I guess I'm not "telling" anyone anything, except which parameters
generally dictate best practices when considering system-wide scanning
strategy. Either way, "my" AV product is irrelevant to the question posed
-- and further qualified by a legitimate business problem -- which was
essentially "is this additional scan necessary with respect to all my other
defensive measures, AND the substantial overhead it consumes?". If I
thought the conclusion reached based on those parameters was a recipe for
disaster I wouldn't have offered such a reckless suggestion, especially
under my moniker.

Is schedule scanning "pointless"? In a perfect world, no. But as it
stands, its business value may decrease when all other things are
considered. It's just another risk calculation we all must face in this
topsy-turvy world, my friend, so I'm just offering it as I hope you would
take it: FWIW. No apologies necessary.

Kyle Moffitt
Sophos, Inc.

"Bruce Martins"
<BMartins@extend.
COM> To
<kyle.moffitt (at) sophos (dot) com [email concealed]>
12/29/2005 11:43 cc
AM <dfox168 (at) hotmail (dot) com [email concealed]>,
<focus-virus (at) securityfocus (dot) com [email concealed]>
Subject
Re: Do we still need scheduled
scan?

So your telling everyone that scheduled scanning is pointless because your
av products with real time scanning are perfect? That is recipe for
disaster, no impact on a user that isn't there running a full scan every
hour doesn't make sense either, using all of the capabilities of the
products is best and having a fall back layer of a scheduled full system
scan doesn't hurt, calling this costly is nothing compared to lost data or
downtime to the user and or network

Apologies if I misread your response as I am on the move at the moment
Bruce Martins
Systems Administrator
EXTEND>>MEDIA
190 Liberty Street
Toronto, Ontario
Canada
M6K 3L5
_______________________
e:bmartins (at) extend (dot) com [email concealed]
t: (416) 535-4222 ext. 2307
f: (416) 535-1201
http://www.extend.com
--------------------------
Sent from my BlackBerry Wireless Handheld

-----Original Message-----
From: kyle.moffitt (at) sophos (dot) com [email concealed] <kyle.moffitt (at) sophos (dot) com [email concealed]>
To: Bruce Martins <BMartins (at) extend (dot) COM [email concealed]>
CC: dfox168 (at) hotmail (dot) com [email concealed] <dfox168 (at) hotmail (dot) com [email concealed]>;
focus-virus (at) securityfocus (dot) com [email concealed] <focus-virus (at) securityfocus (dot) com [email concealed]>
Sent: Thu Dec 29 10:35:10 2005
Subject: Re: Do we still need scheduled scan?

This approach presumes updates are infrequent (> 1hr apart), and/or
innacurate or expensive proactive detection is employed. The cost/benefit
of relying on on-access scanning (esp. for client machines) vs. costly and
redundant scheduled scanning is almost always in the end user's favor.
FYI, best practices differ based on the engineering of AV software, and a
particular vendor's global response capability to emerging threats.
Suffice to say, no two AV are alike.

Kyle Moffitt
Sophos, Inc.

"Bruce Martins"
<BMartins@extend.
COM> To
<dfox168 (at) hotmail (dot) com [email concealed]>,
12/29/2005 09:59 <focus-virus (at) securityfocus (dot) com [email concealed]>
AM cc

Subject
Re: Do we still need scheduled
scan?

You should still run a scheduled scan sometimes things are missed in
between dat file updates, if you run the scan late at night there should be
minimal impact.
Bruce Martins
Systems Administrator
EXTEND>>MEDIA
190 Liberty Street
Toronto, Ontario
Canada
M6K 3L5
_______________________
e:bmartins (at) extend (dot) com [email concealed]
t: (416) 535-4222 ext. 2307
f: (416) 535-1201
http://www.extend.com
--------------------------
Sent from my BlackBerry Wireless Handheld

-----Original Message-----
From: Doug Fox <dfox168 (at) hotmail (dot) com [email concealed]>
To: focus-virus (at) securityfocus (dot) com [email concealed] <focus-virus (at) securityfocus (dot) com [email concealed]>
Sent: Wed Dec 28 17:28:04 2005
Subject: Do we still need scheduled scan?

If we have already implemented virus scan at the gateway, on the mail
server, on individual servers, and real time scan on workstations/laptops,
do we still need scheduled, e.g., weekly, scan on workstations and laptops
as well as servers?

Schdeuled scans really slow down some machines.

Any comments are appreciated.

Thanks,

Doug

--
Kyle Moffitt
Senior Account Executive, Sophos

Tel: 781 973 0110
Web: www.sophos.com
Sophos - integrated threat management

--
Kyle Moffitt
Senior Account Executive, Sophos

Tel: 781 973 0110
Web: www.sophos.com
Sophos - integrated threat management

[ reply ]