I’m not here to discuss which vendor’s product is better than another. I am simply looking for information on good security metrics and practices.
Auditors are always interested in uncovering failures in automated systems and how to mitigate them. This is not a a bad thing for sure. However, what would a good measurement be for out of date anti-virus coverage on a population of computers in a global company? For example, if there are 5000 computers on a company’s network and all AV signatures are within the past 3 days on 90% of the computers, would you feel that the environment is adequately covered? What about the 10% that may have AV signatures more than a week old? How do you suggest mitigation for those computers in your environment and is 10% too high or is it really a good number?
Thanks for your feedback.