We currently use a PaaS solution for our web application and db for a Ruby on Rails environment and PostgreSQL.

In an on-premise solution, we had servers that we managed ourselves and had antivirus solution installed on these servers. Does it make sense to have AV service on a PaaS that is provided and integrated by the PaaS provider (i.e. we are not installing AV)? I searched the cloud provider's site and have not come across this.


With a PaaS, they manage both the hardware and software for you (which is different from IaaS, when they manage the hardware and you control the software). The advantage of PaaS is of course that you have less to do - you hand them your application and they manage everything to make it run - hardware, OS, load balancing, automatic scaling, etc... Many of these items can be a pain to manage properly, so PaaS has some helpful advantages.

I know you already know all of this, but your answer is hiding in there. They manage everything, and as a result you implicitly assume that they are managing it properly. Downtime, for any reason, is covered by your service agreement. As a result:

  1. If they are down because some critical hardware fails, they may owe you a refund
  2. If they are down because they upgrade their software and crash their systems, they may owe you a refund
  3. If they are down because ransomware takes over their systems, they may owe you a refund
  4. If they are down because a virus takes over their infrastructure, they may owe you a refund
  5. If they get hacked and the attacker walks away with your confidential information, you may be able to sue them for lots of money

So to recap:

Should they use an anti-virus?

Who knows! If they are running an OS that requires an antivirus, then they probably should be. If they are running something else, then they probably shouldn't. Neither you nor I really "know" what their hardware/network/OS setup look like, so no one can answer that question for you. The only question that really matters is:

Can they reliably provide the service they promised and keep your data safe too?

Answering that question goes far beyond the usage of anti-virus software, and is even more impossible to answer. Therefore, the question you really want answered is to some extent unanswerable. At least, I wouldn't expect them to talk extensively about antivirus usage or any details like that. I would just expect them to make general promises about how awesome and secure they are, and probably mention as many positive reviews or referrals as they can squeeze out of their customers. I don't expect your typical PaaS provider to let you "peek under the hood", so to speak, so at the end of the day it is really just about trust and the threat of legal action if they screw up.

Trusting a PaaS

Finally I think it's worth a brief aside to say that while you can't necessarily verify just how well a particular PaaS might secure their ecosystem, it's certainly worthwhile to ask whether a particular vendor might be trustworthy. The problem is that egregious failures on the part of PaaS vendors have definitely happened. The biggest example that comes to mind is Code Spaces. Part of their services were data protection, for which they promised:

“Backing up data is one thing, but it is meaningless without a recovery plan, not only that a recovery plan – and one that is well-practiced and proven to work time and time again,” a cached version of their website reads. “Code Spaces has a full recovery plan that has been proven to work and is, in fact, practiced.”

Unfortunately they were hacked and had their full infrastructure destroyed by the attacker, effectively destroying all customer data and rendering them immediately out of business. Some caution is required!

  • What OS does not require an AV? – schroeder Sep 13 '19 at 8:50
  • @schroeder I'm pretty sure that many of the non-linux varieties of Unix don't even have AV readily available. With Linux it is mildly controversial (from what I have seen) with some insisting that you should use AV with Linux, and some arguing that the costs (reduced performance) outweigh the potential benefits. – Conor Mancone Sep 13 '19 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.