Question: if malware disables your scanner, how could a scheduled scan
possible\y discern the malware?
Answer: the sound of one hand clapping?
Seriously, unless you're remotely scanning all your systems (generally
impractical), a scheduled scan is not going to help you here. Auditing
software will.
G
-----Original Message-----
From: Mark Brunner [mailto:mark_brunner@hotmail.com]
Sent: Thursday, December 29, 2005 2:43 PM
Cc: focus-virus@securityfocus.com
Subject: RE: Do we still need scheduled scan?
Scheduled scans are one more layer of defense in your security arsenal.
Not scanning increases the risk of compromise. These days you need every
layer you can get! Consider the implications of the zero-day threat.
It is quite possible and plausible that real-time scanning will not
detect a malware object that it doesn't have a signature for. This
beastie is now resident on the system, performing it's programmed
intention.
Question: What is the first thing that a modern malware does these days
when successfully executed?
Answer: Discretely de-activate anti-virus and firewall defenses to
ensure its success.
Question: What would be the next function that malware would likely
perform?
Answer: Introduce other vulnerabilities and exploitable characteristics
to secure its existence.
Question: What do you think the next wave of viruses are going to behave
like?
Answer: They are going to target smaller groups, avoiding mass attacks
so as to avoid signature development, lock themselves into a system,
behave in a limited fashion to avoid detection, gather and forward info
slowly, and subvert "normal" processes.
If you don't actively scan, you are unlikely to notice that your A/V
isn't working properly. Most of us rely on the silly little taskbar icon
to indicate that A/V is working in real-time. It's not that hard to
write an app that pops an icon into the system tray to look like A/V is
working. If you don't actively scan, that little malware program may sit
on your hard drive undetected, waiting for your defenses to go down or
some other agent acts to activate it. If you don't actively scan, there
are alternate storage areas that can be used to store viruses where
real-time won't detect it. For one, the Master Boot Record is a great
place to store malware, and it can be reached earlier in the boot
process than A/V software. If you don't scan, you are relying on a
single defense, rather than the full range of defenses provided by your
A/V product.
Just my 2c. Collect the whole dollar!
Mark
-----Original Message-----
From: kyle.moffitt@sophos.com [mailto:kyle.moffitt@sophos.com]
Sent: Thursday, December 29, 2005 12:07 PM
To: Bruce Martins
Cc: dfox168@hotmail.com; focus-virus@securityfocus.com
Subject: Re: Do we still need scheduled scan?
I guess I'm not "telling" anyone anything, except which parameters
generally dictate best practices when considering system-wide scanning
strategy. Either way, "my" AV product is irrelevant to the question
posed
-- and further qualified by a legitimate business problem -- which was
essentially "is this additional scan necessary with respect to all my
other defensive measures, AND the substantial overhead it consumes?".
If I thought the conclusion reached based on those parameters was a
recipe for disaster I wouldn't have offered such a reckless suggestion,
especially under my moniker.
Is schedule scanning "pointless"? In a perfect world, no. But as it
stands, its business value may decrease when all other things are
considered. It's just another risk calculation we all must face in this
topsy-turvy world, my friend, so I'm just offering it as I hope you
would take it: FWIW. No apologies necessary.
Kyle Moffitt
Sophos, Inc.
"Bruce Martins"
<BMartins@extend.
COM>
To
<kyle.moffitt@sophos.com>
12/29/2005 11:43
cc
AM <dfox168@hotmail.com>,
<focus-virus@securityfocus.com>
Subject
Re: Do we still need scheduled
scan?
So your telling everyone that scheduled scanning is pointless because
your av products with real time scanning are perfect? That is recipe for
disaster, no impact on a user that isn't there running a full scan every
hour doesn't make sense either, using all of the capabilities of the
products is best and having a fall back layer of a scheduled full system
scan doesn't hurt, calling this costly is nothing compared to lost data
or downtime to the user and or network
Apologies if I misread your response as I am on the move at the moment
Bruce Martins Systems Administrator
EXTEND>>MEDIA
190 Liberty Street
Toronto, Ontario
Canada
M6K 3L5
_______________________
e:bmartins@extend.com
t: (416) 535-4222 ext. 2307
f: (416) 535-1201
http://www.extend.com
--------------------------
Sent from my BlackBerry Wireless Handheld
-----Original Message-----
From: kyle.moffitt@sophos.com <kyle.moffitt@sophos.com>
To: Bruce Martins <BMartins@extend.COM>
CC: dfox168@hotmail.com <dfox168@hotmail.com>;
focus-virus@securityfocus.com <focus-virus@securityfocus.com>
Sent: Thu Dec 29 10:35:10 2005
Subject: Re: Do we still need scheduled scan?
This approach presumes updates are infrequent (> 1hr apart), and/or
innacurate or expensive proactive detection is employed. The
cost/benefit of relying on on-access scanning (esp. for client machines)
vs. costly and redundant scheduled scanning is almost always in the end
user's favor. FYI, best practices differ based on the engineering of AV
software, and a particular vendor's global response capability to
emerging threats. Suffice to say, no two AV are alike.
Kyle Moffitt
Sophos, Inc.
"Bruce Martins"
<BMartins@extend.
COM>
To
<dfox168@hotmail.com>,
12/29/2005 09:59 <focus-virus@securityfocus.com>
AM
cc
Subject
Re: Do we still need scheduled
scan?
You should still run a scheduled scan sometimes things are missed in
between dat file updates, if you run the scan late at night there should
be minimal impact. Bruce Martins Systems Administrator
EXTEND>>MEDIA
190 Liberty Street
Toronto, Ontario
Canada
M6K 3L5
_______________________
e:bmartins@extend.com
t: (416) 535-4222 ext. 2307
f: (416) 535-1201
http://www.extend.com
--------------------------
Sent from my BlackBerry Wireless Handheld
-----Original Message-----
From: Doug Fox <dfox168@hotmail.com>
To: focus-virus@securityfocus.com <focus-virus@securityfocus.com>
Sent: Wed Dec 28 17:28:04 2005
Subject: Do we still need scheduled scan?
If we have already implemented virus scan at the gateway, on the mail
server, on individual servers, and real time scan on
workstations/laptops, do we still need scheduled, e.g., weekly, scan on
workstations and laptops as well as servers?
Schdeuled scans really slow down some machines.
Any comments are appreciated.
Thanks,
Doug
--
Kyle Moffitt
Senior Account Executive, Sophos
Tel: 781 973 0110
Web: www.sophos.com
Sophos - integrated threat management
--
Kyle Moffitt
Senior Account Executive, Sophos
Tel: 781 973 0110
Web: www.sophos.com
Sophos - integrated threat management
-----------------------------------------
This e-mail is sent by a law firm and contains information that may be
privileged and confidential. If you are not the intended recipient,
please delete the e-mail and notify us immediately.
