15 ms·
I've often felt that antivirus software is like the rock that keeps the tigers away. I haven't used it since the AOL days, and that's also the last time I was a
by beart 7y ago
I've often felt that antivirus software is like the rock that keeps the tigers away. I haven't used it since the AOL days, and that's also the last time I was actually hit with Malware (something from Kazaa I would guess.)
It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something? I'm curious what the actual statistics are for caught viruses.
- Spooky23 7y agoFor corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing. The newer products are different and more effective, and come with an appropriate price tag. (The Microsoft solution costs as much as O365!)
- 52-6F-62 7y ago> For corporate IT, it’s a compliance requirement. It is the equivalent of putting a sign in the bathroom that says to wash your hands, only less effective. AV does almost nothing and costs almost nothing. Corporate IT at my previous employer even allowed and aided us in uninstalling the resource-hogging McAfee installation that comes default with a company machine. That stuff was crippling our machines.
- bradknowles 7y agoWe loved it at a previous employer when the corporate-approved Endpoint Protection Solution silently installed a new firewall component, without telling anyone. Of course, it is (was?) a requirement of the corporate-approved Mobile Device Management system. Broke everyone in the company for weeks (?), because the only thing it allowed was ports 80 and 443. No one could figure out what the problem was, because the OS-standard firewall configuration clearly showed that all the required ports were open, and therefore it couldn't possibly be a firewall problem. Well, at least it broke all those people who had the corporate MDM software installed on their machines. Those who had a different MDM installed and so could not install the corporate MDM, well those people were able to get regular work done.
- 52-6F-62 7y agoOh man. Are you talking about Triton? I'm forced to endure that for now as well. It's terrible. It actively attempts to inject its own version of libwebp into nearly every single build and breaks them because it's not signed! It's maddening, and crippling! We've recently moved umbrella companies, so that software will hopefully be going the way of the buffalo, but I can't even run Vagrant on my machine because of it.
- guelo 7y agoComply with what?
- Spooky23 7y agoIf you do any business with the US federal/state/local government, healthcare, criminal justice, Tax collections, most financial institutions, you've signed a contract where you agreed to do a bunch of stuff, including this. AV minimally checks a box.
- freehunter 7y agoFor those that might not understand the compliance requirement, PCI compliance is a good example. If you process credit card payments, you need to be PCI (Payment Card Industry) compliant. And PCI DSS Requirement 5.1 [1] states >Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). So most enterprise companies have to have AV on their workstation and servers (yes Mac and Linux too) in order to keep processing credit card payments. [1] https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_1.pdf https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_...
- LMYahooTFY 7y agoDoes this apply to things like Square card readers plugged into an iPhone?
- freehunter 7y agoIn that case Square is the payment processor. The vendor using the Square reader is not required to be PCI DSS compliant, only Square is. Same for accepting Paypal, Stripe, etc.
- notyourday 7y ago> Same for accepting Paypal, Definitely not the case for Paypal. As soon as the charges cross certain rolling dollar amount, one needs to complete a security assessment that requires AV in addition to a pile of other idiotic things - such as a specific set of signatures returned by the web servers in a scan by TrustWave. Unrecognized signature? Failed! Source: first hand experience.
- freehunter 7y agoIs that Paypal's requirement, or a PCI DSS requirement?
- notyourday 7y ago
- magduf 7y ago>It's also worth noting that every corporate IT department I've ever seen installs antivirus software on employee machines, so it must be good for something? Yes, it absolutely is good for something. Antivirus software is excellent for making companies like McAfee highly profitable, and it's also really good for slowing down your computer.
- saiya-jin 7y agoOwners of the Avast, 2 Czech guys, are ranked among the wealthiest Czechs ever. I mean one has net worth over 1 billion USD, the other at least the same. I had some respect for them some time ago, but these days their product is shit and worse than having nothing. Plus with Windows defender, who still actually pays for it?
- lotsofpulp 7y agoIt’s to let the higher ups cover their ass by being able to say they tried to do prevent malware.
- finnh 7y agoIt's good for meeting compliance requirements.
- avh02 7y agoprobably for checking various compliance tickboxes
- flir 7y agoWell... do you want to stand up in court some day and explain why you didn't install A/V software? It reduces risk, just maybe not the risk we expect it to.
- BlueTemplar 7y agoWell, after this, it's pretty clear that "anti-virus" software is itself malware, so this should not be an issue ?
- johngalt 7y agoSysadmin here. We install AV to tick the box. It doesn't add much to the security equation, and hasn't for years. For prevention, limited roles/access and patching does all the heavy lifting. Detection happens on the server and network side. Otherwise we are expecting a compromised device to know/report itself. Remediation is a wipe and reload from known sources. When properly automated it is faster than running a full AV scan, and much more reliable.
- notyourday 7y ago> Sysadmin here. We install AV to tick the box. Ding! Ding! Ding! Does your company need to accept credit cards? Guess what? You must have AV as there are only two choices in a self assessment form: [ ] Anti-virus and anti-malware software is deployed on all systems used by the company staff. [ ] Anti-virus and anti-malware software is not deployed on all systems used by the company staff. Selecting the 2nd makes one fail self-assessment which in turn denies company's ability to accept credit cards. Security is a charade.
- gruez 7y agowould windows defender count as antivirus software?
- notyourday 7y agoWe were provided with a very large list of AV software (~2 printed pages long). Windows Defender was not on it. It was decided the risk of using software not on the list was not worth it.[0] [0] It was the 2nd annual assessment/audit I was involved in -- during the first one the sticking point was that our user-facing website was exposed to users via a CDN that was detected by the vulnerability scanner as some PHP application, which caused us to fail that test. Needless to say we did not want to deal with such mess again.
- donmcronald 7y agoThat industry seems like a dumpster fire. I once saw an assessment that includes a regular firewall scan. Apparently everyone locks down their firewall, triggers the scan, re-opens their firewall. I guess as long as everyone's getting paid...
- jcranmer 7y agoAntivirus was more necessary back in the days when firewalls and security elevation privileges were rarely enabled on consumer machines. But more modern security software has rather weakened the value proposition for AV, and they've started branching into areas that aren't really helpful at all and sometimes counterproductive (e.g., web browsing protection--your AV does a much, much worse job of validating TLS than browser vendors do). Given the dirty things that AV does to "work" correctly, you can characterize modern AV as malware that tries to keep other malware out.
- tptacek 7y agoI don't think this is true. Generally, I think that privilege levels are a red herring, and that being able to get malware running at the privilege of the user installing it is sufficient; to the extent that this is changing, it's changing only recently. I'd say that the problem with AV is that it has never worked at all; it's always been a "deck chairs on the Titanic" performative spot clean situation – at best, a smart team that reimages a machine with a confirmed "infection" can say they're using AV as a weak sort of host intrusion detection system. AV or no AV, for as long as I can remember (back into the 1990s), if your desktop is "infectable", you're screwed. You'd think that the Summer of Worms would have confirmed that for everyone, but AV is an extremely powerful marketing product category, because of its built-in per-seat multiplier.
- cpach 7y agoI’m curious when you say AV, do you also include solutions such as Windows Defender/Windows Defender ATP/CrowdStrike Falcon in that category?
- marrs 7y agoDo they have a 100% track record of preventing viruses from being installed on your system? Once your system is compromised, it's compromised. There's nothing the AV can do. It's the OS (and to a lesser extent user practice) that's going to limit the damage.
- Sophistifunk 7y agoCorporate AV is like the guy who makes you throw out your ware bottle at the airport. It's a delicate blend of ass-covering and theatre.