I administer a few hundred servers and am going through a yearly PCI audit. This time around we need to prove that we've got anti-virus protection on our "systems commonly affected by malicious software (particularly personal computers and servers)"
The systems I work on consist of several intermediate hosts (all in PCI scope) and far-end servers (also in PCI scope) that function as glorified VPNs.
So I'd say I have 3 classes of Linux servers and 2 classes of Windows servers
- Linux Servers used as bastions
- Linux Servers deployed from proprietary companies as appliances
- Linux Servers used purely for routing traffic
- Windows Servers used as bastions
- Windows Servers with proprietary software on them used as appliances
Of the five classes of servers, what arguments can I make (or steps can I take) to say that some (particularly the Linux Servers used as appliances and used for routing traffic) don't fit the requirement for being ones that require anti-virus installed on them.
Note, I'm not trying to skirt the security, some of these hosts are very lightweight (1 cpu, 192 MB RAM) and buckle under virus scanning and they're not all managed in the same platform to benefit from hypervisor level scanning and they're already locked down to prohibit outbound connections to all but a handful of Internet sites. I deployed a Clam AV server as a good faith attempt to meet the requirement, but found the machines ran out of gas very quickly.