4 ms·

A more nuanced title would be: "To continue its fight against new viruses, Netflix is dumping classical disk-scanning-fingerprints software for newer technolog

by jasode 11y ago

A more nuanced title would be: "To continue its fight against new viruses, Netflix is dumping classical disk-scanning-fingerprints software for newer technologies such as statistical analysis of anomalies." Netflix and whoever they hire (e.g. SentinelOne) is still fighting viruses. They're just doing it using more sophisticated algorithms instead of fingerprints. Traditional anti-virus software trying to match file signatures is not effective against 0-day attacks. What's newsworthy is that a vendor was able to convince important people (e.g. AV-TEST Institute) that algorithms scanning for anomalies is equivalent to, or stronger than, traditional disk-scanning. However, it doesn't look like they've convinced the credit-card industry yet. They're the ones who determine PCI DSS compliance. However, PCI DSS may not apply to Netflix. Interpreting the story as an ongoing progression of anti-virus technology, it means the industry won't "die" at all. They're just retooling themselves with more algorithmic approaches. Maybe Symantec will add algorithms and also be included in the changing industry of fighting viruses.

dogma1138 11y ago
PCI-DSS applies to Netflix very much, they probably still will have traditional AV in their CHD environment and any other system in scope of the certification (e.g. the desktops the sysadmins use to administer servers within the CHD environment). Also the PCI council doesn't define which AV is compliant or not, only states that you need anti-virus protection on all systems commonly affected by malicious software. It's up to the QSA and acquirer(if that one gets really bored) to accept the solution, neither of which care really. You can use Windows Defender, Clam or the most super duper expensive AV out there it's all the same for them. The requirement is also worded very carefully "on all systems commonly affected by malicious software" so people could make a case against installing AV on things that AV solutions are not common for, such as Mac's, Linux box's, and even Mainframes (yes there are mainframes in certain PCI-DSS scope's because the QSA wasn't smart enough to find a loop hole to keep it out of scope or the costumer is dumb enough to actually process or store credit cards on it).
dr_zoidberg 11y ago
I work in digital forensics, and running Volatility against the memory (either online or against a memory dump), helps give a far deeper insight and way higher probability at finding viruses than standard "antivirus" software. You can even find Advanced Persistent Threats (APTs) and "unidentified" viruses, because what you look for are the mechanisms by which a virus resides in memory: hidden processes, hooks to system calls, spurious DLLs, etc. Ever since I learned about memory analysis, I have considered almost every antivirus useless. I do have the Windows Defender antivirus active, but if I have a real doubt, I turn to memory analysis just to be sure (still clean luckily!).

by jasode 11y ago

dogma1138 11y ago

PCI-DSS applies to Netflix very much, they probably still will have traditional AV in their CHD environment and any other system in scope of the certification (e.g. the desktops the sysadmins use to administer servers within the CHD environment). Also the PCI council doesn't define which AV is compliant or not, only states that you need anti-virus protection on all systems commonly affected by malicious software. It's up to the QSA and acquirer(if that one gets really bored) to accept the solution, neither of which care really. You can use Windows Defender, Clam or the most super duper expensive AV out there it's all the same for them. The requirement is also worded very carefully "on all systems commonly affected by malicious software" so people could make a case against installing AV on things that AV solutions are not common for, such as Mac's, Linux box's, and even Mainframes (yes there are mainframes in certain PCI-DSS scope's because the QSA wasn't smart enough to find a loop hole to keep it out of scope or the costumer is dumb enough to actually process or store credit cards on it).

dr_zoidberg 11y ago

I work in digital forensics, and running Volatility against the memory (either online or against a memory dump), helps give a far deeper insight and way higher probability at finding viruses than standard "antivirus" software. You can even find Advanced Persistent Threats (APTs) and "unidentified" viruses, because what you look for are the mechanisms by which a virus resides in memory: hidden processes, hooks to system calls, spurious DLLs, etc. Ever since I learned about memory analysis, I have considered almost every antivirus useless. I do have the Windows Defender antivirus active, but if I have a real doubt, I turn to memory analysis just to be sure (still clean luckily!).