Re: Ransomware on Power

[Steve Pitcher <SPitcher@xxxxxxxxxxxx>]

The good doctor summed up my reasoning exactly. 

Steve


> On Jan 21, 2021, at 7:04 PM, Larry DrFranken Bolhuis <midrange@xxxxxxxxxxxx> wrote:
>
> I will tell you why *I* don't like it. (And I agree with Steve by the way.)
>
> FIRST it means you have to share the entire IFS or you can't scan it. That alone should scare you.
>
> Further, if you want the AV program to be able to fix the files then the scan AND the user running the scan needs to be able to write to your entire IFS. That gives me the heebie jeebies just writing it!
>
> SECOND it's a ton of I/O to read every file on there and guess what, the vast majority of them didn't change so why do that every day?
>
> THIRD it's a 'how often' scan? Once a day? So if you have a file in there that's updated 8 seconds after the daily scan it's sitting there contagious for nearly 24 hours before it gets caught. AND if you make the scan more frequent you just make the I/O load worse and worse.
>
> IBM Provides tooling to enable virus scanning at write time. Fabulously better idea. Do that.
>
>    - L
>
>
> > On 1/21/2021 5:38 PM, Patrik Schindler wrote:
> > Hello Steve,
> > > Am 21.01.2021 um 21:05 schrieb Steve Pitcher <SPitcher@xxxxxxxxxxxx>:
> > > Scanning the IFS with a Windows AV tool is bad news. Don’t. Bad idea and should be ignored.
> > I’m interested in your reasoning about your statement.
> > :wq! PoC
>
> -- 
> IBM Champion for Power Systems
>
> www.iInTheCloud.com - Commercial IBM i and Power System Hosting
> www.iDevCloud.com - Personal IBM i Hosting
> www.Frankeni.com - IBM i and Power Systems Consulting.
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com