This white paper examines why having multiple anti-virus scanners at mail server level substantially reduces the chance of virus infection and explores ways in which this can be achieved.
Why one virus engine is not enough
Multiple virus engines are needed to reduce time lag between virus outbreak and signature update
There is no single anti-virus engine on the market today that is always the fastest and most effective at identifying viruses, trojans and other threats. This white paper examines why having multiple anti-virus scanners at mail server level substantially reduces the chance of virus infection and explores ways in which this can be achieved.
WWW.GFI.COM Why one virus engine is not enough . 2
Introduction It is a well known fact that viruses, trojan horses, worms, spam, and other forms of malware present a real threat to all modern-day organizations and affect productivity and business operations negatively. According to the 2006 FBI Crime and Security Survey, 97% of organizations have anti-virus software installed, yet 65% have been affected by a virus attack at least once during the previous 12 months. Network World cited studies that placed the cost of fighting Blaster, SoBig.F, Sober and other email viruses at $3.5 billion for US companies alone. Similarly a 2006 study by the British government found that 43% of companies in the United Kingdom were infected by viruses during 2005.
Responsible organizations agree that they need to protect their network from virus attacks by installing an email security product. Yet malicious code is becoming more sophisticated and is advanced everyday as virus writers hone their skills and sharpen their code to stay one-step ahead of virus detection methods, penetrating anti-virus and firewall solutions with alarming regularity. The success of these viruses is, to a large part, linked to the flawed logic and inherent weakness of protection strategies that are based on a single scanning engine to assess the threat of incoming files.
This white paper explains why the answer to the question: "Is one anti-virus engine enough to protect the internal network from mass-mailing viruses, worms and other email-borne threats?" - is an emphatic "NO!" It also examines the need for multiple anti-virus engines to reduce the average response time to a virus outbreak, and thus reduce the chance of having your network infected. The use of multiple virus engines also enables security administrators to be vendor-independent when it comes to virus scanning, thereby able to use the best of breed virus engines available on the market
Introduction....................................................................................................................................2 The need to have a fast response time.........................................................................................2 Case study: Response to the Worm/Sober virus ..........................................................................3 The need for blending technologies ..............................................................................................4 The case for multiple anti-virus engines........................................................................................5 A new paradigm and strategy........................................................................................................6 About GFI MailSecurity for Exchange/SMTP ................................................................................6 About GFI ......................................................................................................................................7
The need to have a fast response time One of the most important factors in the successful protection of your network against viruses is how fast you get new virus engine signature files - those files released by anti-virus labs that help to identify a virus when there is a virus outbreak. Email allows viruses to be spread at
WWW.GFI.COM Why one virus engine is not enough . 3
lightning speed in a matter of hours, and a single email virus is enough to infect your whole network. Obviously then, a critical factor is how fast the signature files of your anti-virus solution are updated when a new virus emerges. In every virus attack there is a time differential between the outbreak of the new virus and the ... [download for more]
