D&C Lug - Home Page
Devon & Cornwall Linux Users' Group

[ Date Index ][ Thread Index ]
[ <= Previous by date / thread ] [ Next by date / thread => ]

Re: [LUG] Virus checking linux server



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thorsten Ruffle-Brandt wrote:
|
| he could just install the Antivir
| package so he can demonstrate to your boss that an antivirus program is
| installed - he needn't actually *do* anything with it... :-^

No educate the boss.

People making purchasing decisions should be told of the facts.

In the first ten years of the Linux project there was only one virus
found in the wild AFAIK. There have been several worms since but not so
many as to make it cost effective to try and deal with them
automatically (other than in better software patch distribution - "apt"
anyone?).

But at the levels of infection seen in the wild it is pointless to take
the kind of protection required on Windows servers.

Far better to take a holistic approach and install a fingerprinting
system, so you'll spot unauthorised changes be they viruses or humans
that make them.

It is important to paint the picture that both as an individual and as a
group the GNU/Linux community takes security seriously, which is why we
don't need poorly thought out sticking plaster solutions like antivirus
software.

Far better to close down the routes of infection - such as not executing
email attachments, firewalls that are enabled by the installer, services
that default off, diversity at all levels, and fix the software holes
exploited, than pray that your antivirus software gets updated before
the next nasty comes visiting.

The magic phrase is "zero day exploit" - anyone here been following the
latest IE vulnerability ;)
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Debian - http://enigmail.mozdev.org

iD8DBQFAyJMaGFXfHI9FVgYRArPTAKCaF53DxweyPWi5DtYV24hhWgHTZACeN5xC
6a5adTzImXLOp6N7bXo/klM=
=CKJe
-----END PGP SIGNATURE-----

--
The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.



Lynx friendly