ZyXEL ZyWALL ATP700 User Guide - Page 585

Chapter 27 Anti-Malware 1 A computer gets a copy of malware from a source such as the Internet, email, file sharing or any removable storage media. The malware is harmless until the execution of an infected program. 2 The malware spreads to other files and programs on the computer. 3 The infected files are unintentionally sent to another computer thus starting the spread of the malware. 4 Once the malware is spread through the network, the number of infected networked computers can grow exponentially. Types of Anti-Malware Scanner The section describes two types of anti-malware scanner: host-based and network-based. A host-based anti-malware (HAM) scanner is often software installed on computers and/or servers on the network. It inspects files for malware patterns as they are moved in and out of the drive. However, host-based anti-malware scanners cannot eliminate all malware for a number of reasons: • HAM scanners are slow in stopping malware threats through real-time traffic (such as from the Internet). • HAM scanners may reduce computing performance as they also share resources (such as CPU time) on the computer for file inspection. • You have to update the malware signatures and/or perform malware scans on all computers on the network regularly. A network-based anti-malware (NAM) scanner is often deployed as a dedicated security device (such as your Zyxel Device) on the network edge. NAM scanners inspect real-time data traffic (such as email messages or web) that tends to bypass HAM scanners. The following lists some of the benefits of NAM scanners. • NAM scanners stop malware threats at the network edge before they enter or exit a network. • NAM scanners reduce computing loading on computers as the read-time data traffic inspection is done on a dedicated security device. ZyWALL ATP Series User's Guide 585