4 ms·
You probably need it because your corporate IT department wrote a policy that says you must have it. As far as I can tell that’s the only reason. The AV scamme
by badgersnake 3y ago
You probably need it because your corporate IT department wrote a policy that says you must have it. As far as I can tell that’s the only reason.
The AV scammers must have paid the SOC2 racket at lot of cash.
- chgs 3y agoThe problem is more that nobody wants to be changing policy as they won’t see a benefit and they will get blamed. Get hit by ransomware (which your AV wouldn’t detect), you get blamed for removing AV and you’re after a new job. Our password policy still demands periodic changes despite ncsc/microsoft/etc advice saying not to do that, because who wants to take the risk of changing policy.
- eviks 3y agoWhy wouldn't AV detect it? Some detect mass encryption of files and block it
- donatj 3y agoSomeone in a SOC2 meeting started making a fuss about us needing virus scanners on our Amazon Linux EC2 instances. I don’t think that got very far but… Just… Stop.
- kstrauser 3y agoThat’s absolutely a thing. It’s usually under the broader category of anti-malware. Why is the web server suddenly mining bitcoin? Edit: Source: have been through a few SOC 2 audits, enough to understand why they ask for most of the things in there. My personal thoughts on the matter aside, modern audits spend a lot more time on other malware than viruses.
- doubled112 3y agoAWS will send you an alert because your machine is behaving unusually. No need for local protection! /s sort of
- kstrauser 3y agoSeriously, that’s a legit plan. If you use GuardDuty, you can have it trigger EBS volume scans to look for malware if it sees strange behavior. I spun up an EC2 instance and ran an nmap port scan on another server and a bitcoin daemon. It caught both of those, triggered scans, and reported its findings. I’m heading down that road instead of running a traditional on-OS process.
- doubled112 3y agoYes, exactly, and you skip an agent. The agents take more resources than the services on some of my machines, which is lunacy if you ask me, but we have to check those audit boxes and the security team isn’t very capable…err…creative.
- kstrauser 3y agoI was a platform engineer before I was officially a security engineer. I’m very protective of our happy little servers and try to find ways to avoid installing awfulness on them.
- ckdarby 3y agoThought the way you presented your source is a bit odd. For SOC2 you write the controls & policies. The audit is backwards looking to confirm you're adhering to what your company has said is policy.
- kstrauser 3y agoSure, but they also want to see that those policies you wrote and conform to meet a whole lot of bullet points.
- gonzo41 3y agoI have seen this done. It was funny to watch from afar.
- m000 3y ago> You probably need it because your corporate IT department wrote a policy that says you must have it. I think the causes are deeper. At the end of the thread you will probably find some horribly outdated "best practices" and some big consulting firm that is paid $$$ to security-audit your company. The IT department are just the poor buggers that need to do whatever is needed to get that audit, although they may well know that much of it is theater.