1

I work in an organisation that struggles to manage and maintain services.

We're rolling out an AV solution and I want to configure a single exclusion list across our entire estate to cover SQL, AD, Exchange, etc. I realise that this may lead to exclusions on a subset of servers which are irrelevant or shouldn't be excluded.

Our AV solution isn't flexible enough to have inheritable exclusion lists, so we'd need separate exclusion lists for each server type with the management overhead of updating multiple lists each time a single exclusion changes.

Is there any official (NIST, GCHQ, Microsoft, etc.) guidance on this? Theoretically it's safer to use multiple exclusion lists, however given my organisation, the effort in maintaining separate exclusion lists is likely to lead to incorrect and inconsistent configurations, which is a risk in itself.

Any thoughts?

  • I have no idea what do you mean about "exclusion list". Is it a application hash file list? Most AV business solution has a centralised management console allow you to add exclusion file and folder. Prominent AV will exclude prominent application signed file certificate, it is somewhat more reliable than building your own exclusion list. However, there are always exception, even vendor like Microsoft does has tons of legacy apps without a signed certificate. – mootmoot Apr 18 '18 at 16:26
  • By exclusion list, I mean processes, files and directories which should not be scanned by the antivirus agent due to performance implications - for example Ms SQL, Ms Exchange and DCs all have their own exclusion lists. My question is whether it's insecure to use a monolithic list rather than multiple targeted lists for each server product/vendor? I also reiterate the fact that my organisation is bad at management and administration, so anything which adds complexity carries a risk. – SnowyPeaks Apr 18 '18 at 18:46
  • IMHO, except something like data repository, it is not a good idea to exclude application folder. Most anti-malware have try their best to optimize scanning performance by checking known application certificate and file hash (so no heavy check is done if the program file is not tampered). You should also consider move the scanning process and schedule different folder under different time frame. – mootmoot Apr 19 '18 at 8:48
0

You can use template languages or macro processors t generate exclusion lists which share some common parts. When changing a included part you would automatically regenerate.

This might be a good idea to make the exclusion lists as targeted as possible since some standards mandate strict management approval for exceptions.

And since anti-malware is often a cover your ass technology you want to make sure it looks like you care.

1

Excluding in each server only what may be excluded is more secure than excluding the same resources in every server because the less you exclude, the better. In the other hand you won't increase the risk too much by applying the same exclusions to every server if the exclusions are reasonable.

Imagine for a moment that one server requieres you to exclude everything and that should be propagated to all systems...that wouldn't be reasonable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.