>> My point is, that's 144 hours between the virus being released and the 
>> virus definition being released. An extra 24 hours before the server 
>> picks up the new definition seems quite trivial by conparison. The 
>> virus has already had plenty of time to wreck your entire network, 
>> long before the AV vendor has anything to offer you...
> 
> Probably not, as I doubt the person who released the virus aimed it 
> straight at your network.  Likely it took several days to build up 
> worldwide before it got into your network somehow.

Maybe you'll be unlucky. Most likely you won't. Either way, shaving 4 
hours off the window of opportunity seems a little moot when the window 
is theoretically hundreds of hours wide to start with, that's all.

>> [Ooo... the thought of 50 machines all trying to hit the same server 
>> onc per second over a 2 MB Internet link... that's not even funny.]
> 
> Try having just one machine check and download the updates, then deal 
> them out to everyone on your network.  That's how we do it here, as you 
> say, seems kinda stupid to have all your machines all downloading the 
> same software from the same place the whole time, especially with a 
> limited network link.

Yes, our current solution does that, and hopefully the new software will 
eventually be configured that way too. (It requires updating a server to 
a newer version of Windows.)

As I said to Gail, our current AV solution tries to update once per day, 
which is 7x more often than the actual update release frequency. Seems 
fine to me. I don't know how often (if at all) our new provider releases 
these things...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message