Server 2008 without antivirus

[Kooch]

We have a bunch of web servers that run Windows Server 2008. We've been experiencing downtime with our antivirus solution and I've really begun looking into running without. We don't allow surfing the internet from these machines or receiving email, and there is no uploading from web users. What I'm looking for is anyone who does this currently to maybe give me a rundown of what policies they've implemented to ensure security in the absence of antivirus. I'm thinking that as long as I ensure network security (disabling services, monitoring port usage, etc) I should be okay, or would I need Tripwire or something similar? What have you implemented and how successful has it been?

I know there's two major camps on the issue and I know the arguments for running with antivirus on our production servers, but I'm really interested in hearing how folks are managing without and what steps they've taken to make management happy when they're asked how they're ensuring security.

Thanks for any input!

 

[kmcferrin]

If you're not running anitvirus protection then there there's no way to protect yourself from viruses. Even running antivirus you still have a fair chance of getting something. There are enough security holes in any OS that you could still potentially be compromised. Good antivirus software won't just protect against viruses, but will also protect against worms. It doesn't matter if nobody ever logs onto the server, if someone on the network is accessing resources on the server then there is an infection vector.

Rather than trying to build a solution using a collection of policies, firewalls, and IDS systems the prudent move would be to just use antivirus software. To be honest, it would be a bit silly to implement all of those layers of security while leaving the most fundamental security software out.


________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCTS:Hyper-V
MCTS:System Center Virtual Machine Manager
MCTS:Windows Server 2008 R2, Server Virtualization
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator

 

[pagy]

I'll second kmcferrin on this. Another thing to add is if you are having problems with your AV solution get onto to their support people and ask politely/demand that it gets sorted or switch to another AV vendor.

What problems are you having? Maybe we could offer some solutions

Paul
VCP4

https://www.mcpvirtualbusinesscard.com/VBCServer/PaulP/profile

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week