3 ms·

The real tragedy is that there are still "security" standards bodies mandating that AV software is installed on clients. If you want to be PCI-DSS compliant for

by pilif 7y ago

The real tragedy is that there are still "security" standards bodies mandating that AV software is installed on clients. If you want to be PCI-DSS compliant for example then you better install AV software. Even worse, sometimes the requirements go even farther and require the AV software to be third-party - OS built-in solutions don't count. At this point, the only safe solution is running proper whitelisting to make sure that only authorized binaries get to run and to keep those binaries up-to-date and, if possible, sanboxed. If you have such a setup and then you have to install AV like this because of security-theatre, you're making your security much, much worse (because in order to run AV, you have to whitelist it and because AV is apparently written to quality standards that allow running arbitrary user-supplied JS as SYSTEM)

dTal 7y ago
Who defines what "AV" is? Isn't your whitelisting solution also an "antivirus"?
- detaro 7y ago
  Pretty much every definition defines antivirus as software that inspects files and attempts to decide if they are malware or not (and then blocks access etc).
  - _jal 7y ago
    > (and then blocks access etc) Not so much. I'm required to run AV software on production Linux systems. All it does is write opinions to a log. Insofar as the only reason we run it is checkbox-compliance, I'm fine with it being useless - certainly not asking for some kernel module or something that could actually block access. But I do find it funny.
- SamuelAdams 7y ago
  NIST actually defines most of these standards and definitions. "Antivirus Software" has two: A program specifically designed to detect many forms of malware and prevent them from infecting computers, as well as cleaning computers that have already been infected. A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents. [1]: https://csrc.nist.gov/glossary/term/Antivirus-Software https://csrc.nist.gov/glossary/term/Antivirus-Software
  - blattimwind 7y ago
    > as well as cleaning computers that have already been infected. That's not a thing.
    - zymhan 7y ago
      Well, all AV software seems to offer the option, but I don't know many folks who would trust it alone.
    - deleted 7y ago
      [deleted]
xioxox 7y ago
Right. AV software seems really poor quality. I recently updated my Windows app. VirusTotal showed 14 AV products detected my program as malware, when it clearly wasn't. I tried to report the false positives, but the vendors had terrible and inconsistent ways to do this (or even none for some). Even Microsoft's website didn't work when I tried to upload the program ("upload failed - please try again later"). I searched on the internet, and at least I found a workaround which was to recompile a library I used. This fortunately reduced the false positives down to a few products I hadn't heard of. At this point, it's very hard to trust AV products with anything.

by pilif 7y ago

dTal 7y ago

Who defines what "AV" is? Isn't your whitelisting solution also an "antivirus"?

detaro 7y ago
Pretty much every definition defines antivirus as software that inspects files and attempts to decide if they are malware or not (and then blocks access etc).
- _jal 7y ago
  > (and then blocks access etc) Not so much. I'm required to run AV software on production Linux systems. All it does is write opinions to a log. Insofar as the only reason we run it is checkbox-compliance, I'm fine with it being useless - certainly not asking for some kernel module or something that could actually block access. But I do find it funny.
SamuelAdams 7y ago
NIST actually defines most of these standards and definitions. "Antivirus Software" has two: A program specifically designed to detect many forms of malware and prevent them from infecting computers, as well as cleaning computers that have already been infected. A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents. [1]: https://csrc.nist.gov/glossary/term/Antivirus-Software https://csrc.nist.gov/glossary/term/Antivirus-Software
- blattimwind 7y ago
  > as well as cleaning computers that have already been infected. That's not a thing.
  - zymhan 7y ago
    Well, all AV software seems to offer the option, but I don't know many folks who would trust it alone.
  - deleted 7y ago
    [deleted]

xioxox 7y ago

Right. AV software seems really poor quality. I recently updated my Windows app. VirusTotal showed 14 AV products detected my program as malware, when it clearly wasn't. I tried to report the false positives, but the vendors had terrible and inconsistent ways to do this (or even none for some). Even Microsoft's website didn't work when I tried to upload the program ("upload failed - please try again later"). I searched on the internet, and at least I found a workaround which was to recompile a library I used. This fortunately reduced the false positives down to a few products I hadn't heard of. At this point, it's very hard to trust AV products with anything.