Interesting Tid Bit from Microsoft... (paraphrased)

Antivirus software is required for all client computers, no matter what. Even when you don't have a budget for it, find an antivirus solution.

Tony Northrup, "70-298 Designing Security for a Microsoft Windows Server 2003 Network" © 2005, Microsoft Press.

This is so very true. It's not everything though. Five years ago, I had my own web site running on a little Dimension L933r machine under Windows 2000 Pro and IIS 5 (I believe it was) -- all via a cable modem and IP address for the URL. It hosted a simple website and that was it. I didn't keep it running for very long, since when I moved up to college, hosting a web site was not permitted.

So, I disabled IIS, but left it installed. That way, when I went home for break, I could just start up my website again. Within a month of living on campus, I was hit with some virus (Code Red or Nimda... It's hard to remember anymore, but it as some big name virus/worm at the time). The "virus" got on to my system, which was regularly updated with a virus scanner at the time. The school itself was protected by a firewall or two, but the computers had registered IP addresses (in the 158.x.y.z range).

The virus I got was contained by my antivirus (Norton, I believe it was at the time) - but it got into the system because of some aspect of IIS -- since it was still installed, just not running. So, I uninstalled it, keeping my IIS folders, including the "wwwroot" folder - so I could install IIS later, and just resume my website activities.

Over two years later, several HDDs, and transportation to a different computer - I was hit with another virus! This one infected some of my IIS scripts that were saved when I uninstalled IIS -- and got past my new antivirus software and my firewall. After getting rid of the virus, I went and deleted all non-website related files that I didn't really need installed. So far, so good. But even with antivirus software installed, a running client side firewall, a corporate firewall, and all the Windows Updates - it was still quite easy to get infected.

Now - I run Linux. Less updates, less viruses. Gotta love the good life.

Now, I just need to figure out what to talk about for my security class "midterm presentation" that I have to do.