Reply to thread

Message

<blockquote data-quote="bazang" data-source="post: 1114368" data-attributes="member: 114717">It is same range for new malware encountered by home users.Some in government state that all AV is no better than 40% effective regardless of the attack types. The idea being that if one does enough large scale testing, eventually all results will converge on that 40% or lower value.Given that I routinely deal with networks full of personnel-created holes that are under constant attack, my experience with AV is that they are ALL - every single brand and version - are unreliable. While some will catch attacks that others do not, in the end they are all far less effective than the AV lab test results lead people to believe.The only effective solutions are system lockdown of all devices including network devices, user lockdown, and disabling of a lot of unneeded or rarely needed OS features. This is the golden rule of blue team operations whether it is Windows, Linux or some other OS.Nobody is ever going to come up with anything more effective than this. And no, it does not make information systems unusable. They are usable but under tightly controlled policies, procedures and practices. This is how effective cybersecurity works. It is just that home users cannot handle it.</blockquote>

[QUOTE="bazang, post: 1114368, member: 114717"] It is same range for new malware encountered by home users. Some in government state that all AV is no better than 40% effective regardless of the attack types. The idea being that if one does enough large scale testing, eventually all results will converge on that 40% or lower value. Given that I routinely deal with networks full of personnel-created holes that are under constant attack, my experience with AV is that they are ALL - every single brand and version - are unreliable. While some will catch attacks that others do not, in the end they are all far less effective than the AV lab test results lead people to believe. The only effective solutions are system lockdown of all devices including network devices, user lockdown, and disabling of a lot of unneeded or rarely needed OS features. This is the golden rule of blue team operations whether it is Windows, Linux or some other OS. Nobody is ever going to come up with anything more effective than this. And no, it does not make information systems unusable. They are usable but under tightly controlled policies, procedures and practices. This is how effective cybersecurity works. It is just that home users cannot handle it. [/QUOTE]

Verification