Force AV Scan of USB drive vs. File-Access Scan

Question

I have been evaluating MS Forefront Endpoint Protection 2010 vs. Kasperskey 2010.

One of the major differences in features seems to be that Kasperskey gives the option to force the full scan of a USB drive when it is inserted (Source), whereas FEP seems to rely solely on "actively protecting IO to/from that removable drive so autoruns that execute are scanned and any files that autruns call would be scanned.. also any reads/writes to that remove drive file system are scanned..." (Source)

FEP does have the option to run a full scan on the USB drive, but it cannot be a forced scan upon insertion of said device.

Do you see any weaknesses in the approach taken by FEP?

-Josh

Answer 1

Data must be read to be executed; if each read file to be read is scanned, then the time at which it is scanned should not be relevant. Kaspersky's potential advantage it that it will detect a drive with malware that came from somewhere else and is going to be sent somewhere else when you're done with it. It will come at a cost of performance.

Unless you're in the habit of taking somebody else's dirty drive, adding files, and sending it along, I'd not sweat about that particular feature either way. If that is company habit, you have what I would consider more a training issue than a technical issue.

Answer 2

As is usually the case it all depends on your needs. There is an argument that as long as you check everything going to or from the drive you are safe, but this won't help you if your drive is then plugged into a machine that doesn't scan it at all. You may be blamed if malware then infects that machine.