.

AntiVirus Gateway

<<

MicroJay

User avatar

Full Member
Full Member

Posts: 101

Joined: Wed Feb 04, 2009 4:19 pm

Post Fri Mar 05, 2010 11:49 am

AntiVirus Gateway

Reaching out to anyone that may have an insight on this topic.  I have been asked to look for an AntiVirus Gateway.  There are so many options out there, but I am wondering if anyone has had better luck with one brand over another.  I would like to know which is better, or not so good, before making a purchase and find out later that I should have gone with Brand B instead of Brand A.

I have seen that most are bundled together as a UTM.  But we are looking for just a hardware based solution that scans all traffic (all ports) for virus/malware patterns and then block it (inline).  No other stuff needed to slow it down.  But - also give a report in realtime as to whom/where/what occured.  Obviously, definition updates are a must.

Any insight/thoughts and such would be appreciated.
Thank you!
GSEC - GCIH - GSNA - GPEN
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Fri Mar 05, 2010 8:49 pm

Re: AntiVirus Gateway

Are you looking for an SMTP / Exchange gateway anti-virus, a Web-proxy anti-virus, or both?  I have had limited experience with the Barracuda products that people swear by.  My experience with these devices has been primarily from an audit perspective. 

I've used GFI products, but they are not hardware based, and do not scale very well.  I am also noticing that many firewall vendors are offering gateway anti-virus add-ons.  This may be the way to go, if they scale well.  I have only used add-ons in small business environments though.  I would doubt the scalability. 
~~~~~~~~~~~~~~
Ketchup
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Fri Mar 05, 2010 11:01 pm

Re: AntiVirus Gateway

If your budget is unlimited, I'd consider TopChoice firewalls.  They are not specifically antivirus, but I think they integrate with someone or the other.  They are stupid fast and understand protocol grammar.  So much so that they were dropping MS08-067 (remember Conficker) packets before MS announced they had a problem.

Another option (but also very pricey) is McAfee sidewinder.  I knew a guy that worked for McAfee and they make a darn good product.  I have been rather unimpressed with their AV solutions in general, but a sidewinder demo has me convinced that they got the gateway solution right.
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk
<<

MicroJay

User avatar

Full Member
Full Member

Posts: 101

Joined: Wed Feb 04, 2009 4:19 pm

Post Sat Mar 06, 2010 1:58 pm

Re: AntiVirus Gateway

Great considerations.  I will look into these.  As for Barracuda, the Spam Firewall is all ready in place.  But they lost the HTTP protection when they chose to go to better web filter (for the filtering, it was a great choice).  So - I am definately looking for web and all other Internet traffic.

Any more suggestions would be a help.
Thanks!
GSEC - GCIH - GSNA - GPEN
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Sat Mar 06, 2010 9:54 pm

Re: AntiVirus Gateway

Oh, if you are willing to go with HTTP protection, I'd look at FireEye (http://www.fireeye.com/).  I don't personally implement this in my network, but would if I were given the choice.  They have awesome detection engines, a great database of "known bads" and virtualized (read VMWare) execution of unknown code so they know if a dropper is active.

I know two customers who said when they get a ticket from the appliance saying that a user just got malware on the machine, they don't need to check, they just reimage.  They just know its that good.

I don't think they do anything other than web protection, but if you are willing to implement more than one vendor for the total solution, I'd seriously consider them.
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk

Return to Malware

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software