle of adopting HiTrust and I’ve been forced to install Cisco AMP on all of my servers. The product is absolute garbage and frequently eats up all available RAM, causing itself to crash and leave a core dump filling up my root partition. The worst part? AMP on Linux is literally ClamAV plus a kernel module to monitor file access, network connections and process creation.

greedo 6y ago
We've deployed AMP across our RHEL environment, and experienced the exact issues you've described. Cisco's general remediation is to increase the exclusion policy til the core dumps stop occurring. On some systems, AMP is barely monitoring any filesystems...