0

I have an EC2 instance with an Windows OS with anti virus installed.

I have a requirement to attach a file share to the OS where the application is hosted. The file share is Amazon Fsx ( Amazon's native windows file system).

Can I rely on the OS scanning the Fsx file share or should the Fsx have its own file scanning capability?

3
  • 1
    This questions seems a much better fit for Amazon's tech support. They can give definitive answers, rather than wild guesses. – MechMK1 Jul 15 '19 at 15:38
  • this is not an amazon specific question but more a question whether OS scanning of a share is acceptable or a share having its own dedicated scanning capability. – Architect Jul 16 '19 at 8:42
  • 1
    I can’t thing of a reason why file share has to have its own AV. However I also can’t think of a reason why you need AV in the first place. – Andrew Morozko Jul 16 '19 at 9:23
0

I would do BOTH because in the event that either system was compromised it could then become a pivot point on the network to attack other nodes. In all of my secure implementations I've installed antivirus even on Linux OS's, granted the probability of being attacked is less than Windows but it's still a possibility. Also you should consider hardening everything with a framework like NIST and or CIS-CAT to reduce the attack surface and only run what's necessary from a services standpoint. Lastly, configure the machine to also scan on mounted file systems as well as when files are accessed. I like and use ESET because their licensing model is affordable and they have good 3rd party reviews, but there's a TON of options out there for this.

0

It depends on the context.

You should consider some things like the following:

  • what type of files reside there and what can open/execute them

  • what OS(es) will open the target files

  • what capabilities your AV has

Explanation: If your files are generated and stored by a similar OS to the one you scan the location with, then it's pretty safe to do so. If the files are from a different OS then your solution is insufficient and will be as good as the AV solution is, which in turn can or cannot correctly detect dangers designed for other OSes than the host one and may or may not have advanced features (like centralized threat detection).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.