Central Anti-Virus For Small Business? 359
rduke15 writes "I'm trying to find a centrally managed anti-virus solution for a small business network, which has around 20 Windows XP machines with a Linux server. It is too big to manage each client manually. However, there is no no full-time IT person on site, and no Windows Active Directory server — just Linux with Samba. And the current solution with Symantec Endpoint Protection seems too expensive, and too complex for such a simple need. On the Linux server side, email is handled by amavisd and ClamAV. But the WinXP clients still need a real-time anti-virus for the USB disks they may bring to work, or stuff they download from their personal webmail or other sites. I'm wondering what others may be using in similar situations, and how satisfied they are with it."
Re:I'm guessing here, but... (Score:3, Insightful)
Those are all great things. But A) they won't actually stop people from bringing viruses into the office. They might *help*, but you'll still need an A/V client from time to time and B) those things are not going to happen reliably someplace that doesn't even have a full-time IT guy.
Re:ClamWin (Score:3, Insightful)
Terrible detection rate. Sorry, but when an AV suit finds about 2/3 of the threats, you can just as well go without one.
Start with sensible policies. (Score:5, Insightful)
Antivirus suits are the last line of defense. Not the first!
The first is the user and sensible usage policies. When people can download and execute arbitrary software and plug in USB sticks at random, you have bigger problems than the choice of your AV.
One proposal (Score:4, Insightful)
1) You need an anti-virus solution in the Linux box. Assuming that is your only gateway to the external internet, putting up a anti-virus enabled firewall and stopping unwanted protocols is enough to filter out most stuff.
2) Disable USB and DVD drives on every PC. Physically. Period.
Its cheap and fast.
the obvious solution.. on /. (Score:1, Insightful)
Re:Start with sensible policies. (Score:5, Insightful)
So what would you recommend?
I don't disagree with you; smart and sensible policies are the best defense. But then again, I service schools, and schools have kids and parents (and teachers) who aren't going to follow the rules, so AV is still necessary. I can't lock down the USB ports (physically or otherwise); I'd have a rebellion on my hands.
BTW - I'm an engineer by trade, just acting as an IT jockey in the meantime, so I don't know all the best tricks of the trade yet. But it'd be helpful to know. :)
Re:NOD32 Antivirus and NOS32 Remote Administrator (Score:3, Insightful)
Suggesting: don"t use MS Windows.
Yes, and don't venture into the outer world either... You'll obtain the swine consumption.
Re:the obvious solution.. on /. (Score:3, Insightful)
Security Lesson #1: Usability, Secure, Cheap - pick any two.
Anyone can put up a solution that provides two of these, however I think the solution you have put together provides only one.... Cheap!
Working from a VM? Not usable - at least not for typical office workers. No AV protection? Insecure
Allow me to elaborate on insecure...
Fair enough, you 'reset' your virtual machines when shit happens, but what about when a virus sends out spam from one of your IPs and gets your blacklisted? What about when a virus/trojan/whatever leaks confidential business information? and how do you know if things get nasty if you aren't running AV?
The viruses you need to worry about, are the ones you probably wouldn't detect without AV protection, as these are the ones most likely to do your business harm.
Never McAfee (Score:4, Insightful)
McAfee is horrendously insidious. Should you ever want to use a different product, it is damn near impossible to remove. After the IT guy at a job spent 7 hours trying to get rid of it (he did, mostly) when they switched to Kaspersky, I spent another three with regedit and a few Cygwin tools hunting down the rest. I think I got it all, since Outlook has finally quit trying to use it.
Avoid it like the plague.
Comment removed (Score:3, Insightful)
Re:One proposal (Score:3, Insightful)
Usability != USB Drives.
In most of the corporates i have worked for, my USB ports have been disabled and my DVD drive missing.
I didn't feel least constricted, if that is what you mean.
If i needed a software, i had to follow the stupid process, but i did not miss a USB drive or a DVD drive for work.
Minimalist physical configurations leave you less worrying about issues.
You are probably too young and inexperienced in the corporate world. That's why you seem to equate USB with PSU.
Re:I'm guessing here, but... (Score:1, Insightful)
Have a central computer with realtime scanning (Score:1, Insightful)
and disable the cdrom and usb disks in windows. Thats the best you can probably do
He could provide a single computer with CDROM and USB access, running one copy of an AV with realtime scanning, to enable people to transfer files to their computer via Windows filesharing AFTER the AV has scanned the files.
Re:We use Nod32 (Score:5, Insightful)
heuristics won't help either, malware authors will have pirate copies of all the latest av products and will tweak their malware until the heuristics no longer detect it before they start deploying it.
Re:the problem is the OS (Score:3, Insightful)
OSX is supposedly getting exchange support, on the other hand is Apple really the problem?
We have a similar situation where i work, exchange doesn't interoperate with the increasing number of linux and mac workstations... The problem is exchange not interoperating with anything else (as well as having a whole host of other problems and hidden costs), which is why it's being replaced.
Re:ClamWin (Score:3, Insightful)
I've not found any other AV to really be much better, i've seen machines installed with up to date mcafee which are spamming the users with ads... went through the box manually to find what was doing it and uploaded the binaries to virustotal.com, less than 10% of the av engines detected it even tho the programs hooks itself into ie and displays unwanted popup ads constantly (for typical spamvertised things like penis enlargement pills etc)
Re:I'm guessing here, but... (Score:3, Insightful)
What about users who get hit by drive by infections on websites that should be trustworthy (because the sites got owned, or malware is delivered through third party ads)?
What about users who open pdf files or msoffice documents containing exploit code and malware?
What about users who simply insert media infected with autorun malware?
How about malware emails coming from trusted senders (either because those people are infected themselves, or because the mails are spoofed)
There are plenty of infection vectors which don't involve users doing things they're not supposed to be doing.
Re:We use Nod32 (Score:1, Insightful)
"and no viruses". What does that mean? How many has it caught and sequestered? The mark of good virus protection isn't "how few I've had since installing it" but "how many it's detected and stopped"
Re:Start with sensible policies. (Score:3, Insightful)
Re:We use Nod32 (Score:2, Insightful)
nod32 and kaspersky have similar performance impact (much less than most... including symantec and mcafee) and similar success rates at catching viruses (again, much better than symantec and mcafee)
Both nod32 and kaspersky have administrative consoles that manage the network via a server (think policies, update distribution.)
Why do I generally recommend kaspersky.... it's a couple hundred dollars cheaper....
One little hint. If you run a linux server, most admin servers run only on windows (using msde sql server junk.) Not a big deal if you just load up vmware/xen/whatever. A small windows partition solves this problem without jumping though huge hoops.
Oh, and the stay-away froms....... avg, ca (never catches stuff), symantec (tends to hose up the system)
Virtualization? (Score:2, Insightful)
Isn't this a good reason to use virtualization?
Step 1: Have a centralized, protected, backed up file server.
Step 2: Create a standard clean OS and application installation image.
Step 3: Daily or weekly flash back to the clean installation (since all user data will be on the file server see step 1 - if its not they'll learn very quickly)
Step 4: Profit.