Anti-virus scanning is a critical part of protecting the corporate LAN from email viruses and other so-called 'malware' (such as scripts). Not only does does an anti-virus solution prevent downtime, but it also controls:
Near-sighted IT planning that does not include anti-virus scanning is bound for disappointment when you consider that no one is safe from email viruses without a virus scanner of some sort. The cost is small compared to the type of losses detailed above and their attendant soft and hard costs.
Scanning for viruses at the internet gateway is a smart move. You can't rely on desktop anti-virus to do the job since the anti-virus database on the desktop is often out of date. Also, if your corporate setup has the same AV product at the gateway and at the desktop there is no additional benefit in scanning email twice. Only if there are different anti-virus products at the desktop and gateway is there any additional benefit. Note, however, that recent tests by several testing labs have found that each of the major anti-virus scanners have weaknesses(1). Further, note that certification by some labs does NOT require anti-virus products to be 100% effective in all areas.
Since none of the anti-virus scanners catch all of the viruses it makes a huge amount of sense to take advantage of the strengths of more than one anti-virus engine. Let's take a look at the results we might expect if we combine two anti-virus products:
(note this table got messed up somewhere - I'm trying to find the original to recreate it)
Combined | |||
floppy disks)(on access) | 100.00% | 100.00% | |
(DOS, Win32)(on access) | 100.00% | 100.00% | |
(MS Office)(on access) | 100.00% | 100.00% | |
(JS, VBS)(on access) | 100.00% | 100.00% | |
Viruses | |||
69.39% | 100% | ||
97.18% | 100.00% | ||
99.72% | 100.00% | ||
100.00% | 100.00% | ||
99.92% | 100.00% | ||
100.00% | 100.00% | ||
99.88% | 100.00% | ||
38.46% | 100% | ||
Viruses | |||
89.27% | 100% | ||
JavaScript | 84.78% | 100.00% | |
92.12% | 100% | ||
75.00% | 100.00% | ||
MalWare | |||
Controls | 100.00% | 100.00% | |
76.76% | 100% | ||
(1) https://www.av-test.org/, https://www.icsalabs.com/, https://www.virusbtn.com
Copyright August 2003 Dirk Hart All rights reservedGot something to add? Send me email.
More Articles by Dirk Hart © 2009-11-07 Dirk Hart
It is the the duty of a Webmaster to allocate URIs which you will be able to stand by in 2 years, in 20 years, in 200 years. (Tim Berners-Lee)
Thank you for the information presented. We have been nailed waiting for our vendor to create a new pattern update for a fast moving virus. Running at least two AV products could only help.
Brian F.
---July 20, 2004
Mon May 1 15:07:33 2006: 1990 TonyLawrence
Kerio Mail Server can plug in multiple A/V scanners.
I do sell and support Kerio.
------------------------
Printer Friendly Version
Protecting corporate email by using multiple anti-virus scanners Copyright © August 2003 Dirk Hart
Have you tried Searching this site?
This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.
Contact us
Printer Friendly Version