Antivirus is always a "closing the barn door after the horse has left"... it's completely reactionary/inadequate as it almost always relies on other people repo

Antivirus is always a "closing the barn door after the horse has left"... it's completely reactionary/inadequate as it almost always relies on other people reporting a problem, so it's always behind and a Tragedy of the Commons in that very little of actual malware is ever reported. HIDS isn't much better. NIDS is slightly more useful as it's independent of the endpoint, but can also be evaded to a degree. Both HIDS/NIDS aren't great on their own because they're really the last lines of defense to tell you you're pwned. In previous life, I inherited a bunch of Win2k database servers that were running on unfiltered public IPs (yuck!).. and several of them had undetectable, stealth rootkit malware that wasn't economically-feasible to remove (Microsoft and Winternals were in the loop).. and because they "couldn't be reimagined," network rules were used to disconnect it from bot operations. Yuck. Don't put unsecured or fragile anything on public IPs because odds are they will be pwnes with variants of malware no AV has ever seen, and it will be a persistent threat (APT) that won't be evident until later. The best defenses include, but aren't limited to: - Never run untrusted code. - Never allow untrusted write and execute. - Don't do email / browser operations with admin credentials. Do it in a VM maybe or a separate machine as a normal, unprivileged user is best. - Least privilege, all the things. - Verify cryptographic signatures enforcing chain-/web-of-trust of source/binaries/packages. - Holistic defense-in-depth. - Minimalism/minimal attack surfaces. - Don't run fragile, unconfigured OSes on unfiltered public IP's. (Please.)