All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled.
A brief Google search doesn't show much interest in securing these little beasties. Should I look into a lightweigh AV system for these, or are they fine?
Running Windows 8 and 10 iot embedded.
The point is that if an end-user plugs in een USB it can infect devices on the network.
This depends on quite a few factors. A few points for and against AV in thin clients. What is the thin client actually used for? Is it normal users workstations or or a specific app?
What connectivity do they have? Access to network shares? This could allow malware to spread across the infrastructure via shares, this could include ransomware.
Are the the clients sessions destroyed and reverted when they log out? This would clear any existing malware on the system. However, depending on the connectivity as above movement to another server may have already taken place if the connection allows it.
If you have connectivity to the web, and nothing else, if malware gets onto that machine data from that session and users profile could be exfiltrated via the internet.
Does the host the clients are running on have AV? And are the shares scanned on a regular basis? This could be a good halfway house, but won't be able to detect in memory malware, but to be persistent, malware must write to a file "at some point" and when this happens if you are scanning all the mount points used within the thin client, then you should be able to detect it.
In my view, as a someone in the security field, I'd say yes, run AV. It's potentially a point of exposure for malware to enter your network and you want to stop that asap.
In case of Windows-based HP thin clients (Windows Embedded Standard 7 either Windows 10 IoT Enterprise based) Windows Defender is included and enabled by default: Windows-based HP thin clients - Antivirus Software Support. http://h10032.www1.hp.com/ctg/Manual/c05316314
