The debate about whether antivirus software is still useful has been going on for a few years now. This technology was once the mainstay of the security efforts for most businesses and home users. The challenge of late is the ability of these products and their providers to keep up with the rapidly changing threat landscape.
The folks at the Defensive Security Podcast pointed out last week that this debate was renewed once again by Darren Bilby speaking at Kiwicon, who said, "We need to stop investing in those things we have shown do not work." He stated his position even more succinctly when he said: "No more magic."
Antivirus technology is probably older than most think, having been created in an early form in 1987 by developers who would curiously also go on to produce a virus authoring kit (perhaps renewing the old humorous urban legend about antivirus companies producing viruses to keep themselves in business).
While the technology has improved over the years, its basic approach has always remained the same. It looks at incoming data from downloads, removable media and other sources for patterns of characters, called signatures, which are known to indicate a malicious file. When identified, any such files are quarantined to prevent compromise of the system. The database of known signatures is updated frequently to account for new signatures.
For many years, this antivirus approach was effective in preventing the compromise of many endpoints. The math was simple -- antivirus companies could identify a new malware entity, and get their signatures updated more quickly than the typical malware could make it across the internet.
Unfortunately, two major factors have greatly diminished the effectiveness of antivirus technology. First, malware can traverse the internet at a rate nobody ever imagined was possible. Today, a new virus can become widespread on the internet before the antivirus vendors even know it exists. Second, virus authors have learned to produce variants, which are version of their illicit programs that function the same way, but have deliberate changes in their signature to evade antivirus programs. Because much of our malware is now distributed in kit form, even a novice can produce a malware variant and get it out on the internet very quickly.
While the value of antivirus software has been diminishing for some time, it was arguably pushed over the edge by ransomware, which, by some recent estimates, evades 100% of antivirus systems, owing its success to the rapid succession of new variants.
So, is traditional antivirus software dead? Microsoft for one does not seem to think so. While many vendors could be accused (rightly or otherwise) of supporting this technology (effective or not) to continue reaping revenue from it, Microsoft gives the technology away in the form of Windows Defender, and continues to enhance and upgrade its product. Many other vendors have been incorporating behavioral analysis and other techniques into their products to enhance them.
One of the best arguments for antivirus software is the fact that many infections come from old malware. Once a malware package hits the internet, there is no good way to completely remove it. The same malware, unaided by its author, can continue to show up for years.
Given all of the facts, I continue to believe that antivirus software, despite its limitations, has a place in our defensive strategy -- but just as part of that strategy. Other players should include:
Whitelisting: Somewhat the reverse of the antivirus signature approach. This technology only allows known good programs to run, and prevents the execution of anything else. This approach can be a challenge to manage, but offers greatly increased endpoint protection.
Sandboxing or containerization: This approach causes attachments or links, which usually carry the malware's payload, to be opened in an isolated virtual environment on a PC, containing any damage to the PC.
Behavioral analysis: This approach looks at the patterns of behavior of malware, rather than the signatures. For example, since ransomware will quickly begin to encrypt files, behavioral analysis can recognize that an abnormal number of files are changing in a a short time, and shut down the related process.
Privilege restriction: In order to install itself on an endpoint, a malware program runs on an endpoint where the user has the privilege to install programs. If most end users are denied the privilege to install programs themselves, most malware will not run.
Remote detonation: This is a similar approach to sandboxing, except that the attachment is opened on an isolated remote system, containing any damage before it reaches the user endpoint.
Bottom line: Even as promising new technologies for malware detection and prevention hit the market, bad actors are working hard to find ways around them. As such, we must continue with an arsenal of tools -- including antivirus -- to have the best chance to beat the hackers.
This article is published as part of the IDG Contributor Network. Want to Join?
