In the view of many security professionals, antivirus software is not an effective solution to protecting an environment from infections. Primarily, their argument is that most serious virus threats are new viruses that are not included in the signature dictionaries of antivirus software. Therefore, if the protection tool cannot detect new virus incursions, then it really only offers a semblance of protection.
I have to agree somewhat with this argument. However, I don't agree that antivirus software is useless. Antivirus software is more than sufficient at protecting all known virus incursions. So failing to deploy it is a definitive act of negligence.
However, antivirus software by itself is not an adequate protection solution. Fortunately, there are many other preventative, detective and corrective controls to help protect your organization's critical data from damage, destruction and loss.
The first and most important alternative or compensating tool is to use a backup solution. Backup can be as simple as a daily file backup or as complex as system mirroring, redundant servers, database shadowing or remote journaling.
Another tool is to use an integrity-checking solution. Tools like tripwire can be used to scan files for changes. Verifying the integrity of files periodically is a definitive way to discover when an unauthorized change has occurred. If you are unable to link a discovered change to a specific authorized user through
Requires Free Membership to View
When you register, you’ll also receive targeted alerts from my team of editorial writers and independent industry experts with the latest news, tips, and advice to help you do your job more efficiently and effectively. Our goal is to keep you informed on the hottest topics and biggest challenges faced by IT professionals today working with desktop management and security technologies.
Cathleen A. Gagne, Senior Editorial Director
audit trails, then you can have a reasonable assurance that some form of malicious activity is going on.
Host-based IDS solutions based on behavior detections may offer some additional protection as well. Being able to train a semi-intelligent monitoring program to look for abnormal activities, especially those performed by processes rather than directly by a user, can identify possible intrusions.
These are just a handful of the alternatives to antivirus software you should seriously consider deploying in your environment. Not as a replacement, but as a companion protection mechanism. Remember, it is your data and your environment. Isn't it worth protecting?
About the author
James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.
This was first published in December 2002