Protecting corporate email by using multiple anti-virus scanners

By Dirk Hart
Adanac Software
Email: dhart@mailstarusa.com
Web Site: MailStarUSA.com

Anti-virus scanning is a critical part of protecting the corporate LAN from email viruses and other so-called 'malware' (such as scripts). Not only does does an anti-virus solution prevent downtime, but it also controls:

• Loss of business continuity
• Loss of confidentiality
• Loss of data
• Actual loss of hardware
• Loss of revenue
• Loss of productivity

Near-sighted IT planning that does not include anti-virus scanning is bound for disappointment when you consider that no one is safe from email viruses without a virus scanner of some sort. The cost is small compared to the type of losses detailed above and their attendant soft and hard costs.

Scanning for viruses at the internet gateway is a smart move. You can't rely on desktop anti-virus to do the job since the anti-virus database on the desktop is often out of date. Also, if your corporate setup has the same AV product at the gateway and at the desktop there is no additional benefit in scanning email twice. Only if there are different anti-virus products at the desktop and gateway is there any additional benefit. Note, however, that recent tests by several testing labs have found that each of the major anti-virus scanners have weaknesses⁽¹⁾. Further, note that certification by some labs does NOT require anti-virus products to be 100% effective in all areas.

Since none of the anti-virus scanners catch all of the viruses it makes a huge amount of sense to take advantage of the strengths of more than one anti-virus engine. Let's take a look at the results we might expect if we combine two anti-virus products:

(note this table got messed up somewhere - I'm trying to find the original to recreate it)

			Combined
floppy disks)(on access)		100.00%	100.00%
(DOS, Win32)(on access)		100.00%	100.00%
(MS Office)(on access)		100.00%	100.00%
(JS, VBS)(on access)		100.00%	100.00%
Viruses
		69.39%	100%
		97.18%	100.00%
		99.72%	100.00%
		100.00%	100.00%
		99.92%	100.00%
		100.00%	100.00%
		99.88%	100.00%
		38.46%	100%
Viruses
		89.27%	100%
JavaScript		84.78%	100.00%
		92.12%	100%
		75.00%	100.00%
MalWare
Controls		100.00%	100.00%
		76.76%	100%

Clearly we can expect a much better result than if we used just one anti- virus scanner. An outside service such as MailStarUSA.com might well provide an immediate and inexpensive solution. The scanner in use at MailStarUSA is F-Prot which provides a good fit with the more common Norton Anti-Virus on individual desktops or McAfee in corporate environments. Configuration is as simple as a change to your domains MX record to point mail to MailStarUSA. MailStarUSA scans each email and passes it on to your existing email server. Corporate mailservers can be configured to ONLY accept mail from MailStarUSA for added security. Alternatively MailStarUSA can provide SMTP, POP3 and Webmail services in which case you don't need a mailserver at all - and your mail still gets checked once before it hits your desktop and again at your gateway or desktop.

(1) http://www.av-test.org/, http://www.icsalabs.com/, http://www.virusbtn.com

Copyright August 2003 Dirk Hart All rights reserved

More Articles by Dirk Hart

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.