There are three components you need for a basic anti virus solution in the workplace; an e-mail filter, server based anti virus, and an anti virus client on all company PC’s. Like anything else relative to information technology security, you are only as secure as your weakest link.
E-mail Gateway FilterAn e-mail gateway filter will scan inbound internet based emails and attachments for viruses before the email enters your mail data store. Most of these filter applications give you several options for dealing with infected emails that cannot be repaired. The most common is to quarantine the infected email and attach a text document in place of the original attachment that notifies the intended recipient that a virus was detected and removed. Whenever a virus is detected, whether it is repaired or not, an email will also be sent to the server administrator or helpdesk notifying them of the infected file. A log is also created for reporting or tracking purposes.
Server Based Anti VirusYour servers that store all of your company data need protection as well. Even if you have anti virus protection on your PC’s there are several different ways a virus can get to your servers. The trick with server based anti virus is the exclusions. You need to be sure that your anti virus application does not affect other applications running on your servers. For example, if an anti virus application was to scan certain files within Microsoft’s e-mail server, Microsoft Exchange, there is the chance of mail store corruption. The server based anti virus is probably the most delicate part of an anti virus strategy to implement.
PC Based Anti VirusTo put it simply if you are relying on your users to update their anti virus themselves then you are NOT protected from viruses. You could have the best end users with the easiest process for user based updates but you still won’t receive 100% protection. In fact, 100% protection is almost impossible however, you can greatly reduce your risk with some simple automation tools that are readily available. Most anti virus applications come with a client-server type of solution. The client is the same anti virus client you use today however, rather then each client downloading the virus definition updates from the Internet the anti virus server downloads the updates once, then pushes the updates to each PC in your infrastructure. This is an automated process that forces the latest and greatest virus definitions throughout your network. Using this client-server application allows you to lock down the client’s functionality as well, like preventing a user from temporarily disabling the client. Plus this system provides for centralized management, notification and virus sweeps.
The virus definitions are essential in combating virus outbreaks. The MyDoom virus was propagating for several hours before the anti virus application manufactures had a definition or “fix” available and it was still able to spread across the world. How quickly could it spread through your organization? Put an anti virus strategy together today.
Written by Myles M. Keough
CEO and Principal Consultant
Spade Technology, Inc.
www.SpadeTechnology.com