1

I'm looking at rolling out agent based AV to around 1000 Windows servers across our estate. This feels like too much of a blanket approach. We have a mixture of services running - the usual things such as Citrix, SQL, AD, Exchange and various other applications.

A lot of our servers do not have any direct user interaction as users do not directly logon, so the risk is somewhat low. Conversely, the risk of a performance hit is significant.

From what I've read the should AV be on servers questions seems to be a matter of opinion. Is there any official guidance from the likes of Microsoft or NIST?

Also, if AV is put on servers, should all the servers have real time scanning enabled? In addition, should scans be set to scan on read & write or just read?

Thanks

Improve this question
3
  • 4
    There is no "official recommendation". There are different standards for certain requirements (e.g. PCI-DSS), but there is no "official", single recommendation. The "best" standard to follow would necessarily be opinion-based unless it's legally mandated.
    – forest
    Jul 5, 2018 at 8:18
  • As mentioned in the other answers about this, it needs to be a risk-based approach. You need to understand your threats and the impacts and you need to figure out what costs and risks you are willing to accept. Because of this risk calculation, there can be no official "recommendation".
    – schroeder ♦
    Jul 5, 2018 at 8:22
  • Matching features of the security products to the server role is worth consideration. For example, you may want to deploy a cryptoguard solution on a file server. You may want web scanning on a computer providing internet access to users but not on a SQL server. Security products hook in different places to make "checks". You can typically disable features to reduce resources. I would expect maybe a group/policy approach for each role where exclusions/feature options are considered.
    – HelpingHand
    Jul 5, 2018 at 22:29

1 Answer 1

Reset to default
1

There no official "recommendation" that you can get. What you can do is understand your security needs, and compare products to match your requirements, performance and budget.

Personally I use this for my Windows Servers:

https://www.eset.com/uk/business/server-antivirus/file-security-windows/

Read about it, understand the features and see if they match your requirements.

Improve this answer
2
  • Came here to say that - there's no such thing as an "official recommendation," and if it did exist, Stack Exchange wouldn't be the place to find it. :)
    – securityOrange
    Nov 3, 2018 at 18:07
  • Indeed that’s correct.
    – Mecanik
    Nov 4, 2018 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.