Ironport WSA AV scanning

piotr.chrusciel — Wed, 20 Nov 2013 13:55:40 GMT

Hi Everynone.

Is there any information about maximum filesize that is scanned with antivirus engine in S170 and S370 ?

At the moment I compare WSA with other vendors. Some competitors claim that Ironport does not scan all downloaded objects. It only scans obcjects which were downloaded from sites with poor reputation. Even "good" sites can be infected and such approach can create security hole. Some vendors have dedicated hardware where all objects are scanned.

I also found an information that WSA can work in two modes : Maximum protection and High Performance

I wonder, what is the impact on a performance when WSA works in High Performance mode? Do anyone have any experience on that field (what is the latency, user experience) ?

Best Regards,

Piotr

Ironport WSA AV scanning

Vance Kwan — Thu, 21 Nov 2013 10:13:48 GMT

The maximum scannable file size is 32mb by default.

I have not heard of a Maximum Protection/High Performance mode. But it is true that the WSA only scans objects from netural/poor rated websites. Your concern about good rated websites containing malware is valid. But this is configurable. Obviously it will increase overhead due to the increased scanning of course.

topic Ironport WSA AV scanning in Web Security

Ironport WSA AV scanning

Ironport WSA AV scanning