Do I need antivirus for this unusual installation - or just firewall?

Question

I'm donating an old Windows XP laptop to a school. The machine will spend its golden years doing only one thing - a process that consists of just three steps:

1. Recording lectures and discussions with MP3 recorder software (the app is MP3myMP3).
2. Uploading these recordings over an unsecured wireless connection to a password-protected (https:) school web site, to make them available to students participating remotely in classes.
3. Sending emails to the students after each upload, announcing that the latest recording is available. This is done thru a GMail account (accessed with Firefox) that will be used only to do this, and only on this computer.

Here's the tricky part: The old laptop is near its performance limit when doing real-time recording, and competing with wireless connections and security software for CPU cycles sometimes puts it over the edge, and we end up with skips and blips in the recordings. So it seems necessary to disable the wireless and disable the security services (currently using Norton Security Suite) while doing step 1, then re-enable them (in the opposite order, of course) when doing step 2.

But the problem with these disable/enable steps is that this whole process needs to be as simple as possible for the users who are doing it, because there are time constraints, some users with little training and experience, and the problem that each manual step is another opportunity to make fatal errors.

I'm pretty sure we need to have a functioning firewall during step 2, but I'm not sure if we also need antivirus, if all we'll ever be doing with this machine is these three steps - no other emailing, no web browsing, no other apps that interact with the internet. If we can do without the antivirus, that would save the two steps of disabling and re-enabling it.

So I'd appreciate yes/no advice about antivirus, and any other ideas for improving this peculiar setup.

Answer 1

Given the limited scope of use, I would say no, anti-virus is not critical. There are a couple of things I would do here to ensure that it's as secure as it can be, under the circumstances.

1. Make sure you have all the latest Windows Updates for XP. (May they rest in peace.)
2. Ditch Norton entirely, and configure the Windows firewall to reject all inbound connections.
3. Uninstall everything that isn't required. Doubly so for Adobe products and the Java runtime.
4. Disable every service that isn't required. This should be a lot of them, given you have a single purpose machine.
5. Enable every protection available. (ASLR and DEP are both options in XP, IIRC.)
6. Have them use the physical switch to disable wireless when they aren't uploading or using Gmail.
7. Check to ensure there are no unnecessary non-service programs running at start up.

Ultimately, some of this is bordering on paranoid mode (disabling wireless) but it's all going to improve security, is easy to implement (because you do it before you give the computer to them, they don't have to do anything other than switch wireless on and off) and getting rid of any cruft that could be running will improve performance to boot, which sounds like it's at a premium for this specific application. I really would not be terribly concerned about the security here, given the limited application of the device, but these steps should make it as secure as it can reasonably be.

Answer 2

This situation really depends on how you want to approach this issue, Yes you will always need virus protection, I wouldn't recommended Norton as the best solution for this. It has its pro's but its a complete resource hog and will contribute in taking large amounts of Resources. Better to find something with a smaller footprint like Microsoft security essentials.

If you are looking to introduce more than one computer to possible threat, a firewall would give you control of the outbound and inbound connection to the machine as well as application control pointed out towards the internet.

A Sonicwall with a UTM ( Unified Threat Managment) product on it would fit your situation as it is an All in one option. Its not really ideal for one computer per say, but a strong option at that.

Answer 3

Of course, ideally every Windows computer should have antivirus. However, if the only website this computer will be visiting is Gmail, then I think the chances it will get infected are pretty low as long as whoever is using it knows some basic computer safety tips (like not clicking random ads or opening unfamiliar emails & attachments.) Thus it may be adequate to install the free version of Malwarebytes anti-malware (which doesn't use up any system resources because it does not run in the background and only scans on demand), and run a scan on it every once in a while. Of course the downside is that the person using this computer will have to remember to do this.

Alternatively, have you considered installing a lightweight Linux distro like Lubuntu or Xubuntu? On an old computer they'll probably be a lot faster than XP and concerns about malware will largely disappear. They're also pretty easy to use and there are quite a few good audio recording programs available (Audacity comes to mind).

Answer 4

I think there is no technical solution which reliable works in this environment. The use of an unsecured WLAN indicates a lack of understanding of security in this school. I would not trust them to handle a system with known security problems in a secure way. Instead you risk with your offer, that they will point at you once the system not only got infected by itself but spread the infection to other systems. Don't believe that antivirus products or firewalls will save you, they don't even provide 100% security in an environment which is aware of security issues.

In the interest of your reputation I would suggest to not donate the machine as it is. In the interest of the security of the school I would recommend that they deny such offer because it might cost them more in the long run than they seem to have saved.