As huge a fan of CSA as I am I would have to say that anti-virus is still needed. You can certainly lock down a machine with CSA to the point where virus infection would be next to impossible but in doing so, depending on your environment, you may make that same machine unusable on your network. As a general rule IT Security should be a layered approach starting with your edge routers and firewalls, continuing on into your inside routers and switches, IDS systems, AV programs, hardening and patching of the OS and lastly IPS programs such as CSA. There could always be a scenario where the rule set that a person has created fro CSA just happens to let that one virus through and then all the time, money and energy spent on CSA is wasted. Never discount the possibility of mis-configuration or that crafty end-users can dis-able CSA. They can and will if motivated and smart enough. I created a no music download policy and end users could not download or even save MP3s to their hard drives anymore. You best believe that some of the developers (brainiacs with too much time on their hands) found a way to dis-able CSA. I had to go back to the drawing board to lock them down again.
End-users are more often the enemy than a hacker and they can leave you wide open.
Well that is my sermon for the day. I hope the opinion (and this is just that..my opinion) shed some light on a few issues.
Please remember to rate all replies
