Americas

  • United States

Asia

Oceania

Contributor

Is antivirus software dead at last?

Opinion
Dec 06, 20165 mins
MalwareSecurity

pc antivirus digital display
Credit: Simon Smith/iStock/Thinkstock

The debate about whether antivirus software is still useful has been going on for a few years now. This technology was once the mainstay of the security efforts for most businesses and home users. The challenge of late is the ability of these products and their providers to keep up with the rapidly changing threat landscape. 

The folks at the Defensive Security Podcast pointed out last week that this debate was renewed once again by Darren Bilby speaking at Kiwicon, who said, “We need to stop investing in those things we have shown do not work.” He stated his position even more succinctly when he said: “No more magic.”

Antivirus technology is probably older than most think, having been created in an early form in 1987 by developers who would curiously also go on to produce a virus authoring kit (perhaps renewing the old humorous urban legend about antivirus companies producing viruses to keep themselves in business).

While the technology has improved over the years, its basic approach has always remained the same. It looks at incoming data from downloads, removable media and other sources for patterns of characters, called signatures, which are known to indicate a malicious file. When identified, any such files are quarantined to prevent compromise of the system. The database of known signatures is updated frequently to account for new signatures. 

For many years, this antivirus approach was effective in preventing the compromise of many endpoints. The math was simple — antivirus companies could identify a new malware entity, and get their signatures updated more quickly than the typical malware could make it across the internet. 

Unfortunately, two major factors have greatly diminished the effectiveness of antivirus technology. First, malware can traverse the internet at a rate nobody ever imagined was possible. Today, a new virus can become widespread on the internet before the antivirus vendors even know it exists. Second, virus authors have learned to produce variants, which are version of their illicit programs that function the same way, but have deliberate changes in their signature to evade antivirus programs. Because much of our malware is now distributed in kit form, even a novice can produce a malware variant and get it out on the internet very quickly. 

While the value of antivirus software has been diminishing for some time, it was arguably pushed over the edge by ransomware, which, by some recent estimates, evades 100% of antivirus systems, owing its success to the rapid succession of new variants. 

So, is traditional antivirus software dead? Microsoft for one does not seem to think so. While many vendors could be accused (rightly or otherwise) of supporting this technology (effective or not) to continue reaping revenue from it, Microsoft gives the technology away in the form of Windows Defender, and continues to enhance and upgrade its product. Many other vendors have been incorporating behavioral analysis and other techniques into their products to enhance them. 

One of the best arguments for antivirus software is the fact that many infections come from old malware. Once a malware package hits the internet, there is no good way to completely remove it. The same malware, unaided by its author, can continue to show up for years. 

Given all of the facts, I continue to believe that antivirus software, despite its limitations, has a place in our defensive strategy — but just as part of that strategy. Other players should include: 

Whitelisting: Somewhat the reverse of the antivirus signature approach. This technology only allows known good programs to run, and prevents the execution of anything else. This approach can be a challenge to manage, but offers greatly increased endpoint protection. 

Sandboxing or containerization: This approach causes attachments or links, which usually carry the malware’s payload, to be opened in an isolated virtual environment on a PC, containing any damage to the PC. 

Behavioral analysis: This approach looks at the patterns of behavior of malware, rather than the signatures. For example, since ransomware will quickly begin to encrypt files, behavioral analysis can recognize that an abnormal number of files are changing in a a short time, and shut down the related process. 

Privilege restriction: In order to install itself on an endpoint, a malware program runs on an endpoint where the user has the privilege to install programs. If most end users are denied the privilege to install programs themselves, most malware will not run. 

Remote detonation: This is a similar approach to sandboxing, except that the attachment is opened on an isolated remote system, containing any damage before it reaches the user endpoint. 

Bottom line: Even as promising new technologies for malware detection and prevention hit the market, bad actors are working hard to find ways around them. As such, we must continue with an arsenal of tools — including antivirus — to have the best chance to beat the hackers.

Contributor

Robert C. Covington, the "Go To Guy" for small and medium business security and compliance, is the founder and president of togoCIO.com. Mr. Covington has B.S. in Computer Science from the University of Miami, with over 30 years of experience in the technology sector, much of it at the senior management level. His functional experience includes major technology implementations, small and large-scale telecom implementation and support, and operations management, with emphasis on high-volume, mission critical environments. His expertise includes compliance, risk management, disaster recovery, information security and IT governance.

Mr. Covington began his Atlanta career with Digital Communications Associates (DCA), a large hardware/software manufacturer, in 1984. He worked at DCA for over 10 years, rising to the position of Director of MIS Operations. He managed the operation of a large 24x7 production data center, as well as the company’s product development data center and centralized test lab.

Mr. Covington also served as the Director of Information Technology for Innotrac, which was at the time one of the fastest growing companies in Atlanta, specializing in product fulfillment. Mr. Covington managed the IT function during a period when it grew from 5 employees to 55, and oversaw a complete replacement of the company’s systems, and the implementation of a world-class call center operation in less than 60 days.

Later, Mr. Covington was the Vice President of Information Systems for Teletrack, a national credit bureau, where he was responsible for information systems and operations, managing the replacement of the company’s complete software and database platform, and the addition of a redundant data center. Under Mr. Covington, the systems and related operations achieved SAS 70 Type II status, and received a high audit rating from the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency.

Mr. Covington also served as Director of Information Technology at PowerPlan, a software company providing software for asset-intensive industries such as utilities and mining concerns, and integrating with ERP systems including SAP, Oracle Financials, and Lawson. During his tenure, he redesigned PowerPlan's IT infrastructure using a local/cloud hybrid model, implemented IT governance based on ITIT and COBIT, and managed the development of a new corporate headquarters.

Most recently, Mr. Covington, concerned about the growing risks facing small and medium business, and their lack of access to an experienced CIO, formed togoCIO, an organization focused on providing simple and affordable risk management and information security services.

Mr. Covington currently serves on the board of Act Together Ministries, a non-profit organization focused on helping disadvantaged children, and helping to strengthen families. He also leads technical ministries at ChristChurch Presbyterian. In his spare time, he enjoys hiking and biking.

The opinions expressed in this blog are those of Robert C. Covington and do not necessarily represent those of IDG Communications, Inc., its parent, subsidiary or affiliated companies.

More from this author