What are the arguments for and against having anti-virus on domain servers

Question

I have been hired at a start-up where I seem to have become the de-facto admin despite being hired to do application support (to be fair I do have a background as an all-rounder).

Amongst the interesting things I have found is a lack on anti-virus on the domain's Microsoft servers the argument being that they are not the point on ingress therefore as long as all the ingress point are covered, protection for them is not needed.

Whilst my knee-jerk reaction is too blanket install (eset in our case) across all of machines, it got me thinking, what is my justification for the licence and performance cost?

Answer 1

Some people argue that installing an antivirus would in fact increase the system attack surface because to the vulnerabilities of the OS, you now have to add the vulnerabilities of the antivirus.

Another common argument is that antivirus could reduce system performance and stability.

In my opinion, these arguments are valid and true but you have to balance these facts with the increased security you could gain installing an antivirus.

How an antivirus can effectively increase the security of a domain controller?

In my opinion, if you implement and mantain good security practices you don't need an antivirus but cause this is difficult, installing an antivirus will cover you in some cases.

Answer 2

This might be specific server to server and application to application

For:

• Another layer detecting threats on the machine (second line of defense, since it won't plug the vulnerability).

Against:

• Most anti-virus are resource heavy and can impact performance if configured to actively scan on access server application files.

Usually i recommend to install the anti-virus and have it perform periodic scans. It is always nice to have a known company report saying you had no infections to cover your back and you can schedule it to convenient times so it won't degrade performance.

Also, you should have it actively scan for any file servers that store user uploaded files, since you don't want to be a vector on sharing malware.

Answer 3

as long as all the ingress point are covered, protection for them is not needed

This is OK most of the time - but AV do not detect 100% of malware 100% of the time. It would be nice to think that your vendor is adding new detection capabilities to deal with new threats - hence it's highly possible that a new virus might infect your domain controllers before your devices at the periphery have the capability to detect them. If your domain servers did have AV then at least there's a good chance that they will clean up the infection when they can recognize the malware.

To some extent this would be mitigated by a HIDS.

Answer 4

The advantages are minor. It's extremely unlikely AV on a domain controller would actually prevent any attack. However, the disadvantages are also minor: license cost and CPU overhead are pretty minimal. Because it doesn't actually matter what you do, most people end up installing AV by default. If you do have a problem, it's much easier to justify that action to a manager :-)

In general I think it is pretty crucial to have AV on workstations. On servers it has much less benefit. There are particular instances when it helps; a file sharing server is one example, where it is a good idea to scan for viruses on writes.

Your colleagues' mention of "ingress points" worries me as it is hard to define exactly what is an ingress point. I can imagine them putting AV on the firewall, then later getting upset that it didn't catch a virus that came over SSL.