Harlan, et al:
I think the points most people are making here can be summed in a
simple scenario:
- 2 companies install webservers - both use identical OS's and IIs
versions. Both folow all a dilliegent process of securing the box, such
that IIS is the only service running, port 80 is the only port open.
They both follow an identical, very thorough process, except that 1
installs AV software, the other doesn't.
- An exploit is discovered and disclosed in IIS before MS have a
chance to patch. Lets say a buffer overflow in the "content:" tag.
Unlikely and simplistic, but quite suitable for our purposes. (the
point being, you can't trust 3rd party software)
- Some black-hat kiddie finds the exploit code, wraps a stock rootkit
up in it, and sends it into the wild.
- It hits both of our theortical organisations webservers, and
exploits successfully on both of them.
- The webserver with AV software detects the rootkit, and cleans the
file/notifies the admin/whatever.
- What happens to the system without AV software is left as an
exercise for the reader (clue: 0wnAg3)
Not an unlikely scenario, I'm sure you'll agree.
No amount of lock-down can protect you from a vulnerability in the
service you are deliberatey exposing - AV software can. Not all the
time, granted, but sometimes. And sometimes is a hell of a lot better
than never in my books.
Gareth Humphries
IT Specialist
IBM New Zealand Ltd
______________________________________________________________________________________________________
This message contains information, which is confidential and may be subject to
legal privilege.
If you are not the intended recipient, you must not peruse, use, disseminate,
distribute or copy this message.
If you have received this message in error, please notify us immediately (Phone
0800 665 463 or info@linz.govt.nz) and destroy the original message.
LINZ accepts no responsibility for changes to this email, or for any
attachments, after its transmission from LINZ.
Thank you.
______________________________________________________________________________________________________
---------------------------------------------------------------------------
---------------------------------------------------------------------------
