| Re: Sophos AV - why am I paying for this? [message #122225 is a reply to message #122104] |
Mon, 22 June 2015 17:52   |
Maerad
Messages: 275
Registered: August 2013
|
|
|
|
Sophos works fine. The clients (especially ESET) find the virus, because they have something called heuristic. They also don't have the virus in their database, BUT they analyze the behavior/coding if its has virus like usage patterns and do a "best guess".
99% of my known antivirus systems for mailservers work with virus lists, not heuristics. On a client you SEE that the antivirus found something and can decide what to do. In a mail, you get - in best cases - just a warning and no attachment. And if THAT was some really important program someone was waiting for and it got deleted by a false positive .... wohoooo!
Also if it's a new virus, it's quite common that 95% of all scanners won't find a thing. Last time I had a virus I uploaded non virustotal and 2 other sites - not ONE scanner detected it as a virus. After 3 hours 2 scanners found the virus.
You can't relay on a scanner alone. You need mail protection and client protection. IF the clients can kill the virus the mailserver didn't find, everythings ok, because that's what its there for.
We never had any problems with viruses. First a bit more aggressive spam rules (most viruses are sent like spam mails), then the sophos protection, then the client protection and MOST important - A KNOWING USER! I school any new worker and 1x a year (or with mail in important cases), so THEY know what they are doing.
That with enabled extentions on windows files protected us more then any antivirus. And we had Panda, Avira, ESET, Micro...thing...., Kaspersky etc.
Nothing was 100% secure. But if the user knows what to open and what not or/and when to ask, it's fine.
You don't need one antivirus program, you need a security and antivirus strategy for your company
|
|
|
|
Members
Search
Help
Register
Login
Home
