Anti-Virus Is Dead (But Still Makes Money) Says Symantec 254
judgecorp (778838) writes "Symantec says anti-virus is dead but the company — the world's largest IT security firm — still makes 40 percent of its revenue there. AV now lets through around 55 percent of attacks, the company's senior vice president of information security told the Wall Street Journal. Meanwhile, other security firms including FireEye, RedSocks and Imperva are casting doubt on AV, suggesting a focus on data loss prevention might be better."
Re:To easy to make new viruses (Score:4, Informative)
I guess you haven't used a Windows computer since Vista? Users are NOT administrator by default, heck even the domain account Administrator isn't an admin by default, you have to perform an action which requires elevated permissions and then you get a UAC dialog which is required to actually have an Administrator token. This is not at all unlike how SU works *NIX.
Maybe that their AV sucks? (Score:5, Informative)
Good anti-virus still has high detection rates. AV Comparitives puts most virus scanners above 90% detection in their March real world protection test. The better ones are in the 98%+ range. http://www.av-comparatives.org... [av-comparatives.org]
Of course Symantec isn't on that list... perhaps there's a reason :).
Re:Maybe that their AV sucks? (Score:4, Informative)
There are statistics and then there are useful statistics. If an AV product is capable of catching 95% of all the viruses ever written, you should
A) use it
B) be really worried because you don't know what good it's actually doing.
Remember, 99% (a made-up stat) of all malware is no longer used at all because it's either blocked by every tool in existence or doesn't do something actually useful, like bringing cash to the distributor of said malware.
What matters is what percentage of currently active (and dangerous) malware the AV tool can catch, and further, whether the types of malware it can't catch pose a danger to your personal types of computer usage. As a contrived example, all Flash-based malware is irrelevant if you never visit any Flash-enabled web page (and don't run Flash modules locally either).
Paradigm Shift. (Score:3, Informative)
Malware constitutes the following:
[Injection Method] + [Exploit] + [Persistence or Self-Removal Configuration] + [Payload]
You can jumble around solutions to create a virus.
AV companies have to figure out both signature based and heuristic detection methods as they can't just MD5 and ban files. Malware writers can build files that defy algorithmic description; that self-jumble every time they are copied.
Most viruses can emulate user activities sufficiently that antivirus cannot stop them.
E.G. Cryptolocker. Users have rights to use windows cryptographic processes to encrypt files.
Thus the focus has gone straight to controlling user activities and user data securely. Assume the user is a criminal, what can they do, what can I do to stop them?
Assume the end user will get hijacked; what can they do? Compartmentalize them and their job so the damage done is minimal. E.G. Publishing every application via Citrix Remote applications and setting the interface with the OS on some of them so you cannot copy specific fields in forms. E.G. Websense.
Assume multiple end users will get compromised, Log every attack so each attack becomes a one-trick-pony. E.G. Most Firewalls and their monitoring features.
Assume the end user will take off with their files; encrypt them and setup a system by which the keys are kept locally. E.G. Microsoft RMS or "Next Gen" Firewalls.
This is a big shift in paradigm for security and for Sarbox organizations where compliance objectives trump everything else. It's also a fantastic way to completely decimate an organization, because you limit the ability of organic growth to fudge over incompetent management.
For your Ma' and Pa' business, things have stayed business as usual. And really, there's a whole new set of skills and features big enterprises are expecting out of IT that they will not be able to find in the field or in current certification paths.