Antivirus- Dead Or Alive?

[Logethica]

Antivirus- Dead Or Alive?

The general notion in the cybersecurity industry is that antivirus is an antiquated product, which does not provide enough security against today’s advanced threats. Symantec CEO even went further and declared the demise of the Anti-Virus.

But recent events seem to indicate otherwise.

Just a few weeks ago the antivirus maker, Avast Software, announced plans to acquire competitor AVG Technologies for $1.3 billion in cash. Surely Avast would not spend such a fortune on a dying technology…

The combined company would create the world’s biggest antivirus software firm by number of active users, exceeding even Microsoft’s market share of antivirus technology on consumer devices. The most recent data from software-maker OPSWAT indicates that Avast’s 15% market share plus AVG’s 5% would edge out Microsoft’s 15.9% (a figure that excludes Windows Defender, which is included in Microsoft Windows).

So with this in mind, we ask several questions:

• is this product days over?
• Will it continue to be relevant only to the mass market?
• what are the alternatives?
• would it continue to live in a freemium model?
• Would it continue to live only as an OEM/ consolidate product?

Dead or simply outdated?

It goes without saying that antivirus does no longer enjoy the same status it once had.
Most people realize that deploying the best antivirus will not secure them completely and even the term “Virus” feels outdated and replace by the more accurate “malware”.

But despite this, it’s hard to find organizations who gave up on antivirus altogether. As part of the “layered security approach”, it’s still considered worth having. Interviewing several cybersecurity professionals, they all agree that signature based detection became less efficient with time, due to the rapid increase in new malware evolution.

The attackers can move and mutate quickly, so the attempt to track, analyze and release signature updates fast enough is concept destined to failure. However, antivirus still provide protection against large mass of low level threats, hence worth having.

Mass market Appeal

Antivirus is currently the ONLY cyber product adopted by the masses and sold as a commodity. The adoption of the fermium model increases its’ appeal and distribution even further. No other product even comes close in terms of adoption- firewalls are reserved for large organizations and even DDoS mitigation services have only managed to scratch the surface in terms of mass market and SMB adoption. As an analogy- it’s “the only cybersecurity technology your mom knows about” and would consider consuming, and as such isn’t likely to disappear so quickly.

The Freemium model

Although some free/ freemium Antivirus are considered to be of good quality, the general notion in the industry is these are not “serious” enough for the enterprise. For consumers this is a great model as long as they realize that the free piece of software is not an almighty shield deflecting all attacks but a basic product securing against basic threats. Lately with the rise of Ransomware and mobile malware we’re seeing security companies promoting their paid products more aggressively, perhaps trying to capitalize on the general hysteria of the public.

Continue Reading at the link at the top of the page

 

[DJ Panda]

I voted:

1. Antivirus Is Alive - But only if used as part of a multi-layered security approach.
2. Antivirus Is Alive - One does not need any addition Security Software!

I used to be a multi-layered person and recommend doing so to this day. I also however have tweaked my AV to a point where nothing else is needed to protect my system. Its always good to have something for protection and maybe another tool for scanning the system.

 

[_CyberGhosT_]

Its not dead "yet" but it is on a fast track to its grave.
In my opinion it's not the effectiveness, its within the way its applied through signatures.
Signature based protection is fast becoming obsolete, started a few years back and has been gaining momentum
ever since. The resource usage does not help as well as having to maintain that large signature database.
Now we have the ability to not wait till a signature is needed with anti exe's which is one more nail in the
coffin.
I don't mind having a small AM or AV as a on demand, but none other than Defender will run full time on my system that requires a sig base.
As always when things and technology change, the strong will adapt and endure, those that can't will face that inevitable
death that comes with being obsolete.
Awesome thread @Logethica

 

[DJ Panda]

Its not dead "yet" but it is on a fast track to its grave.
In my opinion it's not the effectiveness, its within the way its applied through signatures.
Signature based protection is fast becoming obsolete, started a few years back and has been gaining momentum
ever since. The resource usage does not help as well as having to maintain that large signature database.
Now we have the ability to not wait till a signature is needed with anti exe's which is one more nail in the
coffin.
I don't mind having a small AM or AV as a on demand, but none other than Defender will run full time on my system that requires a sig base.
As always when things and technology change, the strong will adapt and endure, those that can't will face that inevitable
death by becoming obsolete.
Awesome thread @Logethica

Out of curiosity what is different in Defender than other traditional AVs?

 

[_CyberGhosT_]

Out of curiosity what is different in Defender than other traditional AVs?

It's built into Windows 10, so poppa Gates says it has to stay. I go along with this "for now" I dont want to tempt fate this close to Patch time

 

[Deleted member 178]

as Kenshiro of Hokuto Shinken said and i quote : " You don't know yet, but you are already dead"

 

[ravi prakash saini]

Antivirus are in comma but they are in the localities where mercy killing is not allowed

 

[frogboy]

No i do not think AV are dead yet they just need a prop up with some additional software to hold it's hand.

 

[Logethica]

Its not dead "yet" but it is on a fast track to its grave.
In my opinion it's not the effectiveness, its within the way its applied through signatures.
Signature based protection is fast becoming obsolete, started a few years back and has been gaining momentum
ever since. The resource usage does not help as well as having to maintain that large signature database.
Now we have the ability to not wait till a signature is needed with anti exe's which is one more nail in the
coffin.
I don't mind having a small AM or AV as a on demand, but none other than Defender will run full time on my system that requires a sig base.
As always when things and technology change, the strong will adapt and endure, those that can't will face that inevitable
death that comes with being obsolete.
Awesome thread @Logethica

Thanks @_CyberGhosT_ ...
Interesting voting ...thank you to those that have voted and commented so far.

 

[safe1st]

In my opinion..
We still need an antivirus software. But that doesn't mean you are 100% protected. It's all depends on our behavior when use PC.
Even you use best antivirus but you open random links, etc. You will get infected eventually...

 

[jamescv7]

Antivirus is dead in terms of signature based approach.

Which will connect to have multi-layer approach that consist complex components like whitelisting technology.

Yes another fight here will be on digital signature malware attacks, so honestly it's all about on maintaining the tweaks.

-

 

[LabZero]

Antivirus Is Dead - In terms of "Signature-based detection" for protection.

In my opinion, protection based only on the signatures no longer works: the criminals have figured out how to work around it.
AVs based on signatures using a technology to determine if a certain file is legitimate or malicious. This approach has changed very little since it was developed many years ago and today the criminals write malware ever more sophisticated.

Even 1% of malware, which escapes constantly from signature based AV is a serious problem.
Cryptolocker, Cryptowall, TeslaCrypt & CO was undetected by many analysis systems.
These ransomware have caused millions of dollars of damage to businesses with endpoint security that cost thousands of dollars per year and use proactive technologies ...I don't want to think about the signatures....

But we are talking about signatures, so many malware have a structure very precise, but they drops a payload that changes its appearance every time it replicates itself, reorganizing its code, changing encryption.. These functions create a problem of detection, because there are no valid signatures to detect them.
One of the easiest ways to change a malware is the use of encryption.
Everything a malcoder must do is to use a random keys generator to change the malware structure and makes it unrecognizable each time it is copied.

How can AVs signature-based to identify a string of code if this line of source code each time is different because of the encryption ?

AV vendors know about this issue working on parts of a malware that cannot change, that should be section of the malware that crypt/decrypt.
But the malcoders use systems to change the functions of decryption and make them random as the rest of the program.
They add dates that change, random times, algorithms, functions and operations to drop the code into different segments, for example a script that performs the download of other parts of the code while other parts of the malware are embedded, so AVs do not notice the installation.

Those who create malware thinks of ways to make it look anything, but not malware.

 

[NekoHr]

Signature based AV is not dead yet but is becoming less useful. But for regular user who even doesn't know it has it installed it's better than nothing.

 

[Logethica]

Palo Alto says ditch the antivirus approach:
SOURCE: itwire.com (ARTICLE DATE; 15 Aug 2016)

Traditional antivirus (AV) endpoint products give the enterprise a false sense of security, because while they may satisfy regulatory and corporate governance requirements, they do not protect against today's advanced cyber-threats...

Most organisations use traditional, software-based, blacklist definition, AV security products on their endpoints. Regardless cyber breaches continue to increase in frequency, variety and sophistication. AV cannot keep pace and invariably fail to prevent these attacks on endpoints.

Rob Westervelt, research manager, Security Products, IDC, said “The sophistication and frequency of cyberattacks are growing too quickly for legacy antivirus tools that rely on signatures to keep pace. Traps takes an innovative approach to endpoint security, keeping endpoints more secure despite a growing landscape of cyber-threats and reducing the resources required by IT teams to track and install security patches."

To read the full article please visit the link at the top of this post

 

[NekoHr]

Media always reports that AV is dead, but they always mean signature based AV. There are less and less pure signature AVs out there and this confuses less experienced users who just read AV is dead.

 

[FrFc1908]

Traditional AV ( read signature detection ) is nearly dead. malware writers are getting more clever each and every day using sophisticated techniques. this requires sophisticated counter measures! so the future full virtualisation behaviour blocker and so on. even AVG got the hint , that pure signature detection is a prehistorical method!

voted for 2 and 3 by the way.

 

[JakeXPMan]

I voted:

1. Antivirus Is Alive - But only if used as part of a multi-layered security approach.
2. Antivirus Is Alive - One does not need any addition Security Software!

I used to be a multi-layered person and recommend doing so to this day. I also however have tweaked my AV to a point where nothing else is needed to protect my system. Its always good to have something for protection and maybe another tool for scanning the system.

Egg-Zackly... !

No need for me to say more, J Gamez covered it.

 

[Aura]

Antivirus Is Alive - But only if used as part of a multi-layered security approach.

It's that simple. Also by "multi-layered", I mean Antivirus, Antimalware and Firewall. These are the basics of security and everyone should have them. As well as Common Sense Edition of the Year.

 

[Deleted member 178]

mwaahahahahahahahaha they forgot a line.

Palo Alto says ditch the antivirus approach

because they can't use VT anymore

 

[Lucent Warrior]

I chose "anti-virus is alive" but only if used as a layer of a multi layered approach.

I prefer my AV layer to detect by signature upon access to the file as opposed to the file executing and running, being monitored by behavior or reputation, when possible, of course the file not being able to execute at all is preferred. No matter what you are running, if your system becomes infected, and you are not highly skilled at removing malware manually, you will need a signature based product to remove the infection.