3

All the servers & fat clients on site are protected with ESET Endpoint Antivirus, however I notice none of the thin clients have any type of AV enabled.

A brief Google search doesn't show much interest in securing these little beasties. Should I look into a lightweigh AV system for these, or are they fine?

EDIT:

Running Windows 8 and 10 iot embedded.

The point is that if a end user plugs in een USB it can infect devices on the network.

  • Some thinclient use a flashbased OS and the OS is proprietary, thus you just cant install an AV on those. please edit your question with the OS (windows embeded, thinos, linux, zero client, etc..) – yagmoth555 Sep 7 '17 at 16:34
  • if rebooting is quicker than scanning, what's the point? – dandavis Sep 7 '17 at 18:54
  • The point is that if a end user plugs in een USB it can infect devices on the network – Ruben.w Sep 8 '17 at 6:37
1

This depends on quite a few factors. A few points for and against AV in thin clients. What is the thin client actually used for? Is it normal users workstations or or a specific app?

  • What connectivity do they have? Access to network shares? This could allow malware to spread across the infrastructure via shares, this could include ransomware.

  • Are the the clients sessions destroyed and reverted when they log out? This would clear any existing malware on the system. However, depending on the connectivity as above movement to another server may have already taken place if the connection allows it.

  • If you have connectivity to the web, and nothing else, if malware gets onto that machine data from that session and users profile could be exfiltrated via the internet.

  • Does the host the clients are running on have AV? And are the shares scanned on a regular basis? This could be a good halfway house, but won't be able to detect in memory malware, but to be persistent, malware must write to a file "at some point" and when this happens if you are scanning all the mount points used within the thin client, then you should be able to detect it.

In my view, as a someone in the security field, I'd say yes, run AV. It's potentially a point of exposure for malware to enter your network and you want to stop that asap.

  • Thank you! Do you know a good AV for windows 8/10 embedded? – Ruben.w Sep 7 '17 at 13:58
  • To be honest, Windows defender is one of the better AVs out there at the moment! Free too... – geekscrap Sep 8 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.