Is Antivirus Software Now Dead?

The debate about whether antivirus software is still useful has been going on for a few years now. This technology was once the mainstay of the security efforts for most businesses and home users. The challenge of late is the ability of these products and their providers to keep up with the rapidly changing threat landscape. 

The team at the Defensive Security Podcast have pointed out, this debate was renewed once again by Darren Bilby speaking at Kiwicon, who said, "We need to stop investing in those things we have shown do not work." He stated his position even more succinctly when he said: "No more magic."

Antivirus technology is probably older than most think, having been created in an early form in 1987 by developers who would curiously also go on to produce a virus authoring kit (perhaps renewing the old humorous urban legend about antivirus companies producing viruses to keep themselves in business).

While the technology has improved over the years, its basic approach has always remained the same. It looks at incoming data from downloads, removable media and other sources for patterns of characters, called signatures, which are known to indicate a malicious file. When identified, any such files are quarantined to prevent compromise of the system. The database of known signatures is updated frequently to account for new signatures. 

For many years, this antivirus approach was effective in preventing the compromise of many endpoints. The math was simple, antivirus companies could identify a new malware entity, and get their signatures updated more quickly than the typical malware could make it across the internet. 

Unfortunately, two major factors have greatly diminished the effectiveness of antivirus technology. 

First, malware can traverse the internet at a rate nobody ever imagined was possible. Today, a new virus can become widespread on the internet before the antivirus vendors even know it exists. 

Second, virus authors have learned to produce variants, which are version of their illicit programs that function the same way, but have deliberate changes in their signature to evade antivirus programs. Because much of our malware is now distributed in kit form, even a novice can produce a malware variant and get it out on the internet very quickly. 

While the value of antivirus software has been diminishing for some time, it was arguably pushed over the edge by ransomware, which, by some recent estimates, evades 100% of antivirus systems, owing its success to the rapid succession of new variants. 

So, is traditional antivirus software dead? Microsoft for one does not seem to think so. While many vendors could be accused (rightly or otherwise) of supporting this technology (effective or not) to continue reaping revenue from it, Microsoft gives the technology away in the form of Windows Defender, and continues to enhance and upgrade its product. Many other vendors have been incorporating behavioral analysis and other techniques into their products to enhance them. 

One of the best arguments for antivirus software is the fact that many infections come from old malware. Once a malware package hits the internet, there is no good way to completely remove it. The same malware, unaided by its author, can continue to show up for years. 

Given all of the facts, I continue to believe that antivirus software, despite its limitations, has a place in our defensive strategy -- but just as part of that strategy. Other players should include: 

Whitelisting: Somewhat the reverse of the antivirus signature approach. This technology only allows known good programs to run, and prevents the execution of anything else. This approach can be a challenge to manage, but offers greatly increased endpoint protection. 

Sandboxing or containerisation: This approach causes attachments or links, which usually carry the malware's payload, to be opened in an isolated virtual environment on a PC, containing any damage to the PC. 

Behavioral analysis: This approach looks at the patterns of behavior of malware, rather than the signatures. For example, since ransomware will quickly begin to encrypt files, behavioral analysis can recognize that an abnormal number of files are changing in a short time, and shut down the related process. 

Privilege restriction: In order to install itself on an endpoint, a malware program runs on an endpoint where the user has the privilege to install programs. If most end users are denied the privilege to install programs themselves, most malware will not run. 

Remote detonation: This is a similar approach to sandboxing, except that the attachment is opened on an isolated remote system, containing any damage before it reaches the user endpoint. 

Bottom line: Even as promising new technologies for malware detection and prevention hit the market, bad actors are working hard to find ways around them. As such, we must continue with an arsenal of tools, including antivirus, to have the best chance to beat the hackers.

ComputerWorld:       Common Cyber Threats You Need To Be Aware Of (£):
 

 

« Malicious Ads Expose Millions To Hacking
The Snowden Films - Spirit of the Whistleblower »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Mocana

Mocana

Mocana provides a software platform that allows you to develop, test and distribute more secure IoT devices and services.

Lockton

Lockton

Lockton is the world’s largest privately owned insurance brokerage firm. Commercial services include Cyber Risk insurance.

Cleafy

Cleafy

Cleafy are a team of fraud hunters, cybersecurity experts, data scientists, and software engineers. Our purpose is to make people’s life easier and free from the threats in the digital ecosystem.

Centre for the Protection of National Infrastructure (CPNI)

Centre for the Protection of National Infrastructure (CPNI)

CPNI works with the National Cyber Security Centre (NCSC), Cabinet Office and lead Government departments and agencies to drive forward the UK's cyber security programme to counter cyber threats.

Cyanre

Cyanre

Cyanre delivers state of the art cyber forensic services through software technologies and procedures that exceed conformities of major law enforcement agencies across the globe.

Rewertz

Rewertz

Rewterz is a cyber security company based out of Dubai, serving customers in UAE, Oman, Qatar, Bahrain, Saudi Arabia, and Pakistan.

Redstor

Redstor

Redstor's complete data management helps you discover, manage and control your data from a single control centre, unifying backup and recovery, disaster recovery, archiving and search and insight.

IoT M2M Council (IMC)

IoT M2M Council (IMC)

The IMC is the largest and fastest-growing trade organisation in the IoT/M2M sector.

01 Communique Laboratory

01 Communique Laboratory

01 Communique Laboratory is an innovation leader in the new realm of Post-Quantum Cyber Security.

Quantum Star Technologies

Quantum Star Technologies

Quantum Star Technologies has developed Starpoint to be a next-next-generation solution to cyber security threats. Our mission is to secure the online world through our patented technology.

Bluefin Payment Systems

Bluefin Payment Systems

Bluefin is the recognized integrated payments leader in encryption and tokenization technologies that protect payments and sensitive data.

WireGuard

WireGuard

WireGuard is a communication protocol and free and open-source software that implements encrypted virtual private networks (VPNs).

Iolo

Iolo

Iolo develops patented technology and award-winning software that repairs, optimizes, and protects computers, to maximize system speed and performance while keeping them safe.

CoGuard

CoGuard

CoGuard is a patented solution that uses AI driven automation to provide fast, cost effective white-box penetration testing, infrastructure audits and infrastructure design services.

Clear Ridge Defense

Clear Ridge Defense

Clear Ridge was founded in April 2015 with the mission and vision to support Joint, Service Cyber Components, and commercial clients in specialized cyber support.

Triovega

Triovega

Triovega are a leading provider for production security and efficiency. Our solutions enhance OT security, and reduce production downtime.