#networkingninja

Written by: Chuck Shaleen

We had a very good session today on antivirus/malware issues.  Malware, which is short for malicious software, is the general term for computer threats. A virus, on the other hand, is a self-replicating program that infects other files. Although both terms are often used interchangeably, a virus is technically part of the malware family that includes trojans, worms and spyware.

We actually started with the latest news about the recent Microsoft Internet Explorer security threat (Heartbleed) that prompted Microsoft to issue a warning not use their browser.  Since then a patch has been delivered that has solved the problem and many of the participants have allowed IE to be used again, although the usage of alternative browsers will probably increase on a permanent basis.

A key take-away from the session is the advice that there is not one tool that can do it all. There are just so many threats that come from so many directions that most organizations are using at least two tools. One member even said they are using a four tier approach. The most commonly mentioned ones included  Sophos, Symantec End Point Protection, McAfee, TrendMicro, Kaspersky, Malwarebytes, ProofPoint, Mimecast and FireEye,

One tool that was given poor marks is Microsoft’s System Center Endpoint Protection.  Two members who tried MS SCEP as a Symantec replacement are going back to Symantec SEP. 

There were also several recommendations on the importance of user training.  As one participant stated, “What good does a lock do when somebody opens the door to anybody who knocks.”