RE: Should webservers, eg. IIS 6 have anti--virus installed on them?

From: Brady McClenon (BMcClenon_at_uamail.albany.edu)
Date: 07/20/05

  • Next message: Harlan Carvey: "RE: Should webservers, eg. IIS 6 have anti--virus installed on them?" 
    Date: Wed, 20 Jul 2005 11:00:27 -0400
To: "Harlan Carvey" <keydet89@yahoo.com>, <focus-ms@securityfocus.com>

    If what I said was taken to be a cheap shot I apologize to all. It was
    meant to be a warning to never take the attitude that one is infallible,
    and perhaps I should have said "one" instead of "you", because that is
    what I meant. I did not mean to single any one person out.

    I'll digress a bit now and say this. No, an AV product is not a
    necessity on an IIS server, but then neither is a firewall. They are
    both just ways to minimize risk, and I can not see how anyone can oppose
    one and advocate the other. Would I recommend running IIS without
    either? No. If the added cost of either is too costly then let
    management make that call, but as a sys admin never rule out any
    security measure based on cost. If it bogs down your system, well then
    maybe adding exclusions will help or in the end you may have to go
    without and disable or uninstall it.

    What are we trying to protect ourselves from with AV? Well, except for
    the obvious viruses, worms and trojan horse answer, which seems
    smartass, I do know. What's the next threat going to be? No one knows
    that either. My system is fully patched and properly secured. Why do I
    need AV? Why do I need a firewall? Answer: To minimize risk against
    what you, or your product vendor didn't see coming, or the vulnerability
    that is discover and disclosed to the public before a patch, or other
    solution was released or found. Yes, they are both band-aid approaches,
    but sometimes band-aids is all you have. AV software, firewalls, IDS
    systems, (I'm sure more could be named but I'm drawing a blank).
    They're all really band-aid approaches. If we could guarantee the
    security of our systems, none of them are needed. Unfortunately, we can
    not.

    I also think it's being lost that a lot of web servers are not single
    admin, or a group of admin/developers posting content. I work in
    academia and know a few other colleges that use IIS to give student
    space to create their own personal web page. Many ISPs give clients
    space too. Can it honestly be said that these admins don't need to
    install an AV client, or that it might be a good idea?

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Harlan Carvey: "RE: Should webservers, eg. IIS 6 have anti--virus installed on them?"

    Relevant Pages

    • admin
      ... Would you teach me how to prevent a bot that is trying to login as Admin to ... IIS every second for couple hours please? ... The firewall doesn't seem to do anything. ...
      (microsoft.public.windows.server.security)
    • Re: Should I still buy SBS 2003 Premium w/ ISA in light of XP SP2s ICF2?
      ... Admin rights is a very simple story. ... relying upon the firewall to block accordingly the access to workstations, ... don't have the same level of packet-filtering in your favor that ISA ...
      (microsoft.public.windows.server.sbs)
    • RE: Hacking to Xp box
      ... and an admin with knowledge of their environment would be able ... I think there was a misunderstanding in the firewall point: ... > restricts most of the attacks that use anonymous connections. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • Help with Interactions between IISadmin mmc and FP2003
      ... I'm a relative newbie to IIS and Frontpage, but I am a long time IT ... and I have done a bit of web site publishing admin using ... The latter, "My Webs", folder would mirror ...
      (microsoft.public.frontpage.client)
    • Re: I was hacked
      ... Only me noticing that the requests seemed to come from a LAN? ... To secure IIS somewhat, remove all the virtual directories even if they are ... > Do you have some kind of application level firewall on this machine? ... a series of attempts to attack IIS that the IIS log claimed were coming ...
      (microsoft.public.inetserver.iis.security)