Is Antivirus Software Now Dead?

The debate about whether antivirus software is still useful has been going on for a few years now. This technology was once the mainstay of the security efforts for most businesses and home users. The challenge of late is the ability of these products and their providers to keep up with the rapidly changing threat landscape. 

The team at the Defensive Security Podcast have pointed out, this debate was renewed once again by Darren Bilby speaking at Kiwicon, who said, "We need to stop investing in those things we have shown do not work." He stated his position even more succinctly when he said: "No more magic."

Antivirus technology is probably older than most think, having been created in an early form in 1987 by developers who would curiously also go on to produce a virus authoring kit (perhaps renewing the old humorous urban legend about antivirus companies producing viruses to keep themselves in business).

While the technology has improved over the years, its basic approach has always remained the same. It looks at incoming data from downloads, removable media and other sources for patterns of characters, called signatures, which are known to indicate a malicious file. When identified, any such files are quarantined to prevent compromise of the system. The database of known signatures is updated frequently to account for new signatures. 

For many years, this antivirus approach was effective in preventing the compromise of many endpoints. The math was simple, antivirus companies could identify a new malware entity, and get their signatures updated more quickly than the typical malware could make it across the internet. 

Unfortunately, two major factors have greatly diminished the effectiveness of antivirus technology. 

First, malware can traverse the internet at a rate nobody ever imagined was possible. Today, a new virus can become widespread on the internet before the antivirus vendors even know it exists. 

Second, virus authors have learned to produce variants, which are version of their illicit programs that function the same way, but have deliberate changes in their signature to evade antivirus programs. Because much of our malware is now distributed in kit form, even a novice can produce a malware variant and get it out on the internet very quickly. 

While the value of antivirus software has been diminishing for some time, it was arguably pushed over the edge by ransomware, which, by some recent estimates, evades 100% of antivirus systems, owing its success to the rapid succession of new variants. 

So, is traditional antivirus software dead? Microsoft for one does not seem to think so. While many vendors could be accused (rightly or otherwise) of supporting this technology (effective or not) to continue reaping revenue from it, Microsoft gives the technology away in the form of Windows Defender, and continues to enhance and upgrade its product. Many other vendors have been incorporating behavioral analysis and other techniques into their products to enhance them. 

One of the best arguments for antivirus software is the fact that many infections come from old malware. Once a malware package hits the internet, there is no good way to completely remove it. The same malware, unaided by its author, can continue to show up for years. 

Given all of the facts, I continue to believe that antivirus software, despite its limitations, has a place in our defensive strategy -- but just as part of that strategy. Other players should include: 

Whitelisting: Somewhat the reverse of the antivirus signature approach. This technology only allows known good programs to run, and prevents the execution of anything else. This approach can be a challenge to manage, but offers greatly increased endpoint protection. 

Sandboxing or containerisation: This approach causes attachments or links, which usually carry the malware's payload, to be opened in an isolated virtual environment on a PC, containing any damage to the PC. 

Behavioral analysis: This approach looks at the patterns of behavior of malware, rather than the signatures. For example, since ransomware will quickly begin to encrypt files, behavioral analysis can recognize that an abnormal number of files are changing in a short time, and shut down the related process. 

Privilege restriction: In order to install itself on an endpoint, a malware program runs on an endpoint where the user has the privilege to install programs. If most end users are denied the privilege to install programs themselves, most malware will not run. 

Remote detonation: This is a similar approach to sandboxing, except that the attachment is opened on an isolated remote system, containing any damage before it reaches the user endpoint. 

Bottom line: Even as promising new technologies for malware detection and prevention hit the market, bad actors are working hard to find ways around them. As such, we must continue with an arsenal of tools, including antivirus, to have the best chance to beat the hackers.

ComputerWorld:       Common Cyber Threats You Need To Be Aware Of (£):
 

 

« Malicious Ads Expose Millions To Hacking
The Snowden Films - Spirit of the Whistleblower »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

SmartSearch

SmartSearch

SmartSearch is a leading online provider of Anti-Money Laundering and Fraud Prevention Services.

Nixu

Nixu

Nixu is the largest Nordic specialist company in information security consulting.

TrainACE

TrainACE

TrainACE, is a professional computer training school offering courses in information technology with a focus on Advanced Security training.

DataProtect

DataProtect

DataProtect is a specialized information security company providing consultancy, information management, integration and training services.

Center for Research on Scientific & Technical Information (CERIST)

Center for Research on Scientific & Technical Information (CERIST)

CERIST is a scientific and technical research centre with activities focused in the area of networks, information systems and IT security.

eLearnSecurity

eLearnSecurity

eLearnSecurity is an innovator in the IT Security training market providing quality online courses paired with highly practical virtual labs.

Andreessen Horowitz (a16z)

Andreessen Horowitz (a16z)

Andreessen Horowitz (known as "a16z") is a venture capital firm in Silicon Valley, California that backs bold entrepreneurs building the future through technology.

Traced

Traced

At Traced, our aim is to redefine mobile cyber security to provide the best possible protection to everyone against breaches of privacy and security.

Nassec

Nassec

Nassec is a Cyber Security firm dedicated to providing the best vulnerability management solutions. We offer tailor-made cyber security solutions based upon your requirements and nature of business.

FPT Software

FPT Software

As a leading technology service provider, FPT assists customers of all sizes and from any industries in implementing and adapting digital technologies including cybersecurity.

SharkStriker

SharkStriker

SharkStriker is a US based managed security services provider with SOCs and offices across the globe.

FortiGuard Labs

FortiGuard Labs

FortiGuard Labs is the threat intelligence and research organization at Fortinet. Its mission is to provide Fortinet customers with the industry’s best threat intelligence.

SecOps Group

SecOps Group

SecOps Group is a boutique cybersecurity consultancy helping enterprises identify & eliminate security risks on a continuous basis.

Incyber

Incyber

Incyber is a fully integrated network and cybersecurity solutions provider contracted to safeguard public and private enterprise, high value data and sensitive industries.

Deloitte Denmark

Deloitte Denmark

Swift incident management, worldwide support, and advanced defense strategies ensure comprehensive recovery and enterprise security with our IR service.

PureID

PureID

Protect your enterprise with PureAUTH #IAMFirewall, Resilient SSO platform, purpose built to provide Passwordless Authentication & Zero Trust Access, by default.