4 ms·
Yes, I believe there are several precedents. Tavis has found remote code execution exploits in Sophos[1] and TrendMicro[2] products too. Continuous protection
by gmac 10y ago
Yes, I believe there are several precedents. Tavis has found remote code execution exploits in Sophos[1] and TrendMicro[2] products too.
Continuous protection by nature opens up an enormous attack surface, and AV vendors' seem in no way up to the challenge. For this reason, in my company, security policy is to use only what's built in to each O/S.
[1] http://www.pcworld.com/article/2013580/researcher-finds-critical-vulnerabilities-in-sophos-antivirus-product.html http://www.pcworld.com/article/2013580/researcher-finds-crit...
[2] http://arstechnica.co.uk/security/2016/01/google-security-researcher-excoriates-trendmicro-for-critical-av-defects/ http://arstechnica.co.uk/security/2016/01/google-security-re...
- Spooky23 10y agoThat's a progressive stance that few organizations have the balls to implement. In one case, a contractural compliance thing required that we have AV be present. We complied, but disabled the filter driver and let it scan nothing. ;)
- _asummers 10y agoI'm sure your legal team was thrilled when you approached them with that, haha.
- gmac 10y agoWe're small enough not to have a legal team yet. But if we did, this is not something I'd be overruled on easily. The technical issues seem pretty clear cut, and if you have a written policy in place (and it was there before anything bad happened) I can't see how it's a genuine risk. It was also no problem for our ISO27001.
- rhizome 10y agoIf you're using Windows, does Microsoft Security Essentials (or whatever its current name is) not qualify?