I am working with an enterprise network with sensitive data nad am not sure if I should use SELinux or an Antivirus for the Servers, POS Terminals, and Desktop Machines.
I need to know what the difference between SELinux and antivirus is, the functionality in selinux that is better than antivirus, embedded features, and if it can replace an antivirus program
Quick answer:
SELinux is a security module that provides access lists and many other features. I'm not familiar with the details of this tool. Hopefully another answerer will be able to help you.
Since SELinux focuses more on access control, it would be an effective way to limit the access of users, and any potential attacks on that user's account. Such an 'access control' system is quite different from Anti-Virus.
Anti-Virus is a 'file scanning' tool that checks for publicly-known malware that is in a regularly-updated database. Unfortunately the database may not be complete and small-scale malware will not be detected.
Anti-Virus is a simple to install but limited-effect tool. Can be used to detect attacks (usually after the attack is successful), or to attempt to remove malware after the computer is 'infected'. Unfortunately, some malware is not in the database and could remain, so if you are infected you should Nuke From Orbit. (wipe and re-install the OS)
Sometimes malware is contained within a non-root user account, in which case wiping that account should suffice. However, this only works if you are sure that the virus could not have obtained root access after the initial attack.
It is possible that SELinux gives non-root accounts greater flexibility? This would help you avoid use of a root account for applications.
Should you use SELinux or an antivirus? Yes. SELinux and an antivirus perform complementary tasks, so using both is better than using one or the other.
An antivirus is a tool to find known threats. It can look at a file and say "this is a virus", but it can't look at it and say "this is not a virus" -- the file might contain a previously unknown threat.
SELinux is a fine-grained permission system. It can do things like enforce a rule of "the web sever cannot write to directories outside its dedicated storage area" -- this greatly limits the damage an attack can do, but does nothing to prevent you from running an infected program in the first place.
The two work together: the antivirus stops known threats, but can't deal with unknown threats, while SELinux limits what an unknown threat can do, but wouldn't recognize a threat if one bit it.
Both SeLinux & Anti-virus/rootkit-hunters should be used.
SeLinux is a tool for keeping users and services in check though the use of profiles. Think of it kinda like a file system firewall because when improperly configured their equally useless. When setup correctly it can cause premature balding in attackers that stress out over such things.
Antivirus software generally only protects against known and nonpolymorphic locally executable code. And will fail to protect against software lives in memory or software that touches it's own bits such as those compiled with movfuscator that are intentionally designed to not only defeat antivirus but also reverse engineering attempts by malware analysis tools. In other words antivirus only really protects against "script kidies" and their ilk.
For production servers I'd suggest something for your kernels' security (the only currently known tool to mitigate against some forms of 0-day exploits) in addition to above mentioned; see the GrSecurity kernel patch and it's PaX control friends. Warning this is the highest difficulty suggestion listed in this post, however, it's also a pain in the butt to attack systems with this level of security. So definitely check into it.
For any remote servers, some form of intrusion detection system (IDS) such as tripwire should be in place prior to allowing other users on. And for persistently networked servers it would behoove you too consider setting up a snort box to monitor network traffic.
For user process segregation I've found that firejail is compatible with above listed suggestions and when setup correctly provides a lower overhead cost and much smaller dependencies list to keep updated than other sandboxing/virtualization options on the market that provide similar levels of control.
All that being said if someone wants to pop your box and has sufficient time, resources & access, then, your box will eventually get popped. So encourage your clients/users to be making encryption and off site backups a priority. These final layers of security are a bit tougher to have implemented on a multi-user server so the one experimental option I'll leave for your consideration is a tool I'm writing for server access log asymmetric encryption Paranoid_Pipes a bash script that allows remote servers to write logs they'll never be able to read from in clear text again.
One option similar to the last one listed but not advisable for this question because of the "sensitive intimation" stipulation would be the file system from https://keybase.io but because you're handling private stuff it would be best if ya kept it off third party storage no matter the encrypted state and preform local encryption and backup over secure channels such as sshfs mounts.
