[photonthug]

serious question, does anyone really think Linux antivirals are good or necessary, particularly if they are active measure kernel things and not just passive scanners?

I have only seen people use them when windows it departments suddenly have to pretend to be cloud savvy, or when enterprisey infosec teams are looking for more vendors to bloat up their budgets. If it’s written in contracts, it’s not the customers demanding av on ephemeral cloud servers, it’s the home team bloating costs so they can cut them later for a raise and applause.

Aaaand whenever it goes that way, antivirals affect performance and stability with random problems, always hurting more than they help

[whalesalad]

Nine times out of ten it’s not even for security it’s for checking some kind of auditing compliance box. We’re perpetuating this nightmare quagmire of shit and no one understand how it works.

[photonthug]

Any details on what compliance regime specifically requires it for Linux tho, and whether it differentiates static servers from ephemeral? I’m just curious since you always hear “compliance” but I’ve never actually seen the requirement coming from anywhere except windows sysadmins who are out of their element

[whalesalad]

Part of the issue is that compliance is so broad and will vary from industry to industry, state to state and country to country. If you’re in defense and work with the government you’re requirements will be different versus healthcare or the education sector.

The baseline is NIST guidelines but even that is a huge can of worms. It’s difficult to simply say “yes we’re compliant” especially in large organizations. https://www.cuicktrac.com/nist-compliance/nist-800-171-compl...

A lot of orgs get overwhelmed by this, and so they outsource the effort to a third party.

[1970-01-01]

Here's one

https://www.stigviewer.com/stig/canonical_ubuntu_16.04_lts/2...