On Access Scanning - Servers

Hello dan dunn,

on access scanning should be disabled on servers (with a weekly scan setup)
once in a while I have to talk to some freelance computer expert or a specialized equipment retailer's technician who seems to think what they#ve learned about AV in the 1990s is all there is to know, INT 13 is the biggest threat, scanning means rummaging through a file until you find a telltale string, and best practice is still what it was then.

Arguably if all endpoints are reliably protected and "nothing" is ever downloaded, imported, executed on the server itself the potential double scan (note this applies to files written, files only read are not rescanned on the server) is superfluous. Interestingly the discussion stops whenever a claim is made that AV consumes too much resources and I ask for hard numbers.

Now, ransomware on a client would encrypt the files it can write to, this should be only (writable) data on the share but not the server's files - bad enough. Traditional AV wouldn't be able to prevent this, Intercept X claims to be able to detect such an attack. As the recent Wanna has again shown attacks on the server from the outside are not impossible (remember Blaster?). There's a chance though that (even traditional) AV detects one of the precursors or initial actions of the final payload.
And with roaming/mobile devices and BYOD you never know about the state of AV on the client, so ...

Just my two cents

Christian

Hello dan dunn,

on access scanning should be disabled on servers (with a weekly scan setup)
once in a while I have to talk to some freelance computer expert or a specialized equipment retailer's technician who seems to think what they#ve learned about AV in the 1990s is all there is to know, INT 13 is the biggest threat, scanning means rummaging through a file until you find a telltale string, and best practice is still what it was then.

Arguably if all endpoints are reliably protected and "nothing" is ever downloaded, imported, executed on the server itself the potential double scan (note this applies to files written, files only read are not rescanned on the server) is superfluous. Interestingly the discussion stops whenever a claim is made that AV consumes too much resources and I ask for hard numbers.

Now, ransomware on a client would encrypt the files it can write to, this should be only (writable) data on the share but not the server's files - bad enough. Traditional AV wouldn't be able to prevent this, Intercept X claims to be able to detect such an attack. As the recent Wanna has again shown attacks on the server from the outside are not impossible (remember Blaster?). There's a chance though that (even traditional) AV detects one of the precursors or initial actions of the final payload.
And with roaming/mobile devices and BYOD you never know about the state of AV on the client, so ...

Just my two cents

Christian