Slashdot Log In
Cisco CSO Says Antivirus Money "Completely Wasted"
Posted by
timothy
on Thu May 22, 2008 10:09 AM
from the what-about-the-rape-industry-and-the-pillage-industry dept.
from the what-about-the-rape-industry-and-the-pillage-industry dept.
mernil writes with an excerpt that kicks off a story at ZDNet Australia: "Companies are wasting money on security processes — such as applying patches and using antivirus software — which just don't work, according to Cisco's chief security officer John Stewart. Speaking at the AusCERT 2008 conference in the Gold Coast yesterday, Stewart said the malware industry is moving faster than the security industry, making it impossible for users to remain secure."
Related Stories
Submission: Antivirus is 'completely wasted money' by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Agreed (Score:5, Insightful)
Re:Agreed (Score:4, Insightful)
Parent
Re:Agreed (Score:5, Informative)
- Comodo [comodo.com] - Still in beta, lots of false positives. Configuration is all in local text files, so some level of remote management is possible, but they certainly don't provide the tools for it.
- PC Tools [pctools.com] - Requires interaction from the user to do updates, so not a contender.
- ClamAV [clamav.net] is free of course, but does not provide a scan-on-access monitor. More suitable for mail servers than workstations.
- Winpooch [sourceforge.net] - uses the ClamAV engine for on-access scanning, project seems dead, never tried it.
- Spyware Terminator [spywareterminator.com] - Also does AV using the ClamAV engine. I'd never heard of this one before today, and unfortunately their site design looks a little on the fly-by-night side. They offer a corporate edition with central administration for the wacky price of $2 per seat per year.
Please add to/subtract from/comment on these if you know something!Parent
Re:Agreed (Score:5, Informative)
Parent
Re:Agreed (Score:4, Funny)
You kids had it easy. When I was your age, we just had ones and zeros. And sometimes we didn't have zeros, had to make do with recycled oh's and hope no one would notice.
Parent
Re:Agreed (Score:5, Insightful)
Parent
Re:Agreed (Score:5, Interesting)
This whole thing makes me wonder why there isn't a lightweight Linux distribution thats sole purpose is to run another OS in a virtual machine. A user could then run a firewall/etc on this hypervisor to protect the guest.
I know Vista is supposed to do this, but let's face it, it's a big target, and it's created by Microsoft.
Parent
Re:Agreed (Score:5, Insightful)
And it's not completely useless to have anti-virus software on your machine, but the problem is that they are always a bit behind so there are always a few that takes a hit before the propagation is halted by updated AV software.
Unfortunately there have been too many mistakes made throughout history with the intent of making it easy for users to work with a computer. This way of relaxed behavior is kicking back because it also makes it easy to create malware.
Parent
Re:Agreed -Free For Personal Use (Score:5, Informative)
Parent
Re:Agreed -Free For Personal Use (Score:5, Insightful)
Parent
Re:Agreed -Free For Personal Use (Score:5, Interesting)
Is this really what it's like? Is having malware violating your personal computer the norm? Is it really impossible to design secure OS's and applications from the ground up instead of making them full of holes and relying on "solutions" that pick up the pieces? Is it really better to do damage control than prevention?
I find that very hard to believe. I think it's more likely that the current state of the software industry is based on complacency and no respect for the customer and his or her personal data.
If it turned out that the maker of your main door lock made a shoddy product that allowed anybody to unlock it and have their way with your house... you'd be mad, right? You'd hold them responsible, want your money back, never buy from them again, maybe even sue them and ask for reparations if they acted like assholes.
But when your personal computer gets broken into you don't make a peep, you just sigh and use a backup, if they have one. Then it's back to the torture of finding and paying for antimalware, knowing full well that one day you'll get shafted again.
Someone please explain this self-abuse to me. The only explanation I've come up with is that people are ignorant and/or brainwashed into thinking there's no alternative so they'll put up with anything and think that's how it's supposed to work.
Software industry needs to grow a spine, take responsability and stop all the "no guarantees" crap. Than maybe, just maybe we'll see some improvement on the malware front.
Parent
Re:Agreed -Free For Personal Use (Score:4, Insightful)
Parent
Re:Agreed (Score:5, Insightful)
Parent
Re:Agreed (Score:5, Insightful)
Parent
Re:Agreed (Score:5, Funny)
Parent
Re:Agreed (Score:5, Funny)
Parent
Re:Agreed (Score:4, Funny)
It is easier to put a lock on a door if the building is designed with walls to begin with. Windows was an open air pavilion that had clapboard and sheeting tin added on after the fact. And yes you can "pick the locks" on Linux, as the Debian key debacle has so aptly proved, but with windows you just kick out some tin sheeting.
Parent
Re:Agreed (Score:5, Insightful)
The bad guys have access to all the same tools you have. They can get their hands on ClamWin, Avast, AVG, etc. They have full access to Windows in any flavour, every variety of Mac OS, and the rainbow of Linux. These aren't script kiddies farting around in their parents' basement. The "bad guys" are groups of organized professionals that know more about your computer than you do.
THE MALWARE DOES NOT GET DETECTED BY ANTIVIRUS SOFTWARE BECAUSE THE WRITERS TEST IT USING THE SAME TOOLS WE USE!
To completely harden your system against an intrusion, you have to patch every single hole and then guarantee that there are no more holes. Further, every program that you install on your computer has to be guaranteed to have no holes. Finally, all your hardware (AND its firmware, I'm looking at YOU, 2-wire!) has to pass the same test - NO HOLES! Ask MS how happy they were with the folks who made GoldenEye.
To hack into a system, you merely have to find ONE hole. That's it. You're banking the health of your computer on the hopes that not one single person has put in an exploitable bug. Nobody on sourceforge made an error. None of the "featured articles" on TDWTF are in your code. None of the lowest bidders from Elbonia pasted together snippets from codesamples.com. All your pointers are bound, all the copying templates are limited (K&R, I'm calling YOU out on this!), and your multi-threaded application is coded properly. Did someone stay up until midnight to meet an arbitrary deadline? Is your program "good enough for who it's for"?
And you, just now, said, "I want to spend as little as possible on my security systems". Now, I fully agree that the free alternatives are significantly better than the ones that come bundled with your HP-branded Staples Windows Vista Ultimate Ice-Cream PC (Printer Included with Bundle). But the attitude is, "I'll slap on a few quick and easily downloadable programs and call my system secure." The bad guys get these programs too, and they probably know them as well, or better than, the authours.
One error, anywhere, and your security becomes "by obscurity". That's really what I use at work and at home. I don't have anything valuable on my computer, and I am not a worthwhile target for phishing, exploiting, hacking, etc.
Any system is exploitable. One error. That's all it takes.
Parent
Re:Agreed (Score:5, Insightful)
So even if AV software isn't the best solution but merely a patch it at least protect us somewhat.
But what's needed is a completely different design of the operating systems we have. SELinux is far too weak in reality - even if it is a good step forward it is very static in it's behavior. It is also necessary to have more dynamically adapting operating systems that can see overall patterns and be able to lock down certain processes if they start to behave in an unexpected way.
Parent
Re:Agreed (Score:4, Interesting)
Parent
Re:Agreed (Score:4, Insightful)
Parent
Stating the obvious.. (Score:5, Insightful)
Patching software does work though, I don't see the alternative if you have an exploitable bug in your code? You want that code fixed. It doesn't matter if no damage can be done to your system, you still want all your applications running as expected.
Re:Stating the obvious.. (Score:5, Informative)
I generally agree with your sentiment, although I feel compelled to correct one of your points...
The previous Slashdot article didn't say 66% of all PC's, it said 66% of all PC's (over $1000) sold in retail. That's still impressive for Apple and shows a lot of growth potential as it expands its retail presence, but it's a very different market than 66% of all PC's.
Parent
Re:Stating the obvious.. (Score:5, Insightful)
Don't be naive. The problem is simply worse for Windows because windows is the most heavily used OS.
This idea that Linux is immune from viruses is just stupid. It's not the primary target of most malware, but it is a target. A poorly configured Linux server is pure gold to a spammer.
Thinking that you are safe just because you use Linux is, well, dumb.
And as for Apples various OS products? Well they have only a tiny market share. There isn't going to be the same return on investment of time and effort to attack that as much as windows is attacked.
Parent
Re:Stating the obvious.. (Score:5, Insightful)
The fact remains that the OS vendor here is in the habit of finding new
ways to do boneheaded things with software. You could even say that you
are far less likely to have Windows malware problems if you avoid as
much Microsoft product as possible while running Windows.
This is not unlike how earlier versions of Windows were much more crash
prone if you use MS apps as well.
This brings up an interesting problem of using Microsoft software on
other operating systems. That's bound to create problems that would
not exist on a platform otherwise.
Yes, sometimes a particular manufacturer (like McDonalds or GM) just makes crap.
Parent
Re:Stating the obvious.. (Score:4, Informative)
Parent
Re:Stating the obvious.. (Score:5, Informative)
This is not the case with Mac OS X. My current account has administrator privileges, but they are inactive by default. I have to enter my password in order to elevate to admin permission, and such elevation applies only to the program which requested the change. This makes an attack both less likely and easier to defend against, as the program can't just silently go in and modify my applications -- it has to at least ask for permission first.
Obviously there are still dangers. My user files are still vulnerable to attack at all times, but of course Time Machine means I have backups of my files going back weeks. There is also the danger that a program could trick me into entering my password when its try intentions are nefarious, thereby getting the required permission to trash my computer. The only way to defend against that is to be very careful about when and where I enter my admin password, but that's true of any OS.
Parent
Re:Stating the obvious.. (Score:4, Insightful)
Parent
Quick linux question (Score:5, Interesting)
Re:Quick linux question (Score:5, Interesting)
Parent
Problem of assessing success... (Score:5, Insightful)
I read this story yesterday, and the quote is a little misleading. Here's the context:
"It's completely wasted money," Stewart told delegates.
Re: (Score:3, Insightful)
Re:Problem of assessing success... (Score:5, Insightful)
If your roof isn't leaking all those buckets are wasted money.
If they're norton buckets they're also (a) glued to the floor so you can't use them anyway, and (b) full of holes themselves.
Parent
Riiight. (Score:5, Insightful)
There are a lot of people profiteering in the computer security market, and Cisco is up there.
That's correct, do not run Windows as admin. (Score:5, Funny)
That's absolutely correct. If you avoid logging onto Windows as Administrator, you greatly lessen your exposure to security hazards. Especially since in the real world you can hardly run any useful software unless you're logged on as admin, therefore your using the Windows box less, and naturally, less use equals less exposure to danger. In fact if you just keep your Windows box powered off, then it will be the absolute most secure against malware.
Parent
WTF? (Score:3, Interesting)
Generally, a rational botnet creator would tend to try to pwn the low-hanging fruit first - i.e. the ones that have no updates, malware detection, AV, etc. Only if he/she is unable to get a large enough botnet after applying those tools would one resort to the higher-level techniques.
It's rather like saying that Timothy McVeigh would rather have used nuclear ordnance when a U-Haul full of fertilizer served his purpose just fine...
They want to go to whitelisting (Score:5, Insightful)
Not completely wasted... (Score:5, Insightful)
For Geeks who delete suspicious emails, use Thunderbird (so emails are not rendered in the IE engine), etc., sure, an AV may be a useless waste of CPU cycles. But for the nontechnical user, it's important. While it's difficult to keep up with outbreaks, it's important for older viruses in the wild- something Grandma may not catch.
Now, as for a whitelist. Dumb idea. It puts too much power in the hands of AV companies (who can say "$$$ to get on the list!" or if users can change it, they'll get "IMPORTANT WINDOWS UPDATE- REMEMBER TO ADD TO YOUR WHITELIST!". What about unsigned programs? Updated versions?
A whitelist might work for children, for work PCs, for other non-administrators. But people ultimately want to install their own programs without the blessing of company XYZ.
And, as a geek, I strongly disagree that it's impossible to remain secure, it just takes a little training. I know nontechnical users, I teach them for 10 minutes, and they have good habits. Don't open emails saying "A greeting card from a classmate", don't run unsolicited programs, if you get an email saying it's from chase.com "Important Account Update" visit their directly, etc.). Those habits go a long way, along with some layered protection (ZoneAlarm Free, Router w/ a firewall, Avast Home, Immunize in SpywareBlaster, and Immunize in Spybot S&D). That user still has some trouble with some tasks, but with a little common sense and some good protection, they've stayed infection free for 4 years.
(And, of course, I fix the computer as a friend, and I occasionally run rootkit detection and AV from a LiveCD just to make sure).
Re: (Score:3, Interesting)
Disagree (Score:5, Informative)
Additionally, patching isn't just about security. It's about fixing software bugs that could cost you time/money later.
clam (Score:5, Insightful)
Cancel or Allow? (Score:3, Funny)
Duh! (Score:3, Informative)
Anti-virus software is by its very nature a "post damage" measure, like closing the barn door after the horses leave. Of fixing the roof after the house is wrecked from rain.
The *only* way to prevent viruses is to understand that your computer only does what it is told and you need to control who gets to tell it what to do.
Windows, and we are talking about Windows here, is designed to allow foreign agents to control your system without your consent. Microsoft has so many holes in its system beyond just stack overflow exploits, but protocols and APIs designed to make it "easier" for application to do things "for you," and are we surprised that it is exploited?
Agree somewhat (Score:3, Interesting)
Antivirus as virus (Score:5, Insightful)
Viable alternative. (Score:5, Informative)
Re:Viable alternative. (Score:4, Insightful)
None of my machines have anti-virus on them (I use one-shot scanning tools every couple of months to be sure all is good), and I have only ever caught ONE virus, which I noticed with my 2 eyes 5 minutes after I caught it, on a totally out of date lap-top that I hadn't used in over a year (so it wasn't updated), through the COM+ jpeg exploit. And I sure don't have anything beyond a 40$ NetGear router.
There simply isn't all that much to catch, unless you take needless risks.
Parent
Some things can't be fixed with software (Score:5, Insightful)
Re:Some things can't be fixed with software (Score:4, Funny)
Parent
Re:Inadequate != Nothing (Score:4, Insightful)
Based on what? The cause of infection is pretty much the same with or without AV software:
- Application exploits (AV software only stops known ones, all the new ones constantly coming out get through just fine)
- Stupid users saying "sure I want to run this random
I'm not seeing any real world evidence that AV software is reducing the damage being done by all these viruses.
I mean really, when was the last time you had AV software catch a virus that would have otherwise infected your system?
Parent