Do Transient, Volatile Servers Require Antivirus Scanners?

Question

We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often mention it.

For long running servers this naturally makes sense. Although it theoretically opens the window to attacks through the compromise of, say, ClamAV's signature update process, this is far less likely than other forms of infections that periodic AV scans can detect and quarantine.

However, modern infrastructure is often based on immutable "machine images", such as Amazon Web Service's Amazon Machine Images, which are used as the base for groups of highly transient servers that scale up and down throughout the day based on overall usage.

Individual servers in these groups can last anywhere from one hour to six hours, but rarely last longer than a day in our case. Asking in sysadmin/devops circles, the consensus seems to be to not bother with antivirus on these servers.

Some of the points I've heard against AV on such servers are:

• The servers die in a day or less in most cases, so malware would have a hard time persisting.
• When do you schedule the scan? Not on startup, as that's presumably when the infrastructure needs the new server's resources the most, so even a niced scan process could be a problem.
• The basis of new servers is from an immutable image, so automatic quarantining is only fixing the problem for a single server for a short period of time, not fixing the problem in the base image that allowed in infection to begin with.

However, I find myself questioning this view for these reasons:

• Modern viruses often have good network propagation mechanisms, so spotting malware even on transient servers seems important.
• Combining antivirus scanning with centralised logging allows alerting of malware even if automatic quarantining isn't effective in the long term on a transient, short lived server. Just allowing staff to know about the presence of malware in a transient group of servers is critical.
• Service managers like systemd allow offsetting the first scan and scheduling after that, so avoiding hitting startup time is easy.

Could some of the experts here give their view on this? Am I right to still want antivirus scanners on such servers?

Answer 1

You are asking yourselves the right questions but asking us the wrong one.

Security controls, like AV, are meant to address threats in order to reduce the impact to an acceptable level. You have identified the threats and the likely impact of those threats. Great! Now you need to see if signature-based AV addresses those threats and reduces impact to an acceptable level (or if the impact levels are already acceptable).

Can you address the propagation issue by changing the firewall/networking to block connections initiating from the front-facing servers? If so, then AV might not be necessary.

Could you gain the threat intel ("allowing staff to know about the presence of malware") by logging the non-transient servers? What does the data from the transient servers give you that your permanent servers do not? What's the likelihood that the transient servers will get infected uniquely? If you can get the data from other sources, then you might not need AV.

How do you update the AV database? Will you have to launch the server, update the database, then run a scheduled scan? Is this delay acceptable for the level of service you require? If the delay does not make sense for you, then you might want to use other mitigations.

But the underlying question is about the type of AV that you are assuming. You are assuming locally installed, signature-based AV, but there are other, more dynamic types that do not require database updates and only scans new or incoming data. Network-based, in-line, AV is possible, as well as IDS.

So the question you need to ask is if this one implementation meets your needs or if the risks can be met by other means.

Answer 2

I would not run antivirus on my servers, for a couple reasons:

1. They are massive pieces of software

   The whole idea of a server is to execute one task, and only one, in the fastest way possible. There are some accessory tasks that you need to run, but the idea is the same. AV engines slows down your service.

2. They usually run with root permissions

   Your webserver probably does not run as root. Neither do your email server, or database, or whatever else. But the antivirus runs as root.

3. The attack surface of an AV is huge

   They have countless decoders, interpreters, decompressors, parsers, emulators... The list of moving parts is endless. One buggy decoder and you have code execution as root. Allow the AV to scan incoming packets, and you have remote code execution as root.

There are exceptions: file servers. I would install AV on a file server, because users will upload bad things. The ingress point is a good place to put an AV too, though it would be a better place to put an IDS/IPS.

Other than that, server hardening and compartmentalization will be much better for security than to install a resource hungry, hole-filled antivirus engine.