Re: Should webservers, eg. IIS 6 have anti--virus installed on them?

> Should IIS have anti-virus installed on them. I know I would do it for a
> fileserver but for IIS, I rather lock  it down.

Given that  IIS Servers are often externally facing, I would suggest
that AV software should be considered a higher priority for these
machines.

I often see IIS boxes compromised through vulnerable services, poor
coding or inadvertent misconfiguration.  Once compromised, the
attackers will install an ftp server, install a rootkit to hide their
warez/toolz, and probably use your box to scan other systems,
participate in a botnet, host phishing sites etc.

Of these, only the initial exploit code can really be considered, in
and of itself, malicious.  but AV software will often pick up the ftp
server, the rootkit (prior to installation) the vuln scanner, and if
you are lucky, maybe the phishing kit as well.

AV software on your IIS box can mean the difference between you
finding the above tools, and a CERT team asking you to remove them.

Some guidance is available on this subject from Microsoft:

Antivirus Defense in Depth Guide:
http://www.microsoft.com/technet/security/topics/serversecurity/avdind_0.mspx

Windows Server 2003 Security Guide (CH 8):
http://www.microsoft.com/technet/security/prodtech/windowsserver2003/w2003hg/sgch00.mspx

---------------------------------------------------------------------------
---------------------------------------------------------------------------