D-Link DFL-210 - NetDefend - Security Appliance, User Manual

Page: 261 / 469

NetDefendOS Anti-Virus scanning is implemented by D-Link using the "SafeStream" virus
signature database. The SafeStream database is created and maintained by Kaspersky, a company
which is a world leader in the field of virus detection. The database provides protection against
virtually all known virus threats including trojans, worms, backdoor exploits and others. The
database is also thoroughly tested to provide near zero false positives.
Database Updates
The SafeStream database is updated on a daily basis with new virus signatures. Older signatures are
seldom retired but instead are replaced with more generic signatures covering several viruses. The
local NetDefendOS copy of the SafeStream database should therefore be updated regularly and this
updating service is enabled as part of the subscription to the D-Link Anti-Virus subscription.
6.4.5. Subscribing to the D-Link Anti-Virus Service
The D-Link Anti-Virus feature is purchased as an additional component to the base D-Link license
and is bought in the form of a renewable subscription. An Anti-Virus subscription includes regular
updates of the Kaspersky SafeStream database during the subscription period with the signatures of
the latest virus threats.
6.4.6. Anti-Virus Options
When configuring Anti-Virus scanning in an ALG, the following parameters can be set:
1. General options
Mode This must be one of:
A. Disabled - Anti-Virus is switched off.
B. Audit - Scanning is active but logging is the only action.
C. Protect - Anti-Virus is active. Suspect files are dropped and
logged.
Fail mode behavior
If a virus scan fails for any reason then the transfer can be dropped or
allowed, with the event being logged. If this option is set to Allow then
a condition such as the virus database not being available or the
current license not being valid will not cause files to be dropped.
Instead, they will be allowed through and a log message will be
generated to indicate a failure has occurred.
2. Scan Exclude Option
Certain filetypes may be explicitly excluded from virus-scanning if that is desirable. This can
increase overall throughput if an excluded filetype is a type which is commonly encountered in a
particular scenario, such as image files in HTTP downloads.
NetDefendOS performs MIME content checking on all the filetypes listed in Appendix C, Verified
MIME filetypes to establish the file's true filetype and then look for that filetype in the excluded list.
If the file's type cannot be established from its contents (and this may happen with filetypes not
specified in Appendix C, Verified MIME filetypes) then the filetype in the file's name is used when
the excluded list is checked.
3. Compression Ratio Limit
When scanning compressed files, NetDefendOS must apply decompression to examine the file's
contents. Some types of data can result in very high compression ratios where the compressed file is
a small fraction of the original uncompressed file size. This can mean that a comparatively small
6.4.5. Subscribing to the D-Link
Anti-Virus Service Chapter 6. Security Mechanisms
261