Cisco CSO Says Antivirus Money "Completely Wasted" 503
mernil writes with an excerpt that kicks off a story at ZDNet Australia: "Companies are wasting money on security processes — such as applying patches and using antivirus software — which just don't work, according to Cisco's chief security officer John Stewart. Speaking at the AusCERT 2008 conference in the Gold Coast yesterday, Stewart said the malware industry is moving faster than the security industry, making it impossible for users to remain secure."
Agreed (Score:5, Insightful)
Re:Agreed (Score:4, Insightful)
Re:Agreed (Score:5, Informative)
- Comodo [comodo.com] - Still in beta, lots of false positives. Configuration is all in local text files, so some level of remote management is possible, but they certainly don't provide the tools for it.
- PC Tools [pctools.com] - Requires interaction from the user to do updates, so not a contender.
- ClamAV [clamav.net] is free of course, but does not provide a scan-on-access monitor. More suitable for mail servers than workstations.
- Winpooch [sourceforge.net] - uses the ClamAV engine for on-access scanning, project seems dead, never tried it.
- Spyware Terminator [spywareterminator.com] - Also does AV using the ClamAV engine. I'd never heard of this one before today, and unfortunately their site design looks a little on the fly-by-night side. They offer a corporate edition with central administration for the wacky price of $2 per seat per year.
Please add to/subtract from/comment on these if you know something!Re:Agreed (Score:5, Informative)
Re:Agreed (Score:4, Funny)
You kids had it easy. When I was your age, we just had ones and zeros. And sometimes we didn't have zeros, had to make do with recycled oh's and hope no one would notice.
Re:Agreed (Score:5, Insightful)
Re:Agreed (Score:5, Interesting)
This whole thing makes me wonder why there isn't a lightweight Linux distribution thats sole purpose is to run another OS in a virtual machine. A user could then run a firewall/etc on this hypervisor to protect the guest.
I know Vista is supposed to do this, but let's face it, it's a big target, and it's created by Microsoft.
Re:Agreed (Score:5, Insightful)
And it's not completely useless to have anti-virus software on your machine, but the problem is that they are always a bit behind so there are always a few that takes a hit before the propagation is halted by updated AV software.
Unfortunately there have been too many mistakes made throughout history with the intent of making it easy for users to work with a computer. This way of relaxed behavior is kicking back because it also makes it easy to create malware.
Re:Agreed -Free For Personal Use (Score:5, Informative)
Re:Agreed -Free For Personal Use (Score:5, Insightful)
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
That's a bit complex. Why not just run a liveCD then? Cache it into RAM, and it runs very fast.
Re:Agreed -Free For Personal Use (Score:5, Interesting)
Is this really what it's like? Is having malware violating your personal computer the norm? Is it really impossible to design secure OS's and applications from the ground up instead of making them full of holes and relying on "solutions" that pick up the pieces? Is it really better to do damage control than prevention?
I find that very hard to believe. I think it's more likely that the current state of the software industry is based on complacency and no respect for the customer and his or her personal data.
If it turned out that the maker of your main door lock made a shoddy product that allowed anybody to unlock it and have their way with your house... you'd be mad, right? You'd hold them responsible, want your money back, never buy from them again, maybe even sue them and ask for reparations if they acted like assholes.
But when your personal computer gets broken into you don't make a peep, you just sigh and use a backup, if they have one. Then it's back to the torture of finding and paying for antimalware, knowing full well that one day you'll get shafted again.
Someone please explain this self-abuse to me. The only explanation I've come up with is that people are ignorant and/or brainwashed into thinking there's no alternative so they'll put up with anything and think that's how it's supposed to work.
Software industry needs to grow a spine, take responsability and stop all the "no guarantees" crap. Than maybe, just maybe we'll see some improvement on the malware front.
Re:Agreed -Free For Personal Use (Score:4, Insightful)
Re:Agreed (Score:5, Insightful)
Re: (Score:2)
Re:Agreed (Score:5, Insightful)
Re:Agreed (Score:5, Funny)
Re:Agreed (Score:5, Funny)
Re:Agreed (Score:4, Funny)
It is easier to put a lock on a door if the building is designed with walls to begin with. Windows was an open air pavilion that had clapboard and sheeting tin added on after the fact. And yes you can "pick the locks" on Linux, as the Debian key debacle has so aptly proved, but with windows you just kick out some tin sheeting.
Re: (Score:2)
Re:Agreed (Score:5, Insightful)
The bad guys have access to all the same tools you have. They can get their hands on ClamWin, Avast, AVG, etc. They have full access to Windows in any flavour, every variety of Mac OS, and the rainbow of Linux. These aren't script kiddies farting around in their parents' basement. The "bad guys" are groups of organized professionals that know more about your computer than you do.
THE MALWARE DOES NOT GET DETECTED BY ANTIVIRUS SOFTWARE BECAUSE THE WRITERS TEST IT USING THE SAME TOOLS WE USE!
To completely harden your system against an intrusion, you have to patch every single hole and then guarantee that there are no more holes. Further, every program that you install on your computer has to be guaranteed to have no holes. Finally, all your hardware (AND its firmware, I'm looking at YOU, 2-wire!) has to pass the same test - NO HOLES! Ask MS how happy they were with the folks who made GoldenEye.
To hack into a system, you merely have to find ONE hole. That's it. You're banking the health of your computer on the hopes that not one single person has put in an exploitable bug. Nobody on sourceforge made an error. None of the "featured articles" on TDWTF are in your code. None of the lowest bidders from Elbonia pasted together snippets from codesamples.com. All your pointers are bound, all the copying templates are limited (K&R, I'm calling YOU out on this!), and your multi-threaded application is coded properly. Did someone stay up until midnight to meet an arbitrary deadline? Is your program "good enough for who it's for"?
And you, just now, said, "I want to spend as little as possible on my security systems". Now, I fully agree that the free alternatives are significantly better than the ones that come bundled with your HP-branded Staples Windows Vista Ultimate Ice-Cream PC (Printer Included with Bundle). But the attitude is, "I'll slap on a few quick and easily downloadable programs and call my system secure." The bad guys get these programs too, and they probably know them as well, or better than, the authours.
One error, anywhere, and your security becomes "by obscurity". That's really what I use at work and at home. I don't have anything valuable on my computer, and I am not a worthwhile target for phishing, exploiting, hacking, etc.
Any system is exploitable. One error. That's all it takes.
Re:Agreed (Score:5, Insightful)
So even if AV software isn't the best solution but merely a patch it at least protect us somewhat.
But what's needed is a completely different design of the operating systems we have. SELinux is far too weak in reality - even if it is a good step forward it is very static in it's behavior. It is also necessary to have more dynamically adapting operating systems that can see overall patterns and be able to lock down certain processes if they start to behave in an unexpected way.
Re:Agreed (Score:4, Interesting)
Re:Agreed (Score:4, Insightful)
Re: (Score:3, Insightful)
I have a air-bag in my car as well. It doesn't guarantee I'll live in all car crashes. But it will save me in some. And the risk/benifit is enough that I like to have an airbag in my car.
I'll also continue to run an anti-virus scanner on my computers. I know full well they won't save me from bad behavior and many/most nasty root-kits, etc, but they will s
Re: (Score:3, Funny)
Power on LAN.
Stating the obvious.. (Score:5, Insightful)
Patching software does work though, I don't see the alternative if you have an exploitable bug in your code? You want that code fixed. It doesn't matter if no damage can be done to your system, you still want all your applications running as expected.
Re: (Score:2, Insightful)
Re: (Score:2)
Re:Stating the obvious.. (Score:4, Insightful)
Re:Stating the obvious.. (Score:5, Informative)
I generally agree with your sentiment, although I feel compelled to correct one of your points...
The previous Slashdot article didn't say 66% of all PC's, it said 66% of all PC's (over $1000) sold in retail. That's still impressive for Apple and shows a lot of growth potential as it expands its retail presence, but it's a very different market than 66% of all PC's.
Re: (Score:3, Interesting)
windows Pc's are cheapie throw-aways. Get a virus infection, toss it and get a new one.
And yes it IS profitable to me. I still get $100.00 for data backup and moving, plus I get a PC from them for free to recycle that I sell on ebay for $100.00 with a fresh reinstall of XP from it's C
Re: (Score:3, Interesting)
90% of pc owners do not have the ability to install windows XP it's just too difficult.
Re: (Score:3, Insightful)
Re:Stating the obvious.. (Score:4, Informative)
Re: (Score:3, Interesting)
Re: (Score:2)
The problem is Windows, and Microsoft could have fixed much of this, but decided that having an insecure OS...
I'm not convinced the problem is that it's insecure as such (which it may well be), more that patching the system AND ALL THE APPLICATIONS is so difficult. Even on a 'managed' network of Windows machines, it is extremely hard to keep all applications up-to-date, even assuming that patches for applications are available.
WSUS Updates may help if set up, but other applications all have their own
Re:Stating the obvious.. (Score:5, Insightful)
Don't be naive. The problem is simply worse for Windows because windows is the most heavily used OS.
This idea that Linux is immune from viruses is just stupid. It's not the primary target of most malware, but it is a target. A poorly configured Linux server is pure gold to a spammer.
Thinking that you are safe just because you use Linux is, well, dumb.
And as for Apples various OS products? Well they have only a tiny market share. There isn't going to be the same return on investment of time and effort to attack that as much as windows is attacked.
Re:Stating the obvious.. (Score:5, Insightful)
The fact remains that the OS vendor here is in the habit of finding new
ways to do boneheaded things with software. You could even say that you
are far less likely to have Windows malware problems if you avoid as
much Microsoft product as possible while running Windows.
This is not unlike how earlier versions of Windows were much more crash
prone if you use MS apps as well.
This brings up an interesting problem of using Microsoft software on
other operating systems. That's bound to create problems that would
not exist on a platform otherwise.
Yes, sometimes a particular manufacturer (like McDonalds or GM) just makes crap.
"other than by trickery" (Score:3, Insightful)
And 'by trickery' I would take anything from "double-click this exe in this e-mail to see a naked chicks!" to "you must download this program to play this audio file"; i.e. anything that actually requires the user to okay the action taken in one way or another.
Automated I would assume anything that either requires no user interaction whatsoever (somebody ha
Re:Stating the obvious.. (Score:5, Informative)
This is not the case with Mac OS X. My current account has administrator privileges, but they are inactive by default. I have to enter my password in order to elevate to admin permission, and such elevation applies only to the program which requested the change. This makes an attack both less likely and easier to defend against, as the program can't just silently go in and modify my applications -- it has to at least ask for permission first.
Obviously there are still dangers. My user files are still vulnerable to attack at all times, but of course Time Machine means I have backups of my files going back weeks. There is also the danger that a program could trick me into entering my password when its try intentions are nefarious, thereby getting the required permission to trash my computer. The only way to defend against that is to be very careful about when and where I enter my admin password, but that's true of any OS.
Re: (Score:3, Insightful)
That's not necessarily a defense. The virus could modify code that runs just after a legitimate privilege escalation, and then wait until the next time you need to perform that privileged action.
I a
Quick linux question (Score:5, Interesting)
Re: (Score:2, Informative)
Quick Mac question (Score:2)
As a desktop Mac user, has anyone EVER even heard of a virus? I mean seriously, has there even been ONE virus on OS X since it was released nearly a decade ago? I can even count the number of worms and trojans on two hands and have fingers to spare. Better yet, have you ever even installed anti-virus software of any kind? I mean, who even uses that stuff?? I think those virus things are Windows only ;-)
Re: (Score:3, Insightful)
Re: (Score:2)
Stupid people will do stupid things, regardless of the OS they use.
Re: (Score:3, Insightful)
Why would a malware writer write software that will only affect technically elite users? The goal in his eyes, is to damage as many people as possible through the least path of resistance.
That means Linux simply isn't targetted.
This is a stupid question.
Re:Quick linux question (Score:5, Interesting)
Problem of assessing success... (Score:5, Insightful)
I read this story yesterday, and the quote is a little misleading. Here's the context:
"It's completely wasted money," Stewart told delegates.
Re: (Score:2)
If your security works, nothing happens. So it's easy to say that money is "wasted". If the security doesn't work, the problem is a little more obvious.
True story: our office building had a long standing contract with a rat exterminator. We had never seen a rat while we had been there (a few years), so we ended the contract. In three months, guess what? Rats. The rat catchers' contract was immediately renewed.
I guess the difference to the referred-to Windows world is, that our solution actually solved
Re: (Score:3, Insightful)
Re:Problem of assessing success... (Score:5, Insightful)
If your roof isn't leaking all those buckets are wasted money.
If they're norton buckets they're also (a) glued to the floor so you can't use them anyway, and (b) full of holes themselves.
Re: (Score:3, Informative)
Riiight. (Score:5, Insightful)
There are a lot of people profiteering in the computer security market, and Cisco is up there.
I'm a believer (Score:2)
I'm a firm believer that hardware prevention is much greater than AV detection.
Once a friend challenged me, saying that "there's no way you have no viruses" so I let him run the scanner of his choice on the desktop at home. A few hits, all cookies. No viruses.
And I haven't reformatted Windows in 3 years (replace
How does this work? (Score:2)
Does that mean "you can't visit randomwebsite.com because it's not on our white list?" How do you determine what to block?
I'm curious, because it does seem a lot more logical to say "here is what's allowed" than to say "here is a list of (we hope) everything nasty that's out there." An exclusive club doesn't try to keep a list of everyone who isn't allowed in.
I read somewhere that if I didn't run Windows as an admin, that would help a lot, which i
That's correct, do not run Windows as admin. (Score:5, Funny)
That's absolutely correct. If you avoid logging onto Windows as Administrator, you greatly lessen your exposure to security hazards. Especially since in the real world you can hardly run any useful software unless you're logged on as admin, therefore your using the Windows box less, and naturally, less use equals less exposure to danger. In fact if you just keep your Windows box powered off, then it will be the absolute most secure against malware.
Re: (Score:2)
Re: (Score:2)
My home firewall router does everything a semi-equivalent cisco router [newegg.com] would do; VPN, multi-ISP support, DMZ, firewall, etc, etc. The difference is mine is OSS based, running on an old desktop, and cost me, conservatively, 50 bucks, where their equivalent product runs $1000+ and doesn't have gigabit or fibre support.
For what they offer, their appliances are wildly overpriced.
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
WTF? (Score:3, Interesting)
Generally, a rational botnet creator would tend to try to pwn the low-hanging fruit first - i.e. the ones that have no updates, malware detection, AV, etc. Only if he/she is unable to get a large enough botnet after applying those tools would one resort to the higher-level techniques.
It's rather like saying that Timothy McVeigh would rather have used nuclear ordnance when a U-Haul full of fertilizer served his purpose just fine...
Re: (Score:2)
That is, of course, nonsense. A rational defender proportions his precautions to the expected threat. The front door and locks on my flat are doubtless less secure than the vault door at the Bank of England, but that doesn't mean they are worthless or a waste of money.
To be fair to Mr. Stewart, reading the whole arti
Re: (Score:2)
If you're working for an organization of computers though, particularly one marketing oriented how in the world could you maintain any sort of white-list?
In the Windows world it's fairly easily management on a broad scale with mandatory profiles and a login/logout script which writes to a database.
Of course you can do the same thing on a broad scale with most Linux distros out there.
White-listing the web or email is simply not possible for a lot of companies though.
You're right, security is a proce
Inadequate != Nothing (Score:2)
I don't think that Cisco's CSO is a total waste of money. But if he's going to equate "inadequate" to "nothing", Cisco needs to upgrade
Re:Inadequate != Nothing (Score:4, Insightful)
Based on what? The cause of infection is pretty much the same with or without AV software:
- Application exploits (AV software only stops known ones, all the new ones constantly coming out get through just fine)
- Stupid users saying "sure I want to run this random
I'm not seeing any real world evidence that AV software is reducing the damage being done by all these viruses.
I mean really, when was the last time you had AV software catch a virus that would have otherwise infected your system?
They want to go to whitelisting (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This might work for a corporate environment. But how will PC users in home environments know what to put on a whitelist and what not to put on a whitelist?
Why, iexplore.exe. Isn't that all you need?
Re: (Score:2)
distribution packages are pgp signed, and are the only things whitelisted. there, no need for the user to know anything, distro people will know what to whitelist.
and with different mandatory access control mechanisms, each application can b restricted even more to only access resources it is intended to, prventing some exploits in the app itself from working as well.
Not completely wasted... (Score:5, Insightful)
For Geeks who delete suspicious emails, use Thunderbird (so emails are not rendered in the IE engine), etc., sure, an AV may be a useless waste of CPU cycles. But for the nontechnical user, it's important. While it's difficult to keep up with outbreaks, it's important for older viruses in the wild- something Grandma may not catch.
Now, as for a whitelist. Dumb idea. It puts too much power in the hands of AV companies (who can say "$$$ to get on the list!" or if users can change it, they'll get "IMPORTANT WINDOWS UPDATE- REMEMBER TO ADD TO YOUR WHITELIST!". What about unsigned programs? Updated versions?
A whitelist might work for children, for work PCs, for other non-administrators. But people ultimately want to install their own programs without the blessing of company XYZ.
And, as a geek, I strongly disagree that it's impossible to remain secure, it just takes a little training. I know nontechnical users, I teach them for 10 minutes, and they have good habits. Don't open emails saying "A greeting card from a classmate", don't run unsolicited programs, if you get an email saying it's from chase.com "Important Account Update" visit their directly, etc.). Those habits go a long way, along with some layered protection (ZoneAlarm Free, Router w/ a firewall, Avast Home, Immunize in SpywareBlaster, and Immunize in Spybot S&D). That user still has some trouble with some tasks, but with a little common sense and some good protection, they've stayed infection free for 4 years.
(And, of course, I fix the computer as a friend, and I occasionally run rootkit detection and AV from a LiveCD just to make sure).
Re: (Score:2)
Now, as for a whitelist. Dumb idea. It puts too much power in the hands of AV companies (who can say "$$$ to get on the list!" or if users can change it, they'll get "IMPORTANT WINDOWS UPDATE- REMEMBER TO ADD TO YOUR WHITELIST!". What about unsigned programs? Updated versions? A whitelist might work for children, for work PCs, for other non-administrators. But people ultimately want to install their own programs without the blessing of company XYZ.
Huh? I've re-read the whitelist quote and I'm failing to see what this random rant has to do with what he is saying. Where in his statement did he say that you should just be a zombie and create a whitelist based on only what your AV company tells you?
Re: (Score:3, Interesting)
Disagree (Score:5, Informative)
Additionally, patching isn't just about security. It's about fixing software bugs that could cost you time/money later.
Traditional AV technology dead, film at 11 (Score:2)
So, about those Cisco products... (Score:2)
I agree. But... (Score:2, Insightful)
If they couldn't justify the fear, they would themselves research the holes JUST so they have something to patch or utility to sell us. While in a perfect world we could just patch our OSes for bugs and no need for anything running in the background to protect us from boogie men. Companies like No
clam (Score:5, Insightful)
Re: (Score:2)
Cancel or Allow? (Score:3, Funny)
patches do more then make you secure and you shoul (Score:2)
What About a Proactive Security Tool? (Score:2)
Duh! (Score:3, Informative)
Anti-virus software is by its very nature a "post damage" measure, like closing the barn door after the horses leave. Of fixing the roof after the house is wrecked from rain.
The *only* way to prevent viruses is to understand that your computer only does what it is told and you need to control who gets to tell it what to do.
Windows, and we are talking about Windows here, is designed to allow foreign agents to control your system without your consent. Microsoft has so many holes in its system beyond just stack overflow exploits, but protocols and APIs designed to make it "easier" for application to do things "for you," and are we surprised that it is exploited?
Despair (Score:2, Funny)
He then set his hair on fire and ran screaming from the stage.
Agree somewhat (Score:3, Interesting)
And in other news... (Score:2, Funny)
He's right. Now we need secure operating systems. (Score:2)
He's right. Anti-virus tools only work against previous-generation attacks and inept attackers.
Antivirus as virus (Score:5, Insightful)
Viable alternative. (Score:5, Informative)
Re:Viable alternative. (Score:4, Insightful)
None of my machines have anti-virus on them (I use one-shot scanning tools every couple of months to be sure all is good), and I have only ever caught ONE virus, which I noticed with my 2 eyes 5 minutes after I caught it, on a totally out of date lap-top that I hadn't used in over a year (so it wasn't updated), through the COM+ jpeg exploit. And I sure don't have anything beyond a 40$ NetGear router.
There simply isn't all that much to catch, unless you take needless risks.
In other news... (Score:3, Insightful)
Some things can't be fixed with software (Score:5, Insightful)
Re:Some things can't be fixed with software (Score:4, Funny)
Facing metaphorical mortality of your OS (Score:3, Interesting)
A healthy system may have the latest and best immune system known to man, but this does not guarantee and should not be construed to mean that the system is invulnerable or immortal. It is merely immune or resistant to the diseases that it has been exposed to or evolved resistance or immunity to.
We don't expect medical science to ever eradicate all disease and make us perfectly healthy; why do we think it's possible for computers? (Or conversely, why do we think that building an immune system is wasted effort?)
Then again, perhaps turing/von neumann machines and biological organisms aren't so similar after all. It's hard to assess whether this extended metaphor is too forced to be useful or not.
Correction (Score:3, Funny)
Re: (Score:3, Interesting)
AC didn't say malware. There has never been a Mac OS X virus. Ever. Period. And by your own admission, even worms and trojans are incredibly rare. Feel free to cite a virus if you can, I'd love to read about the thing if it were to exist.