Tip

Adding to antivirus software



In the view of many security professionals, antivirus software is not an effective solution to protecting an environment from infections. Primarily, their argument is that most serious virus threats are new viruses that are not included in the signature dictionaries of antivirus software. Therefore, if the protection tool cannot detect new virus incursions, then it really only offers a semblance of protection.

I have to agree somewhat with this argument. However, I don't agree that antivirus software is useless. Antivirus software is more than sufficient at protecting all known virus incursions. So failing to deploy it is a definitive act of negligence.

However, antivirus software by itself is not an adequate protection solution. Fortunately, there are many other preventative, detective and corrective controls to help protect your organization's critical data from damage, destruction and loss.

The first and most important alternative or compensating tool is to use a backup solution. Backup can be as simple as a daily file backup or as complex as system mirroring, redundant servers, database shadowing or remote journaling.

Another tool is to use an integrity-checking solution. Tools like tripwire can be used to scan files for changes. Verifying the integrity of files periodically is a definitive way to discover when an unauthorized change has occurred. If you are unable to link a discovered change to a specific authorized user through audit trails, then you can have a reasonable assurance that some form of malicious activity is going on.

Host-based IDS solutions based on behavior detections may offer some additional protection as well. Being able to train a semi-intelligent monitoring program to look for abnormal activities, especially those performed by processes rather than directly by a user, can identify possible intrusions.

These are just a handful of the alternatives to antivirus software you should seriously consider deploying in your environment. Not as a replacement, but as a companion protection mechanism. Remember, it is your data and your environment. Isn't it worth protecting?


About the author
James Michael Stewart is a partner and researcher for ITinfopros, a technology-focused writing and training organization.


This was first published in December 2002

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.