Antivirus deployment considerations

Bandwidth – Consider the type and size of updates required. Virus definitions alone are relatively small downloads, but engine updates and other advanced capabilities are enabled by default and should be carefully reviewed and adjusted. It may not be feasible to update sites with very low bandwidth, so alternate solutions will be required. Consider training site staff to deploy updates to remote sites after the updates are tested and approved.

Single Points of Failure – If the availability of antivirus capabilities is a high-priority operational requirement, redundancy must be engineered into the antivirus deployment. Many leading antivirus applications support the redundant deployment of update deployment servers, whether through load-balancing or failover pairs. Alternately, the deployment of an update server at each of the major sites involved in the installation (for example, Main and Backup) can provide redundancy over Wide Area Network (WAN) connections in a failure situation while also minimizing the use of WAN links for high-bandwidth update pushes under normal operating conditions. Use of antivirus network appliances should be planned with the same considerations as any other network device.

1. In-line devices – An in-line network antivirus appliance acts as a pass-through for inbound and outbound data, forming a choke point on the network. This provides an optimal configuration for checking data, however, the failure of the device may impact the network. For this type of device, a failover pair of devices should be considered. If this option is not available, a fail-open device may be used, as it allows traffic to pass even if the device enters a fail state. This model still represents greater risk of data loss than maintaining multiple network paths.

2. Tap devices – These devices may function by connecting to a communications port on the network and listening to data as it passes by on the wire. These devices are not directly in-line and therefore, suffer some negative performance issues. However, their failure does not have a significant impact on normal system operations. If a redundant configuration is not appropriate, this type of device should be considered.

External network connectivity – many antivirus solutions are dependent upon access to external network resources to maintain their databases. As mentioned in the previous section, it’s best to use trusted internet proxies or Intranet-available servers to relay any necessary data from external sources. Any internet connection architecture should be planned with your system integration partner.