3 ms·
"Nextgen"AV would not have caught this. AV is still AV and looking at executables and binaries. Exploiting a vulnerability does not fit that bill. This incident
by p0rkbelly 8y ago
"Nextgen"AV would not have caught this. AV is still AV and looking at executables and binaries. Exploiting a vulnerability does not fit that bill. This incident had nothing to do with a 'virus'. Now many tools that include AV, say Crowdstrike, may have caught this...but AV is on the low-end of the hierarchy of needs when it comes securing your assets, especially servers. Much more so for Linux. AV is more of an end-user issue where they want to download files and execute them.
- badrabbit 8y agoCrowdstrike,Carbonblack,windows atp,etc... Are "nextgen av". You can call them by their self proclaimed category as well.
- p0rkbelly 8y agoCarbon Black and Crowdstrike were traditionally EDR platforms. Crowdstrike had no AV capabilities until last year. They have now morphed into the EPP category as per Gartner. They are a now a suite of tools, where AV is just a single part of it that is the least important. Any beyond that, "NextGen AV would have caught this" is the original premise. Nextgen tools were not needed. All they had to do was patch a well known Vulnerability within a period of MONTHS. You can buy the fancy tools. If you can't do the basics, they are worthless.
- badrabbit 8y agoYeah but you'll always have unpatched vulns or 0days. You should patch but you should also account for when patching isn't enough. Sometimes servers get missed. Some places even have forgotten servers that aren't part of asset management. Some places don't have asset management. The fancy tools are not a onse size fits all solution just like patching and goof security hygeine isn't.