23

In what cases does a webserver need an antivirus software installed? When it is not required?

If it is required sometimes, what should be considered when choosing the right one to install?

(In my case it is a Windows Web Server, but maybe I should not narrow down the question.)

4 Answers 4

16

There are a few points to consider here.

First, AV is not a fail-safe, catch-all mechanism for any malware. Even ignoring the blurred line between AntiVirus and AntiMalware (these engines function differently, even if they are packaged in a single product), there is no AV/Antimalware product that will catch customized, targeted attack code. So, if that is the threat you are trying to protect against, you can just as well forget that.

Secondly, if you are accepting file uploads from users (especially essentially anonymous users), you should play it safe and go for defense in depth - even it's trivial to get around AV, you can at least block the low hanging fruit - and the "innocent" victims who continue to spread the payload unknowingly.

Third, if you want to play it super-safe and have AV even if you don't need it, like @Tate recommended, you should realize that while you will be safer from viruses (again, low probability, but still exists), this is not free, there are costs involved:

  • Using AV on the server can add risk to the server, since you're adding potentially vulnerable code - less code, less attack surface. (There have even been cases of attacks on the server via the AV interfaces).
  • Checking for viruses right there on your server isn't necessarily the safest option, since these can potentially "leak" and fool the AV. (Also see George Ou over on ZDnet about defusing a bomb in your living room).
  • Of course, never forget the performance costs of running AV on your servers, consider this an opportunity cost. Also you'd need to add X more servers to offer the same performance and throughput, if you have specific usage targets this can cost real money.
  • Most server-ready AV have a non-negligable cost - more opportunity lost, and if you're spending security money there are better things to spend it on.

All that said, if/when you do decide to go for AV, consider the following points, including the obvious:

  • Coverage
  • Cost
  • Updates
  • reputation (i.e. do they actively research? what are their triggers? do they catch what they should? etc)
  • Performance (or more accurately, performance hit - on memory AND CPU, and throughput)
  • additional engines, e.g. anti-malware, loggers, anti-rootkit, etc
  • Security of the product itself! You don't want to introduce vulnerabilities any more than you have to...
  • VERY preferable - if you can offload the AV scanning to another box, e.g. appliance or gateway, so this isnt even ON the server. Or, there are (were?) some products that let you scan in memory, via an API call, without even writing to disk (or DB).
4

Antivirus is also useful even if the file upload is not required. You should not deny the possibility of server being compromised. In this case antivirus can help to identify and get rid of backdoors, web-shells, other nasty stuff. Besides antivirus additional software can be installed - like anti-rootkits, log event notifiers, etc.

2

Deploying anti-virus software as a security control to reduce the likelihood of a malware infection on a webserver is not required if there are zero opportunities for an attacker to place malware on the webserver.

But who wants to bet there are zero opportunities? The safer bet is to deploy anti-virus software as one of the many controls to help you play good defense.

Check out http://www.av-test.org/certifications.php to help you select an anti-virus solution.

0

Yes you need antivirus if you are allowing users to upload files to your server.

things you can look to choose antivirus:

  • how often is the antivirus updated.
  • determine which features you need and select the one that has those features.
  • performance, if it hogs the memory
  • cost.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .