Solved

Windows Server security/ Virus Definition update methods.

Posted on 2003-12-09
2
562 Views
Last Modified: 2010-04-11
Hello Everybody.

I have a question that is more methodical rather than purely technical, I hope tha is OK. My servers have been hit with a virus two months after we purchased many licenses for Norton AV.

(never installed it)

The previous version was running with outdated definitions prior to this. Since being hit by the new virus, we have applied the new AV software and definitions. NAV uses 'Live Update' to go out over the net and download newer virus definitions on a regular basis.

Now, coming from an IP network/ router background, my first inclination is cut these servers off from the internet, and allow only DNS & some higher level custom TCP ports through. I could possibly open a hole in my FW for LiveUpdate, or I could delegate the download function to a DMZish server from which the updates can be periodically pulled. (Or can't I?- does NAV support this?)

I know the dangers of treating every problem like it was a nail when the only tool you own is a hammer. Is this an appropriate network transport issue? What is the industry prevalent method of insulating servers from the internet and updating/verifying virus definitions?


/john
0
Comment
Question by:johndarpino
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 1

Accepted Solution

by:
NeilDavis earned 250 total points
ID: 9905695
We dont use live update for our AV servers.  Instead we use a batch file avaliable from symantec follow this link:

http://service1.symantec.com/SUPPORT/ent-security.nsf/d04e6f2f2dfad5de88256c910079502c/80e201e3738ae3cc88256c55004c28f4?OpenDocument&src=bar_sch_nam

I find the batch file works better and you can modify and run from a machine in you DMZ.
0
 
LVL 4

Expert Comment

by:MobileOakAI
ID: 9909659
We are going the same way, I think. FTP pattern to our server. Then, the clients are scheduled to check the server at regular intervals (use SAVROAM to locate server).  In case of trouble on network, other options including liveupdate from our client to our server is option, and we also stick it on our webserver, to cover anyone else, such as for a few laptops.

Do also a better job of getting updates from Microsoft.  They have weekly vulnerabilities and now should be only once a month downloads.  I'd guess that your servers got hit because they were short on an upgrade from Microsoft as well, and exploited. That is all too common these days.
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
Article by: Justin
In light of the WannaCry ransomware attack that affected millions of Windows machines, you might wonder if your Mac needs protecting. Yes, it does and here is how to do it.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question