7 ms·
I'm at a loss trying to capture the absurdity of this, but I'll try.. Smith finally escaped Oceania and made a nice home for himself in a free land with free pe
by skinney6 6y ago
I'm at a loss trying to capture the absurdity of this, but I'll try..
Smith finally escaped Oceania and made a nice home for himself in a free land with free peoples. One day agents from Oceania show up at his door. "No hard feelings bud. In fact we brought a gift. We think it will help you. We want to install these little black boxes all throughout your home."
Smith is all ... "ok".
- detaro 6y agoIt's probably more "Our customers have policies/certifications requiring they have antivirus software everywhere, even if that's stupid. We could tell those customers that we can't offer a solution and they'll go somewhere else. Or we could make the thing they 'need' and get their business". Not very absurd at all.
- ancarda 6y agoCan those customers not install ClamAV? Does that not count as anti-virus?
- tw04 6y agoCan I buy an enterprise support contract for it? I honestly don’t see an option on the site. That’s usually a hard requirement in the enterprise.
- greedo 6y agoCisco AMP is just re-badged ClamAV.
- tgtweak 6y agoFun fact that doesn't actually pass on pci-dss1 audit. You need a commercial antivirus with active subscription and centralized monitoring of that. Also I'm guessing it's easier for admins of mixed infra to have a single threat definition (ie. So your storage server catches the same threats as your endpoints)
- greedo 6y agoActually, most assessors won't require A/V on Linux. 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). It's typically an ignorant CISO/CSO who wants to mark a checkbox...
- dingaling 6y agoIt's not necessarily ignorance, but also risk management. Who is the CIO to say that Linux is exempted from that condition? He'd need a stack of evidence that it's not commonly affected, which would need to be kept up to date . Easier just to say "AV on everything".
- greedo 6y agoA CSO/CISO should be aware of what the threats to their environment are. Otherwise how can they effectively mitigate the risk? They should rely upon SMEs who can keep them abreast of changes in threat models.
- tgtweak 6y agoPretending Linux can't host or be affected by malware is a pretty ignorant thing for any ciso/cto to do.
- jorangreef 6y agoIf you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits. At the same time, ClamAV has a terrifying CVE track record. There's no upside, and all downside.
- 8organicbits 6y agoCVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products. ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?vendor_id=8871 https://www.cvedetails.com/product/15657/Clamav-Clamav.html?... Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antivirus.html?vendor_id=76 https://www.cvedetails.com/product/398/Symantec-Norton-Antiv... Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-Defender.html?vendor_id=26 https://www.cvedetails.com/product/9767/Microsoft-Windows-De... It may be safer to say that the CVE record for most AV software isn't great.
- jka 6y agoAs I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed. That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.
- acdha 6y ago> Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly. That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.
- snuxoll 6y agoGod I wish - central management and logging is mandatory under all of these compliance regimes. We’re in the middle of adopting HiTrust and I’ve been forced to install Cisco AMP on all of my servers. The product is absolute garbage and frequently eats up all available RAM, causing itself to crash and leave a core dump filling up my root partition. The worst part? AMP on Linux is literally ClamAV plus a kernel module to monitor file access, network connections and process creation.
- greedo 6y agoWe've deployed AMP across our RHEL environment, and experienced the exact issues you've described. Cisco's general remediation is to increase the exclusion policy til the core dumps stop occurring. On some systems, AMP is barely monitoring any filesystems...
- QuesnayJr 6y agoI've experienced this at one workplace, and I had to install some anti-virus software on my Linux workstation. But it already existed. (It may have even been open source.) I'm not sure how it helps Microsoft to also introduce a product for this.
- detaro 6y ago> I'm not sure how it helps Microsoft to also introduce a product for this. People don't give Microsoft money for a product that's not by Microsoft. If Microsoft offers one, and can even claim that they cover all platforms with one overarching offering, companies pay them for it.
- annoyingnoob 6y agoGoogle Cybersecurity Maturity Model Certification You may not want a product like this on Linux. But if you do business in the DoD supply chain, even way down the chain, then you will be required to do so.
- de_watcher 6y agoYou've just defined an absurd and then said that it's not absurd...
- jordanbeiber 6y agoThis whole thing is a catch 22 - to be taken ”seriously” with enterprise IT you need this badge to show that you are vulnerable. If you’re not vulnerable and don’t need the badge you can’t be taken seriously. It’s all very amusing!
- detaro 6y agofair. But IMHO not absurd in the sense the parent said, and not absurd for MS to do to get benefit in a somewhat absurd situation.
- AMerrit 6y agoI work at a similar cybersecurity company and I can almost guarantee this is the case. Company policy will be to put an AV on everything, and the CSO/procurement always prefer a one size fits all solution so they only have to deal with one vendor. How well it works on Linux is secondary to the fact that it makes it easy for them to hit all the checkboxes in compliance reports.
- unixhero 6y agoThis is absolutely the reality. Spot on mate. I am one of those people ensuring compliance. Even though it doesn't matter, I guess it's a compliance thing. For some businesses GRC matters!
- fomine3 6y agoIn my experience, Trend Micro's antivirus is bullshit not only on Windows but also on Linux. I'm happy if MS Defender for Linux is available and corp adopted it.
- ancarda 6y agoI think it depends if it's free (GPL/MIT/etc) software or not. Then it's truly a gift, rather than a black box Though I have a hunch this won't be free software and will have all kinds of telemetry you can't disable.
- jedieaston 6y agoI mean, it's designed to capture telemetry and push it into Azure for IT to figure out whats going on in the enterprise. It isn't aimed at consumers.
- paulie_a 6y agoIf this does what it designed for that is great. The Linux ecoystem has consistently p it their fingers in their ears and stop informing the very real and long outstanding problems of malware and apts
- ubercow13 6y agoWhat about the very real and long outstanding problems of antivirus software?
- paulie_a 6y agoWhat about it? Are those applicable to my reply at all?so worst case scenario Microsoft took the scamiest approach to it possible but it still defeats something. Vs no protection at all because Linux users blatantly ignore apts Those are the options. Head completely in sand or get some sand in your eyes
- badrabbit 6y agoHad to double check if we were reading the same post. This isn't meant for home users. It costs a lot of money and is targeting enterprise users. Defender ATP is like Carbonblack or Crowdstrike falcon which support windows and Linux. MS finally supports Linux to compete better. It's a great product but you need E5 license for it.
- ghostpepper 6y agoSo it's not the same windows defender product given to consumers? What additional features does Defender ATP have?
- staticassertion 6y agoDefender ATP is closer to an EDR tool, which means it's designed for detection and response teams, not individual users. It'll take more a reporting and contextualizing approach than an av that is typically blocking.
- badrabbit 6y agoIt's not an antivirus, it doesn't care about binary signatures. It looks attack patterns based on known attacker behavior. A good linux example would be httpd starting netcat that connects to a remote port. Or firefox spawning a bash shell. For windows a simple example would be when an office app starts wscript or powershell and that child process schedules taks, wmi, downloads a payload,etc... Those are simple examples but they track more complex attack scenarios, for cloud hosted solutions like defender atp and crowdstrike they also collect everything that happens on every device of every customer, so if they find new malware or an attacker with a certain TTP on one device, they will deploy rules to catch that for all their customers.