5 ms·

> There is no need for anything. This is a bit of a broad brush. It assumes that all people always act with the best security hygiene. I detest traditional AV

> There is no need for anything. This is a bit of a broad brush. It assumes that all people always act with the best security hygiene. I detest traditional AV as snake oil and realize that there is additional risk added by using AV, but it does have its place in many threat models, especially for those who are not internet+security literate.

QAPereo 9y ago
In particular I'm thinking of my very non-techie mother.
- copperx 9y ago
  Is there a way to lock down Windows 10 nowadays, so that you can only install software from the Windows store?
  - avtar 9y ago
    That seems to be the main feature of Windows 10 S, Microsoft's Chrome OS alternative.
  - 0xfeba 9y ago
    Windows 10S will do just that, whenever it is released.
ktRolster 9y ago
AV will make those people who are not internet+security literate more vulnerable. There have been vulnerabilities found in all major anti-viruses, some of them were really bad. You're better off not using an antivirus. See for example: https://arstechnica.com/information-technology/2017/06/latest-high-severity-flaw-in-windows-defender-highlights-the-dark-side-of-av/ https://arstechnica.com/information-technology/2017/06/lates... Staying up to date on your updates is the best advice you can give.
- FreakLegion 9y ago
  > AV will make those people who are not internet+security literate more vulnerable. There have been vulnerabilities found in all major anti-viruses, some of them were really bad. You're better off not using an antivirus. I don't think you can reasonably defend this position. Let's take a pessimistic guess at the efficacy of antivirus software and say it blocks 50% of the new malware generated in a given day. Now let's take a wildly optimistic stab at the added risk of using antivirus and say it increases your exposure by 1%. Are you really saying that a 1% risk increase is too high a price to pay for halving your risk overall? Don't get me wrong, there are all kinds of reasons for power users to bemoan antivirus. RCE vulnerabilities are certainly one, but even just day-to-day usability issues are a legitimate concern. The average user, though, is still statistically much safer with antivirus. > Staying up to date on your updates is the best advice you can give. The vast majority of attacks don't involve vulnerabilities, even counting events like WannaCry. It's mostly down to people clicking on things they shouldn't be clicking on. Keeping your software updated is important, of course, but absolutely will not keep you safe.
  - mulmen 9y ago
    Oh this looks like a fun game. Let me try. Let's take a pessimistic guess at the efficacy of antivirus software and say it blocks 20% of the new malware generated in a given day. Now let's take a wildly optimistic stab at the added risk of using antivirus and say it increases your exposure by 35%. Are you really saying that a 35% risk increase is an acceptable price to pay for a small reduction in overall risk? You can't just pull numbers out of thin air to make your point. Experience has shown us that antivirus software does not do what it says on the tin.
    - FreakLegion 9y ago
      > You can't just pull numbers out of thin air to make your point. > Experience has shown us that antivirus software does not do what it says on the tin. Whose experience? I built WildFire at Palo Alto Networks[1]. We analyzed a few tens of millions of new potential threats daily, including the VirusTotal firehose. As part of our internal efficacy and competitive monitoring, we took the top 5 enterprise antivirus products and ran everything coming into WildFire through them. The delta between ground truth and what the antivirus engines caught using only static scanning and emulation was about a third, i.e. better than the pessimistic estimate of half I threw out. (In the real world, antivirus actually does better because malware is easier to catch after it starts running.) The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with, and in the scheme of things, very few antivirus vulnerabilities have been found. 1% is just a nice, round number chosen for illustrative purposes; it's orders of magnitude greater than the real risk. Now, this will surprise exactly no one who works in security, since most new malware is a minor variant of existing malware and exploits are relatively uncommon, but for the less experienced folks reading these comments, I implore you: Don't listen to people who say antivirus is useless or, worse, makes you less secure. It isn't. It doesn't. They're wrong. 1. It's the biggest ATP product out there, took the crown from FireEye c. 2015. https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/wildfire https://www.paloaltonetworks.com/products/secure-the-network...

QAPereo 9y ago

In particular I'm thinking of my very non-techie mother.

copperx 9y ago
Is there a way to lock down Windows 10 nowadays, so that you can only install software from the Windows store?
- avtar 9y ago
  That seems to be the main feature of Windows 10 S, Microsoft's Chrome OS alternative.
- 0xfeba 9y ago
  Windows 10S will do just that, whenever it is released.

ktRolster 9y ago

AV will make those people who are not internet+security literate more vulnerable. There have been vulnerabilities found in all major anti-viruses, some of them were really bad. You're better off not using an antivirus. See for example: https://arstechnica.com/information-technology/2017/06/latest-high-severity-flaw-in-windows-defender-highlights-the-dark-side-of-av/ https://arstechnica.com/information-technology/2017/06/lates... Staying up to date on your updates is the best advice you can give.

FreakLegion 9y ago
> AV will make those people who are not internet+security literate more vulnerable. There have been vulnerabilities found in all major anti-viruses, some of them were really bad. You're better off not using an antivirus. I don't think you can reasonably defend this position. Let's take a pessimistic guess at the efficacy of antivirus software and say it blocks 50% of the new malware generated in a given day. Now let's take a wildly optimistic stab at the added risk of using antivirus and say it increases your exposure by 1%. Are you really saying that a 1% risk increase is too high a price to pay for halving your risk overall? Don't get me wrong, there are all kinds of reasons for power users to bemoan antivirus. RCE vulnerabilities are certainly one, but even just day-to-day usability issues are a legitimate concern. The average user, though, is still statistically much safer with antivirus. > Staying up to date on your updates is the best advice you can give. The vast majority of attacks don't involve vulnerabilities, even counting events like WannaCry. It's mostly down to people clicking on things they shouldn't be clicking on. Keeping your software updated is important, of course, but absolutely will not keep you safe.
- mulmen 9y ago
  Oh this looks like a fun game. Let me try. Let's take a pessimistic guess at the efficacy of antivirus software and say it blocks 20% of the new malware generated in a given day. Now let's take a wildly optimistic stab at the added risk of using antivirus and say it increases your exposure by 35%. Are you really saying that a 35% risk increase is an acceptable price to pay for a small reduction in overall risk? You can't just pull numbers out of thin air to make your point. Experience has shown us that antivirus software does not do what it says on the tin.
  - FreakLegion 9y ago
    > You can't just pull numbers out of thin air to make your point. > Experience has shown us that antivirus software does not do what it says on the tin. Whose experience? I built WildFire at Palo Alto Networks[1]. We analyzed a few tens of millions of new potential threats daily, including the VirusTotal firehose. As part of our internal efficacy and competitive monitoring, we took the top 5 enterprise antivirus products and ran everything coming into WildFire through them. The delta between ground truth and what the antivirus engines caught using only static scanning and emulation was about a third, i.e. better than the pessimistic estimate of half I threw out. (In the real world, antivirus actually does better because malware is easier to catch after it starts running.) The danger of antivirus, on the other hand, is wildly overstated in this thread. A small fraction of attacks use vulnerabilities to begin with, and in the scheme of things, very few antivirus vulnerabilities have been found. 1% is just a nice, round number chosen for illustrative purposes; it's orders of magnitude greater than the real risk. Now, this will surprise exactly no one who works in security, since most new malware is a minor variant of existing malware and exploits are relatively uncommon, but for the less experienced folks reading these comments, I implore you: Don't listen to people who say antivirus is useless or, worse, makes you less secure. It isn't. It doesn't. They're wrong. 1. It's the biggest ATP product out there, took the crown from FireEye c. 2015. https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/wildfire https://www.paloaltonetworks.com/products/secure-the-network...