We are often asked whether we install antivirus software on our servers, specifically the kind of signature-based scanners that run on a schedule. Client security questionnaires and ISMSes often mention it.
For long running servers this naturally makes sense. Although it theoretically opens the window to attacks through the compromise of, say, ClamAV's signature update process, this is far less likely than other forms of infections that periodic AV scans can detect and quarantine.
However, modern infrastructure is often based on immutable "machine images", such as Amazon Web Service's Amazon Machine Images, which are used as the base for groups of highly transient servers that scale up and down throughout the day based on overall usage.
Individual servers in these groups can last anywhere from one hour to six hours, but rarely last longer than a day in our case. Asking in sysadmin/devops circles, the consensus seems to be to not bother with antivirus on these servers.
Some of the points I've heard against AV on such servers are:
- The servers die in a day or less in most cases, so malware would have a hard time persisting.
- When do you schedule the scan? Not on startup, as that's presumably when the infrastructure needs the new server's resources the most, so even a
niced scan process could be a problem.
- The basis of new servers is from an immutable image, so automatic quarantining is only fixing the problem for a single server for a short period of time, not fixing the problem in the base image that allowed in infection to begin with.
However, I find myself questioning this view for these reasons:
- Modern viruses often have good network propagation mechanisms, so spotting malware even on transient servers seems important.
- Combining antivirus scanning with centralised logging allows alerting of malware even if automatic quarantining isn't effective in the long term on a transient, short lived server. Just allowing staff to know about the presence of malware in a transient group of servers is critical.
- Service managers like
systemdallow offsetting the first scan and scheduling after that, so avoiding hitting startup time is easy.
Could some of the experts here give their view on this? Am I right to still want antivirus scanners on such servers?