Everything Else

So far, this chapter has focused solely on protecting your messaging system against viruses. Because this book is about messaging security, that’s perfectly normal. However, there are certainly some other things to consider when planning your antivirus strategy, listed next. Some of them fall under the rubric of security and risk analysis, so you can refer to Chapter 4, “Threats and Risk Assessment,” for help in figuring out how to assess and quantify risks.

1. If a new virus was released, how long would it take you to protect yourself from it? If you have operations in multiple time zones, this might work in your favor; several recent outbreaks have started outside North America, giving administrators based in the United States, Canada, and Mexico a head start in securing their systems.

2. What protective measures are you willing to take? Some large companies simultaneously shut down all of their Windows-based servers during the CodeRed outbreak a few years ago because that was the only way they could ensure that all of their servers were disinfected. At a minimum, you should consider turning off inbound and outbound mail if a mail-borne outbreak catches you. Other measures (like isolating infected servers) are worth looking into.

3. If you actually got a virus infection, how long would it take you to notice? If your vendor offers you a way to get notifications of new viruses, are you taking advantage of it? At what interval are you updating your antivirus signatures?

4. If stricken by an infection, how would you recover? Remember that the consensus best practice in the antivirus community is to reload from backup, not to try to disinfect affected systems or data. Would you be able to rebuild affected servers in a timely manner? How would losing messages since the last backup affect your business?