The Anti-virus Times

Tuesday, June 26, 2018

A conventional anti-virus on a PC or smart phone will prevent malicious code from being downloaded or launched. And if a traffic scanning component has been installed, it will protect applications from code-injection attacks that exploit unpatched vulnerabilities (e.g., through nefarious images, something we’ve discussed at length in several Anti-virus Times issues)—the anti-virus will prevent Trojans from meddling with vulnerable programs.

But sometimes an anti-virus can't be installed on all potentially vulnerable devices in a corporate environment. Therefore, companies are recommended to adopt server anti-virus solutions to protect their networks. Anti-viruses for mail servers and gateways scan inbound traffic before it is processed by PCs, servers and other devices. When anti-virus security is organised this way, the applications on these computers are protected from attacks leveraging unknown or unpatched vulnerabilities.

In this case, a typical security schematic will look like this:

However, a mail server or Internet gateway may also have vulnerabilities! Here is a recent news post:

A remote code execution vulnerability exists in Microsoft Exchange software whereby the software fails to properly handle objects in the memory. An attacker who has successfully exploited the vulnerability could run arbitrary code in the context of a System user. An attacker could then install programs; view, change, or delete data; or create new accounts.

A security update patching the loophole has already been released, but:

• We all remember how "often" updates are applied on server machines;
• If one vulnerability was discovered, more will follow.

And our recommended security schematic becomes more complex. Naturally, the anti-virus for Internet gateways will always be the first to scan inbound traffic. However, an anti-virus mail gateway (SMTP proxy) can be employed to scan the data flow before it reaches the mail server. The anti-virus SMTP proxy facilitates in-depth mail-traffic analysis. It has many advantages, but in our case protecting the mail server is its principal task.