Categories: SecurityWorkspace

Don’t Blame Antivirus Software, Warns NSS Labs

Antivirus software has its critics, despite the fact that it continues to protect firms and raise the bar for attackers, says a new report from research firm NSS Labs.

The report finds that antivirus software has largely been criticised based on two-decades-old misconceptions.

Antivirus Misconceptions

The antivirus software running on users’ computers does far more than matching patterns, or signatures, for known threats. Instead, it uses a variety of technologies – from firewalls and host intrusion detection to behavioural heuristics and anomaly detection – to find what is likely to be malicious software, or malware, Randy Abrams, research director at NSS Labs, told eWEEK.

Today’s anti-malware software – the term “antivirus” is another hold out from the days of a less complicated threat – does the equivalent of the credit check required by a bank, looking at a variety of factors to assess risk, he said.

“If you want a loan at a bank, you have to have a reputation that they call a credit score,” Abrams said. “If you have a low credit score, it does not mean you wouldn’t pay the bank back; it just means that you are a greater risk.”

Despite increasingly nuanced detection strategies, the antivirus industry has become the punching bag of the security industry, mainly because it is the last line of defence against the compromise of a computer that could, and most often does, lead to a major breach. When a computer is infected with malware, users do not blame the firewall or the network intrusion-detection system – they criticise the software that protects the endpoint, Abrams said.

When Chinese hackers infiltrated The New York Times, for example, the media latched onto the fact that only a single program used by the attackers was detected by the Symantec anti-malware. In fact, only 24 percent of the malware used in similar incidents has historically been detected by any endpoint-security solution, according to a Mandiant report.

Endpoint Protection

While Abrams may sound like an apologist for the endpoint-protection software industry, he is not. The industry has evolved better defences but still has not done enough, Abrams said. Because attackers have time to test against the most major antivirus products and find ways to circumvent their defences, no software program can protect the endpoint indefinitely.

Yet, rather than resign themselves to that fact, anti-malware firms need to evolve and build a more holistic defence against attackers, not only detecting and blocking bad software, but detecting signs of, and helping users remediate, a compromise before the breach gets worse, he said.

“When some other companies detect a breach, the antivirus firms look bad, but when their software detects the breach, then they look like they are doing their job,” Abrams said. “By taking on both tasks, they are creating a much better system of security.”

Are you a security pro? Try our quiz!

Originally published on eWeek.

Robert Lemos

Robert Lemos covers cyber security for TechWeekEurope and eWeek

Recent Posts

Ericsson To Cut 1,200 Jobs in Sweden Amid ‘Challenging’ Market

Swedish telecoms giant Ericsson blamed “challenging mobile networks market” and “further volume contraction” for job…

3 hours ago

FTX’s Sam Bankman-Fried Sentenced To 25 Years In Prison For $8bn Fraud

Dramatic downfall. Sam Bankman-Fried sentenced to 25 years in prison for masterminding $8bn fraud that…

4 hours ago

Elon Musk Orders FSD Demo For Every Tesla US Sale

Fallout avoidance? Tesla buyers in the US must be shown how to use the FSD…

5 hours ago

Amazon Pumps Another $2.75 Billion Into Anthropic

Amazon completes its $4bn investment into AI firm Anthropic, after providing an additional $2.75bn in…

7 hours ago

The Sustainability of AI

While AI promises unparalleled efficiency, productivity, and innovation, questions regarding its environmental impact loom large.…

10 hours ago

Trump’s Truth Social Makes Successful Market Debut

Shares in Donald Trump’s social media company rose about 16 percent after first day of…

10 hours ago